The Operating System for AI Agents
Kernel-level governance for autonomous AI agents. Stop hoping your agents behave—enforce it.
Get Started in 5 Minutes View on GitHub
Kernel-level governance for autonomous AI agents. Stop hoping your agents behave—enforce it.
Get Started in 5 Minutes View on GitHub
Traditional agent safety relies on prompts: “Please don’t do dangerous things.”
The agent decides whether to comply. That’s not safety—that’s hope.
Agent OS applies operating system concepts to AI agent governance. Just like Linux doesn’t ask applications to behave—it enforces permissions—Agent OS doesn’t ask agents to be safe—it enforces policies.
1
2
3
4
5
6
7
8
9
10
11
from agent_os import KernelSpace
kernel = KernelSpace(policy="strict")
@kernel.register
async def my_agent(task: str):
# Your agent code here
return process(task)
# Every action is checked against policies
result = await kernel.execute(my_agent, "analyze data")
Zero violations. Not because agents are trained to behave, but because the kernel won’t let violations execute.
Define what agents can and cannot do. Block destructive SQL, file deletes, secret exposure—before execution.
SIGKILL, SIGSTOP, SIGCONT—control agent execution like processes. Non-catchable termination on violations.
Verify outputs across multiple LLMs. Detect hallucinations through consensus, not trust.
Immutable, append-only ledger of agent experiences. Time-travel debugging. Learn from mistakes.
Cryptographic signing of messages between agents. Know exactly who said what.
Prometheus metrics, OpenTelemetry tracing, Grafana dashboards—see everything your agents do.
1
pip install agent-os
Or with all features:
1
pip install agent-os[full]
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
from agent_os import KernelSpace
# 1. Create kernel with strict policy - blocks destructive operations
kernel = KernelSpace(policy="strict")
# 2. Register your agent function with the kernel
@kernel.register
async def my_agent(task: str):
# Your LLM logic here - any framework works
return f"Processed: {task}"
# 3. Execute through the kernel - all actions are policy-checked
import asyncio
result = asyncio.run(kernel.execute(my_agent, "Hello, Agent OS!"))
print(result) # Output: Processed: Hello, Agent OS!
| Line | What it does |
|---|---|
KernelSpace(policy="strict") |
Creates a kernel that blocks file writes, destructive SQL, shell commands, and secret exposure |
@kernel.register |
Wraps your function so every call goes through the policy engine |
kernel.execute() |
Runs your agent with governance—violations trigger SIGKILL before execution |
@kernel.register wraps your function with kernel governancekernel.execute() runs your agent through the policy engineSIGKILL before execution“Reduced our compliance review time from 2 weeks to 2 days. The audit logs alone saved us.”
— DevOps Lead, Fortune 500 Financial Services
“We went from ‘hoping the agent doesn’t delete production data’ to actually sleeping at night.”
— ML Platform Engineer, Healthcare Startup
“The CMVK module caught 3 hallucination incidents in our first week that would have gone to customers.”
— AI Safety Researcher, Enterprise SaaS
Have a story? Share it on GitHub Discussions →
Agent OS wraps existing frameworks—use it with what you already have:
| Framework | Integration |
|---|---|
| LangChain | LangChainKernel().wrap(my_chain) |
| CrewAI | CrewAIKernel().wrap(my_crew) |
| OpenAI Assistants | OpenAIKernel().wrap_assistant(assistant) |
| Semantic Kernel | SemanticKernelWrapper().wrap(kernel) |
| AutoGen | AutoGenKernel().wrap(agents) |
Use Agent OS directly in your development environment:
| Tool | Description |
|---|---|
| VS Code | Real-time policy checks, kernel debugger, memory browser |
| Cursor | Composer interception, safe alternatives |
| JetBrains | IntelliJ, PyCharm, WebStorm plugins |
| GitHub Copilot | Safety layer for AI suggestions |
| Chrome DevTools | Monitor AMB messages and IATP trust |
See Agent OS in action with full observability:
Healthcare
Patient data analysis with guaranteed PHI protection. Full audit trail for compliance.
Education
Age-appropriate content filtering. No PII collection. Parent-visible audit logs.
Finance / ESG
Fraud detection with multi-model consensus. Complete audit trails for regulators.
Energy / IoT
Multi-agent coordination for grid balancing. IATP trust protocols for agent verification.
Infrastructure
Self-healing infrastructure with guardrails. Can’t delete prod, can’t expose secrets.
Business
Customer support, document processing, workflow automation with governance.
| Traditional Approach | Agent OS | |
|---|---|---|
| Safety | Prompt-based (hope) | Kernel-enforced (guarantee) |
| Violations | Detected after the fact | Blocked before execution |
| Audit | Logs if you remember | Complete immutable ledger |
| Control | Restart the whole thing | SIGSTOP/SIGCONT any agent |
| Trust | “I think it’s working” | Cryptographic verification |
We believe in building in the open. Here’s what’s coming:
| Timeline | Feature | Status |
|---|---|---|
| Q1 2026 | Multi-language SDKs (TypeScript, Go) | 🔄 In Progress |
| Q2 2026 | Visual Policy Editor | 📋 Planned |
| Q2 2026 | Large swarm support (1000+ agents) | 📋 Planned |
| Q3 2026 | Declarative policy language (Rego-like) | 📋 Planned |
| Q3 2026 | Enterprise SSO & RBAC | 📋 Planned |
Current Limitations:
Share Agent OS:
Agent OS is actively developed. Star the repo to follow updates:
