A coding agent that jails model commands and uses editable state machines for long-running tasks.
The model can write code and ask to run commands, but those commands go through a jail with restricted filesystem and network access. Long-running workflows can be written, reviewed, edited, resumed, and replayed as declarative state machines instead of being left to an open-ended agent loop.
Full documentation: agent6.dev
- Sandboxed execution for every LLM-chosen child process, jailed individually
with Landlock + seccomp; the default
strictprofile adds namespaces +pivot_root, rebinds.gitread-only, and confines egress to your provider - Works with Anthropic and any OpenAI-compatible endpoint (OpenAI, OpenRouter, Ollama, vLLM, llama.cpp, LM Studio)
- Per-step git commits, snapshot-resumable runs, per-turn forkable checkpoints, token budgets with hard stops and a best-effort USD ceiling
- Plan, run, review, and ask modes; a live terminal dashboard and a zero-dependency
browser UI (
agent6 web, phone-friendly); persistent transcripts and a searchable run history - State machines (
agent6 machine) for long-running automated tasks: LLM-drafted, operator-reviewed, journaled, and replayable; a machine can wait indefinitely for a human, be poked with a payload, steer/answer its agent states from any front-end, and notify you when it needs attention - Small, fixed LLM tool surface; the only extension point is operator-configured MCP servers, off by default
- Eight runtime dependencies, no telemetry, no auto-update
uv tool install agent6 # or: pipx install agent6agent6 needs Linux for the sandbox (kernel 6.7+ for TCP rules), Python 3.12+, and an API key for at least one provider. macOS runs unsandboxed behind a warning; on Windows use WSL. See installation for the full requirements and building from source.
# Connect a provider once (stored in ~/.config/agent6/, key in a 0600 secrets file).
agent6 connect # interactive: pick provider, paste API key
agent6 model worker anthropic claude-sonnet-4-6
# Run the agent on a task. agent6 infers a verify command if you haven't set one.
cd your-repo
agent6 run "add a --json output mode to the CLI"
# Watch and drive runs from a terminal, a full-screen TUI, or a browser.
agent6 watch <run-id> # plain live event stream (default)
agent6 tui # full-screen dashboard hub
agent6 web # browser UI on http://127.0.0.1:8901 (phone-friendly)
# Audit the effective config, pre-flight the sandbox, resume or fork a run.
agent6 config show
agent6 check
agent6 resume <run-id>
agent6 fork <run-id> --at-turn 7That is the whole loop. See getting started for the full command tour, the web UI for driving runs from a phone, configuration for every field, and the security model for what the sandbox enforces.
Config is layered: built-in secure defaults, then the global ~/.config/agent6/config.toml,
then the per-repo config (out of the workspace, per-machine, not committed), then an
explicit --config FILE. Every field has a default; security-sensitive fields default to
the safe value (agent_network = "providers", tool_network = "block",
run_commands = "ask", protect_git = true, git.allow_* = false), and git_ops.py
refuses push, --force, and history rewrites unconditionally.
Reproducible harnesses live under bench/: real-world SWE-bench-Lite-style tasks,
head-to-head runs against Claude Code / opencode / aider, machine create validation, and
a perf-optimization harness. See each directory's README for recorded numbers (single runs,
no variance measured; re-run before quoting).
Read AGENTS.md first. The repo's verify command decides whether a change is landable:
uv run ruff check && uv run ruff format --check && \
uv run pyright && uv run tach check && uv run pytestAdding a tool, loosening a security default, dialling a new network destination, or
changing the jail (src/agent6/jail/) requires a Security review note: paragraph in
the commit message.