OpenShell is a runtime for autonomous AI agents that executes them in sandboxed environments governed by declarative policies. It is used to restrict agents' access to files, credentials, data, and network resources, and the catalogue includes skills and workflows for operating and contributing to it.
Borrowing it
Nothing to install: this file belongs to NVIDIA/OpenShell. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/NVIDIA/OpenShell/main/AGENTS.mdgit clone --depth 1 https://github.com/NVIDIA/OpenShellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/nvidia/openshell/agents-md)<a href="https://agentmods.dev/instructions/nvidia/openshell/agents-md"><img src="https://agentmods.dev/badge/instructions/nvidia/openshell/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/nvidia/openshell/agents-md"><img src="https://agentmods.dev/badge/instructions/nvidia/openshell/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.04057 | $0.04057 |
| Opus 5.5 | $0.01623 | $0.01623 |
| Sonnet 5.5 | $0.00811 | $0.00811 |
| Haiku 4.5 | $0.00406 | $0.00406 |
Grade A, and why
OpenShell AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Instructions
This file is the primary instruction surface for agents contributing to OpenShell. It is injected into your context on every interaction — keep that in mind when proposing changes to it.
See CONTRIBUTING.md for build instructions, task reference, project structure, and the full agent skills table.
Project Identity
OpenShell is built agent-first. We design systems and use agents to implement them — this is not vibe coding. The product provides safe, sandboxed runtimes for autonomous AI agents, and the project itself is built using the same agent-driven workflows it enables.
Skills
OpenShell has two skill collections:
skills/contains public, installable skills for using and operating OpenShell. These skills must work outside a source checkout and use installed CLI help plus published documentation as their sources of truth..agents/skills/contains internal contributor and maintainer workflows for developing OpenShell. Your repository-aware harness can discover and load them natively.
Do not rely on this file for a full inventory. The detailed public and contributor skill tables are in CONTRIBUTING.md (for humans).
Architecture Overview
| Path | Components | Purpose |
|---|---|---|
crates/openshell-cli/ |
CLI binary | User-facing command-line interface |
crates/openshell-server/ |
Gateway server | Control-plane API, sandbox lifecycle, auth boundary |
crates/openshell-credential-issuer/ |
Embedded credential issuer | Credential storage, built-in refresh execution/recovery/scheduling, typed secret owners, and existing driver transport |
crates/openshell-sandbox/ |
Sandbox runtime | Capability-free workload launcher, process identity, and seccomp-mediated I/O |
crates/openshell-supervisor/ |
Supervisor runtime | Gateway session, policy evaluation, credentials, and upstream networking |
crates/openshell-supervisor-control/ |
Shared supervisor control | Gateway-owned assignment controller, launch registrations, recovery coordination, and host observations for a supervisor shared by many sandboxes |
crates/openshell-binary-identity/ |
Binary identity | Shared trusted procfs executable identity resolution for isolation backends |
crates/openshell-isolation-interface/ |
Isolation backend interface | Shared data and validation for the Isolation Backend RPC contracts |
crates/openshell-sandbox-backend/ |
OpenShell sandbox backend | Concrete Isolation Backend RPC client and authenticated Sandbox Protocol shared with openshell-sandbox |
crates/openshell-policy/ |
Policy engine | Filesystem, network, and process constraints |
crates/openshell-policy-schema/ |
Authored policy schema | Dependency-light YAML/JSON representation, bounded parsing, and pure authored-language semantics |
crates/openshell-bootstrap/ |
Gateway metadata | Gateway registration metadata, auth token storage, mTLS bundle storage |
crates/openshell-gateway-interceptors/ |
Gateway interceptors | Intercepts and transforms configured gRPC requests at the gateway routing boundary |
crates/openshell-ocsf/ |
OCSF logging | OCSF v1.8.0 event types, builders, shorthand/JSONL formatters, tracing layers |
crates/openshell-ocsf-validate/ |
OCSF validation | Test-time validation of OCSF events against vendored OCSF JSON Schemas |
crates/openshell-otel/ |
OpenTelemetry support | Shared OTLP trace provider, resource, and tracing-layer construction |
crates/openshell-otel-test-support/ |
OpenTelemetry test support | Shared loopback OTLP collector fixture for tracing tests |
crates/openshell-crypto/ |
Crypto backend | Backend-neutral primitives and TLS, PKI, JWT adapters; AWS-LC implementation |
crates/openshell-core/ |
Shared core | Common types, configuration, error handling |
crates/openshell-extension-core/ |
Extension core | Shared extension identity, JWT claims, bearer-token rotation, and TLS transport primitives |
crates/openshell-gateway/ |
Gateway binary composition | Links selected first-party compute drivers into the backend-agnostic server registry |
crates/openshell-sdk/ |
Shared client SDK | Async Rust gateway client (gRPC transport, TLS, OIDC refresh, edge tunnel); consumed by CLI, TUI, and @openshell/sdk |
crates/openshell-providers/ |
Provider management | Credential provider backends |
crates/openshell-tui/ |
Terminal UI | Ratatui-based dashboard for monitoring |
crates/openshell-driver-kubernetes-secrets/ |
Kubernetes Secrets credential driver | In-process CredentialDriver backend for OpenShell-managed K8s Secret storage |
crates/openshell-driver-vault/ |
Vault credential driver | In-process CredentialDriver backend for Vault-compatible KV storage |
crates/openshell-driver-db-credstore/ |
Database credential driver | In-process CredentialDriver backend for gateway database credential storage |
crates/openshell-driver-kubernetes/ |
Kubernetes compute driver | In-process ComputeDriver backend for K8s sandbox pods |
crates/openshell-driver-docker/ |
Docker compute driver | In-process ComputeDriver backend for local Docker sandbox containers |
crates/openshell-driver-podman/ |
Podman compute driver | In-process ComputeDriver backend for local Podman sandbox containers |
crates/openshell-driver-vm/ |
VM compute driver | Standalone libkrun-backed ComputeDriver subprocess (embeds its own rootfs + runtime) |
crates/openshell-driver-mxc/ (windows branch) |
Microsoft MXC compute driver | Native Windows ProcessContainer backend; see the Windows branch for the maintained implementation |
crates/openshell-mxc-boundary/ (windows branch) |
Windows sandbox boundary | Dedicated Windows workload boundary paired with the host supervisor |
crates/openshell-prover/ |
Policy prover | Policy verification and proof generation |
crates/openshell-prover-cli/ |
Policy prover CLI | Standalone local policy boundary checks |
crates/openshell-supervisor-middleware/ |
Middleware runtime | Generic middleware registry, remote service integration, and chain execution |
crates/openshell-supervisor-middleware-builtins/ |
Built-in middleware | First-party in-process middleware implementations |
crates/openshell-supervisor-network/ |
Network supervisor | Proxying, L7 enforcement, policy evaluation, and provider credential injection |
crates/openshell-supervisor-process/ |
Process supervisor | Process lifecycle, namespace, and bypass monitoring |
crates/openshell-vfio/ |
VFIO support | PCI and GPU passthrough preparation and lifecycle |
python/openshell/ |
Python SDK | Python bindings and CLI packaging |
sdk/typescript/ |
TypeScript SDK | Native Connect client, curated sandbox API, and generated protobuf types |
proto/ |
Protobuf definitions | gRPC service contracts |
tests/testkit/ |
E2E testkit | Support library and #[testkit::test] attribute for SDK-driven E2E suites |
tests/suites/ |
E2E suites | One directory per test family, such as conformance |
deploy/ |
Docker, Helm, K8s | Dockerfiles, Helm chart, manifests |
docs/ |
Published docs | MDX pages, navigation, and content assets |
fern/ |
Docs site config | Fern site config, components, and theme assets |
skills/ |
Public agent skills | Installable workflows for using and operating OpenShell |
.agents/skills/ |
Contributor agent skills | Repository-aware workflows for developing OpenShell |
.agents/agents/ |
Agent personas | Sub-agent definitions (e.g., reviewer) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +4 tokens per session 75fa21111182
- yesterday Changed · -4 lines · -57 tokens per session 8827dd475a4d
- 6d ago Changed · +25 tokens per session 2b0f7e7fcb16
- 8d ago Changed · +2 lines · +64 tokens per session 280fc9faea23
- 10d ago Changed · +1 lines · +81 tokens per session dcff889d04e1
- 14d ago Changed · +8 tokens per session 298c34061204
- 15d ago Changed · +1 lines · +49 tokens per session feec69763e67
- 18d ago Changed · +2 lines · +122 tokens per session 9f94e7144c4a
- 21d ago Changed · -11 tokens per session a2368dd99878
- 22d ago First seen · 241 lines · 3,772 tokens per session scan A e4777d4a0b59
OpenShell AGENTS.md is an instructions file published in the GitHub repository NVIDIA/OpenShell (21,172 stars, last pushed yesterday), licensed Apache-2.0. It adds 4,057 tokens to every session, about $0.0162 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
OpenShell AGENTS.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| OpenShell AGENTS.mdNVIDIA/OpenShell | Instructions file | 21k | yesterday | Apache-2.0 | A | 4,057 | Codex, OpenCode |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | today | MIT | A | 7,461 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 5,516 | GitHub Copilot |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | today | MIT | A | 4,680 | Codex, OpenCode |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |