Sandboxes, control planes, memory systems, and execution environments for AI agents.
Ranked by Discovery Score — our 0-100 composite of adoption, maintenance, community, and license health. How scoring works.
By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.
NemoClaw runs OpenClaw (the open source coding agent) inside NVIDIA's OpenShell sandbox with managed inference, solving the real security risk of agents executing arbitrary code on your machine. Your agent gets GPU-accelerated model inference through NVIDIA's infrastructure while staying sandboxed. This is NVIDIA saying 'run your coding agents on our hardware, securely.' You get the performance of NVIDIA GPUs for inference without managing the infrastructure yourself. The sandbox prevents the agent from doing anything destructive to your system. Apache 2.0 licensed. The catch: this ties you to NVIDIA's ecosystem. You need NVIDIA hardware or their cloud infrastructure, no running this on Apple Silicon or AMD GPUs. It's OpenClaw-specific, so Claude Code and Cursor users are out. And 'managed inference' is a gateway to NVIDIA's paid compute. The tool is free but the GPU time may not be.
Tool is free. GPU compute costs depend on whether you self-host or use NVIDIA's cloud.
Open source under Apache 2.0. The NemoClaw tool itself is free. Self-hosting requires NVIDIA GPUs. NVIDIA's managed inference (OpenShell) may have usage-based pricing for GPU compute; check NVIDIA's current pricing for NIM/OpenShell. Self-hosted: free if you already own NVIDIA hardware. Managed: likely usage-based GPU pricing through NVIDIA's platform.
DeerFlow is ByteDance's open source take on Manus and ChatGPT's agent mode: an agent harness that works one task for minutes or hours, researching, coding and building reports or slides. It gives the agent a sandboxed computer, persistent memory, skills and sub-agents, plus a web UI and chat bridges for Slack, Telegram, Discord and more. MIT licensed and free.
Version 2.1 shipped in September with SSO, role-based permissions and scheduled tasks. Self-hosting is real work: Python 3.12, Node 22, nginx and a make setup wizard, or Docker as the recommended path. Budget 4 vCPU and 8 GB of RAM to evaluate, 8 vCPU and 16 GB for a long-running server. Any OpenAI-compatible model API works.
Solo and small teams: free, plus tokens and hardware. Larger teams can run it multi-user, but multiple workers mean Postgres and Redis. Want orchestration as a library? LangGraph, which DeerFlow is built on, is lighter. OpenHands is the closest open comparison.
The catch: this thing runs commands. The README says it's built for a trusted local network and calls Gateway admin equivalent to code execution on the host. Expose it without auth and a firewall and you've handed strangers a shell.
Completely free and MIT licensed. Your bill is model tokens, a server with at least 8 GB of RAM, and any hosted sandbox or search API you opt into.
**Free:** Everything. MIT licensed with no paid tier, no hosted cloud and no enterprise SKU. deerflow.tech is a project site with demos and docs, not a SaaS. **Self-hosted:** The only mode. Docker is recommended (Compose v2.24+); local dev needs Python 3.12+, Node 22+, pnpm, uv and nginx. README sizing: 4 vCPU / 8 GB RAM / 20 GB SSD to evaluate, 8 vCPU / 16 GB / 40 GB as the starting point for a long-running server. SQLite is the default database; multi-worker deployments require Postgres plus the Redis stream bridge. Sandboxes run on the host, in Docker containers, on Kubernetes via a provisioner, or on third-party providers such as E2B and Tenki. **Paid:** Nothing from the project. Your bills are model tokens from whatever OpenAI-compatible provider you connect (the README pushes ByteDance Volcengine's coding plan, but it isn't required), any hosted sandbox or paid search API you opt into, and the server.
MemPalace stores your AI conversation history verbatim and searches it semantically. Every Claude session, every project file, indexed locally. The structure is a metaphor: projects become wings, topics become rooms, so you can scope searches instead of querying a flat blob. It publishes 96.6% recall on LongMemEval with no LLM in the loop, and the benchmarks are reproducible from the repo. Install is pip plus pointing it at a directory. ChromaDB is the default backend, embeddings run on CPU with a 300MB model, no API key required. The MCP server exposes 29 tools so Claude Code can read and write the palace directly during a session. Solo developers using Claude Code heavily: install it. The 'wake-up' command that loads relevant context for a new session is the pitch and it works. Small teams: each engineer runs their own palace, there is no shared knowledge layer yet. The catch: it's about two weeks old. The benchmarks are real but the operational track record is not. Breaking changes will happen, and fast-growing projects attract impostor domains. The README has a scam alert for a reason.
Free and open source. Runs entirely offline if you want.
**Free and open source.** MIT license. `pip install mempalace` and you're running. ChromaDB is the default backend, all free. Embeddings run on CPU using a local model of about 300MB, no API key required. The full 96.6% recall path runs entirely offline. **Optional paid:** None from the project. If you swap in OpenAI embeddings or use an LLM for the rerank tier, you pay those providers directly. The core retrieval path has no cloud dependency. No Cloud tier, no paid version, no company behind it yet. That's a feature if you care about data control and a risk if you need support.
QwenPaw is a personal AI assistant you run yourself instead of renting from OpenAI. It ships with a local runtime so it works with no API key out of the box, and it also plugs into Ollama, LM Studio, and a dozen-plus cloud providers if you want bigger models. The hook is reach: it talks to you through Discord, Telegram, Lark, WeChat, DingTalk, even iMessage, and you extend what it can do with skills. It is open source under Apache-2.0, built by the team behind AgentScope, Alibaba's multi-agent framework. Self-hosting is the default here, not an afterthought. There is Docker support and a one-click path to deploy on Alibaba Cloud if you would rather not run it at home, in which case you pay for the cloud, not the software. It takes its own security seriously for a personal tool: a kernel-level sandbox, a Tool Guard, and a File Guard sit between the model and your machine, which matters once an assistant can run code and touch your files. For a solo developer or a tinkerer who wants an assistant that lives in their own chat apps and on their own hardware, this is one of the more complete self-hosted options going, and it costs nothing. Small teams can share an instance. There is no real large-team story here; it is a personal workstation, not a company-wide deployment, and that is fine. The catch is gravity. It is deep in the Alibaba and Qwen ecosystem, the docs are heavily multi-language, and a lot of the built-in channels (WeChat, DingTalk, Lark) point at a Chinese user base. None of that is a flaw, but if you expected a Western-defaults, English-first assistant, calibrate before you install.
Free and open source under Apache-2.0. You only pay if you choose cloud hosting or paid model APIs.
**Free:** Apache-2.0, the whole thing. Local runtime (no API key needed), all the chat-channel integrations, the skills system, the sandbox. **Self-hosted:** The primary way to run it. Docker locally, or one-click to Alibaba Cloud where you pay infrastructure costs, not a license. **Paid:** None for the software. Your only costs are optional: cloud hosting if you do not self-host, or API fees if you point it at paid model providers instead of the local runtime.
Supermemory is a memory and context engine for AI apps. It extracts facts from conversations and documents, keeps a profile of each user, and runs hybrid search that blends RAG with personalized recall, all behind one API. The company reports top scores on the major memory benchmarks. The main repository is MIT, and plugins exist for Claude Code, Cursor and Codex.
Running it locally is one command, npx supermemory local, which starts a single binary with the same API as the hosted platform. It works fully offline with a local model through Ollama, and your data stays on your machine. The local server is single-user and licensed for up to 10,000 documents, though, and the connectors for Google Drive, Gmail, Notion and OneDrive, plus the Supermemory MCP, only exist on the hosted platform.
Hosted pricing is published and credit-based. Free includes $5 of credits a month and pauses when they run out. Pro is $19/mo with pay-as-you-go top-ups, Max is $100/mo, and Scale at $399/mo adds S3 and web crawler connectors, unlimited seats and a self-hosted option. Teams building production memory will land on Pro or Scale.
The catch is maturity. The local server is still version 0.0.x, and one August release was an emergency patch after an upgrade silently wiped search vectors. The consumer app and browser extension were retired in September too. Build on the API, pin versions, and back up your data.
Free locally up to 10,000 documents, or with $5/mo of hosted credits. Hosted plans run $19, $100 and $399 a month.
**Free tier:** The main monorepo is MIT, the TypeScript and Python client SDKs are Apache-2.0, and plugin licenses vary. A free local server runs ingestion, memory extraction, hybrid search and the full API on your own model key or a local model, up to 10,000 documents. The hosted Free plan includes $5 of credits a month, all plugins, the full search and memory API, 1 team seat and unlimited end users, and pauses when credits run out. **Self-hosted:** Install with `curl -fsSL https://supermemory.ai/install | bash` or `npx supermemory local`. The server ships as a prebuilt binary called supermemory lite, is licensed for up to 10,000 documents with the cap enforced at the API, runs a single org with one auto-generated API key, and stores data locally. Extraction runs on whatever model you point it at, including Ollama. Connectors and the Supermemory MCP are hosted-only. Production self-hosting of the full platform is a Scale and Enterprise feature. **Paid:** Pro is $19/mo ($20 of credits, pay-as-you-go top-ups, 3 seats). Max is $100/mo ($130 of credits, Gmail connector). Scale is $399/mo ($600 of credits, S3 and web crawler connectors, unlimited seats, SOC 2, HIPAA BAA, self-hosted option). Enterprise is custom with SSO, air-gapped self-hosting and an uptime SLA. Usage bills per unique SM token: memory at $0.005 (plain text) or $0.010 (rich content) per 1K, SuperRAG at $0.001 or $0.002 per 1K, and search at $0.005 per 1K queries.
IronClaw is a personal AI assistant that runs entirely on your own machine. Built by NEAR AI, it's what you reach for when you want an always-on agent that reads your email, runs scheduled jobs, and answers from Telegram or Slack, but you don't want any of that data leaving your control. Everything is stored locally and encrypted. It's dual-licensed Apache 2.0 and MIT, completely free and open source.
It ships as a single Rust binary, which is the whole pitch: native speed, memory safety, nothing extra to babysit. Install is a shell script or Homebrew, then ironclaw onboard wires up your LLM provider. It leans on Postgres for persistence rather than SQLite, and runs untrusted tools inside a WASM sandbox or Docker, so the security story is built in, not bolted on. You bring your own model API keys, and you'll want Postgres running somewhere.
This is a young project, a Rust reimplementation inspired by OpenClaw, so treat it as early but serious. Solo devs and privacy-minded tinkerers: this is the fun one, a local agent you actually control. Small teams: usable for internal automation if someone's comfortable with Rust and Postgres. Large teams: watch it, don't bet a production workflow on it yet.
The catch is that "Agent OS" is carrying a lot of weight in the description. You're running an early-stage framework, not a finished product, and the work of wiring up providers, keys, and a database is on you. The privacy guarantee is only as good as the setup you build around it.
Free and open source (Apache 2.0 / MIT). You pay only your LLM provider, plus the effort of running Postgres and managing your own keys.
## Free Dual-licensed Apache 2.0 and MIT. Fully free and open source, every feature included. No paid tier from the project. ## Self-hosted This is the only way to run it, and it's the point. A single Rust binary installed via script or Homebrew, backed by Postgres for persistence. You supply your own LLM provider API keys, so model costs are separate. Untrusted tools run in a WASM sandbox or Docker. ## Paid No paid or hosted tier. Your only ongoing cost is whatever your LLM provider charges for the calls the agent makes.
OpenHuman is a desktop AI agent that connects to more than a hundred services, pulls your data in on a schedule, and builds a memory it can act on, with web search, voice, code execution and a talking desktop mascot built in. It's repositioning as an agent harness with a Rust core. The app is GPL-3.0; the managed services behind it are not. Install is native: Homebrew cask, .dmg, .msi, .deb or AppImage, no Docker. By default you sign in and use the TinyHumans managed route for models, search and integrations. Bring-your-own keys for 26 providers and local models through Ollama, LM Studio or MLX are options, and a local-only privacy mode keeps inference on the device. Integrations run through TinyHumans' backend via Composio by default. It was never fully free. TinyHumans sells credit plans: Basic $20 a month or $200 a year with $21 of credits, Pro $200 a month or $2,000 a year with $210, and pay-as-you-go top-ups from $5, all non-refundable. Solo users running local models can avoid paying. Everyone on the default managed route is buying credits. The catch: the local-memory pitch is going away. The development branch replaces the on-disk Markdown memory and Obsidian vault with CortexDB, hosted by TinyHumans or self-hosted by you; with neither, memory is off. It's also an early beta with hundreds of open issues.
Free app if you bring keys or run local models. The default managed route bills TinyHumans credits from $20 a month.
**Free:** The GPL-3.0 desktop app. Free to run with your own API keys or local models (Ollama, LM Studio, MLX). **Self-hosted:** Native desktop installers for macOS, Windows and Linux. The hosted pieces (CortexDB memory, the integration proxy, billing) are not in the repo. Upcoming memory changes require either TinyHumans' hosted CortexDB or your own CortexDB endpoint. **Paid (TinyHumans credits, USD):** Basic $20/month or $200/year, $21 of credits a month. Pro $200/month or $2,000/year, $210 of credits a month. Enterprise custom. Pay as you go from $5. All sales are final. The managed route covers LLM inference, search, embeddings, media generation, integrations and voice.
Hermes WebUI is a browser frontend for Hermes Agent, a self-hosted autonomous AI agent that holds memory across sessions, runs scheduled jobs, and integrates with messaging platforms. Free and MIT-licensed. Setup is moderate. You bring your own LLM API key (OpenAI, Anthropic, Google, DeepSeek, OpenRouter, others) and run the agent plus WebUI on your own hardware or VPS. Once running, the agent persists conversation context, learns from interactions, and can be triggered on a schedule. The web UI mirrors the CLI experience without locking you out when you close the terminal. For solo developers and small teams who want an AI agent that isn't tied to ChatGPT or Claude.ai, this is a real option. Your conversations, your memory, your hardware. The cost is your LLM API bill, which can climb fast if the agent is making frequent calls. Solo: probably $10 to $50 per month in API spend depending on usage. The catch is that "autonomous AI agent" is doing a lot of work in the description. These systems still hallucinate, still drift, still need supervision. Don't wire it into anything destructive without guardrails.
The software is free. Your real cost is the LLM API bill, which you control by your usage patterns.
**Free (software):** Hermes Agent and Hermes WebUI are both MIT-licensed. All features included. **Self-hosted reality:** Moderate. Standard web app stack, plus you wire in API keys for whichever LLM provider you choose. Nothing exotic, but configuring scheduled jobs and integrations takes some work. **LLM API costs:** Pay-as-you-go to your chosen provider. A casual user might spend $10 to $50 per month. An agent making frequent automated calls or running heavy reasoning loops can run several hundred per month.
BrowserOS is a Chromium fork built for AI agents to drive. The neo variant runs as a second browser where Claude Code, Cursor, or any MCP-compatible agent does web tasks in its own tabs using your logged-in accounts, with every session recorded and replayable as scrubbable video. The full browser variant is a daily driver with an agent built in. AGPL, free, bring your own model keys. Setup is signed installers for macOS and Windows, with Linux on the full browser. There's no BrowserOS subscription; cost is whatever your model provider charges, and local models via Ollama bring that to zero. Building from source is a Chromium build, so plan on hours, not minutes. This is for developers already using coding agents who want them doing authenticated web work, pulling data from dashboards, filling forms, without handing credentials to a cloud service. The proprietary comparisons are ChatGPT Atlas, Perplexity Comet, and Dia. The catch is trust and blast radius. You're giving a young third-party Chromium fork your live sessions, and an agent holding your cookies can act as you. Chromium forks also historically lag upstream on security patches. Keep it away from anything you can't afford to have clicked.
Completely free. You pay only your own model provider, or nothing with a local model.
**Free:** Everything. AGPL-3.0, signed binaries, no paid tier, no subscription, no pro version. **The real cost:** Your AI provider keys. 11+ providers supported; Gemini's free tier or a local model via Ollama brings the bill to zero. **The trade:** Free agentic browsing in exchange for trusting a young Chromium fork with your logged-in sessions.
Bifrost is an AI gateway: one OpenAI-compatible endpoint in front of 23+ model providers (OpenAI, Anthropic, Bedrock, Vertex, Azure, Ollama and more). It handles failover between providers, load balancing across API keys, semantic caching, budgets and rate limits per virtual key, and an MCP gateway. It does LiteLLM's job in Go, Apache 2.0 and free to self-host.
Trying it takes one line, npx -y @maximhq/bifrost or the Docker image, then add providers in the web UI. Existing OpenAI, Anthropic or Google SDK code switches by changing the base URL. The "50x faster than LiteLLM" line is the vendor's own benchmark, so test on your traffic.
There is no paid cloud. Enterprise is a licensed add-on with unpublished pricing and a 14-day trial: guardrails, cluster mode, adaptive load balancing, SAML and OIDC SSO, RBAC, audit logs and Vault support. Solo and small teams: the free version covers it. Larger teams needing high availability or SSO: get a quote.
The catch: a fresh install has no password, and anyone who reaches the port gets the dashboard and admin API. In September that became two unauthenticated remote code execution advisories, patched in v2.1.0. Upgrade, set a password, keep the admin port private.
Free under Apache 2.0 with no paid cloud. Clustering, guardrails, SSO, RBAC and audit logs are Enterprise at unpublished custom pricing, with a 14-day trial.
**Free:** The gateway is Apache 2.0: unified OpenAI-compatible API, 23+ providers, automatic fallbacks, load balancing across keys, simple and semantic caching, budgets and rate limits with virtual keys, custom routing rules, MCP gateway with Code Mode, custom Go plugins, the web UI, Prometheus and OpenTelemetry, and a prompt playground. **Self-hosted:** `npx -y @maximhq/bifrost`, Docker (`maximhq/bifrost`), Kubernetes/Helm, or the Go SDK embedded in your own app. Zero config to start, but production needs real work: the docs tell you to pin an image version, turn on dashboard authentication (the first admin account needs a `BIFROST_SETUP_TOKEN`), add TLS and pick durable storage. A fresh instance has no password. **Paid:** No hosted cloud plan. Bifrost Enterprise is custom pricing (talk to sales, 14-day free trial) and adds guardrails, cluster mode, adaptive load balancing, SAML/OIDC SSO, RBAC, audit logs, alerts, log exports, HashiCorp Vault and cloud secret manager integration, in-VPC or air-gapped deployment, and SLA-backed support. You still pay your LLM providers directly.
Agent Governance Toolkit puts a policy check between your AI agent and every action it takes. Tool calls, resource access, and agent-to-agent messages all get evaluated against rules you write before anything runs. The distinction that matters: this is application-layer enforcement, not prompt instructions asking a model to behave, so a jailbreak in the conversation does not talk its way past it. MIT, maintained by Microsoft, free. It is framework-agnostic on purpose, with adapters for LangChain, CrewAI, AutoGen, AWS Bedrock, Google ADK, and Azure AI among others, plus SDKs for Python, TypeScript, Rust, Go, and .NET. You get a CLI, a governance dashboard, and published specs mapped against the OWASP Agentic Top 10. Installation is a package manager command; the actual work is writing policy that reflects what your agents should be allowed to do, which nobody can do for you. Someone shipping a weekend agent can skip this. Anyone putting an autonomous agent in front of production systems or customer data needs this or an equivalent, and there is no free-versus-paid decision to make because Microsoft ships the whole thing MIT with no commercial gate. The catch is scope, and it is narrower than the marketing suggests. This governs what an agent does, not what a model says, so prompt injection that produces a bad answer rather than a bad action passes straight through and you still need a content safety layer beside it. It is also public preview, with breaking changes expected before GA.
Completely free and MIT with no commercial gate. Budget engineering time for policy authoring, not license cost.
### Free Tier All of it. Policy enforcement, the governance dashboard, the CLI, every framework adapter, and all five language SDKs. MIT licensed with no feature gating. ### Self-Hosted The only mode, and it is light: install the package from PyPI, npm, or NuGet and run policy evaluation in-process alongside your agent. No separate control plane to operate. The real cost is the engineering time to author and maintain policy, which is ongoing rather than one-time. ### Paid No paid tier from this project. Commercial equivalents live inside larger platforms, such as Azure AI Content Safety and the guardrail features bundled into Bedrock and Vertex, which are billed per request and tied to those clouds.
Kiro Crew keeps agent work running after you shut the laptop. A long-lived Gateway process holds sessions, memory, schedules and approvals, so multi-step tasks run unattended, recurring jobs fire on schedule, and heartbeats watch a system until a human is actually needed. Apache 2.0, on hardware you control. Getting it up is a one-line installer, a desktop package, a Docker image, or a source build wanting Python 3.12 and Node 22. You work from a dashboard on localhost, the desktop app, the CLI, or through Slack and Discord. History and memory stay on the host. The software is free. The models are not. Every path runs on kiro-cli, so model access goes through a Kiro account: $0 gets 50 credits a month on Claude Sonnet 4.5, Pro is $20 per user for 1,000, and the ladder climbs to $200 for 10,000 with overage at 4 cents a credit. The catch is in the project's own boundary document. Kiro Crew is deliberately KiroACP-only, the agent provider setting accepts exactly one value, and kiro-cli is required. An RFC asking to lift that is still in draft. The license buys the harness, not the choice of model underneath.
The software is free and Apache 2.0, but it only runs on kiro-cli, so budget a Kiro plan: $0 for 50 credits a month, $20 per user for 1,000.
**Free tier:** The Kiro Crew software itself is Apache 2.0 with no paid edition of the project. The Gateway, dashboard, desktop app, CLI, scheduling, memory, subagents, approvals and the Slack and Discord connections are all in the public repository. Model access runs on Kiro Free at $0 per month, which grants 50 credits and access to Claude Sonnet 4.5 plus open-weight models, subject to rate limits. **Self-hosted:** Self-hosting is the default and only deployment mode. Install with a one-line script, a `.deb`, `.rpm` or AppImage desktop package, a Docker image for always-on servers, or a source build (Python 3.12+, Node 22+, npm, and kiro-cli). x86_64 and aarch64 both get first-class builds with SLSA provenance. The Linux desktop app needs glibc 2.34 or newer. Stable, Insider and Nightly channels are available on every install path. On Linux and macOS the agent can run inside an OS sandbox, which on Ubuntu 23.10 and newer needs the AppArmor profile the `.deb` or `.rpm` installs for you. **Paid:** You are buying Kiro credits, not Kiro Crew. Kiro Pro is $20 per user per month for 1,000 credits, Pro+ is $40 for 2,000, Pro Max is $100 for 5,000, and Power is $200 for 10,000. Paid tiers unlock premium models and allow add-on credits at $0.04 each. Kiro Enterprise is contact-sales and adds centralized billing, SSO, usage analytics and security controls. Note that the public repository ships its SSO and tunnel modules as deliberately inert stubs that report unavailable, with a separate enterprise package expected to supply the real implementations.
Kungfu tackles the thing that quietly breaks long agent sessions: context loss on a handoff. It's a continuity layer that preserves task state and context so agents like Codex, Claude, OpenCode, and Amp can pause, hand off, and resume without forgetting what they were doing. The project wraps this in unusually formal governance, cryptographic "Release Passports" and a written qualification spec. It's a real, deep monorepo spanning TypeScript, Rust, and C++, with a serious commit history behind it. This is not a thin repo coasting on a good README, the code is there and the engineering is deliberate. For teams running agents on multi-step work, the promise is fewer dropped threads and cleaner resumption. Solo or team, the license cost is zero. The catch is timing. Kungfu is alpha. The public packaging hasn't shipped ("v4 coming soon"), so today you're building from source, not running an install command. The ideas are strong and the foundation looks solid, but this is one to watch and test, not to put in front of production work yet.
Free and open source, but still pre-release. Build from source for now.
Free and open source under Apache 2.0, with no paid tier announced. The practical cost right now is effort: packages aren't published, so you build it from source until the v4 release lands.
AgentENV runs thousands of isolated agent environments at once, which is exactly what reinforcement-learning training for agents needs. Written in Rust, it orchestrates Firecracker microVMs across a cluster with sub-50-millisecond snapshot pause and resume, memory forking, and S3-compatible storage. It comes from kvcache-ai, the group behind the well-regarded KTransformers, so the pedigree is real. The standout is the speed of the snapshotting. Forking agent state and pausing or resuming microVMs in under 50ms is what makes large-scale agentic RL practical instead of theoretical. This is free under MIT, but the audience is narrow: teams actually training agents at scale. Solo tinkering is possible, self-hosting on real infrastructure is the expectation. The catch is two-fold. It's infra-heavy, it wants Linux 6.8+ and access to /dev/kvm, so this is a datacenter or beefy-server tool, not a laptop one. And the README is blunt that the API has no authorization built in and must never be exposed publicly. Powerful and specialized, with sharp edges you have to respect.
Free and open source. Serious infrastructure for agentic RL, not a casual install.
Free and open source under MIT, no paid tier. The cost is entirely operational: it needs Linux 6.8+ with KVM access and real cluster infrastructure to be worth running. Heavy to deploy and deliberately unauthenticated, so it must stay on a private network.
Boxlite gives you lightweight sandboxes. Each sandbox is a stateful micro-VM with hardware isolation, snapshots, and an API to control it. Picture giving every AI agent its own disposable computer. The project is open source under Apache 2.0 and self-hosting is free. It's early but growing fast. The 'agent sandboxing' space is heating up as AI agents get more autonomous and need safer execution environments. The catch: this is emerging technology. The documentation and ecosystem are still maturing. Running Firecracker-based micro-VMs requires Linux with KVM support. No macOS, no Windows natively. And the question of whether you need full VM isolation versus Docker containers depends on your threat model. For most use cases, Docker is simpler. Boxlite is for when you can't trust the code being executed.
Free to self-host on Linux with KVM. No paid tier. Server cost is $20-40/mo for meaningful capacity.
Fully open source under Apache 2.0. No paid tier announced. Self-host on any Linux machine with KVM support. **Infrastructure cost:** Each micro-VM is lightweight (boots in <125ms, minimal RAM overhead), but you need a Linux host with KVM. A $20-40/mo dedicated server from Hetzner handles dozens of concurrent sandboxes. Cloud VMs from AWS/GCP work if they support nested virtualization. **Compared to alternatives:** E2B (commercial agent sandboxing) charges per sandbox-hour. Modal charges per compute-second. Boxlite is free to run yourself. The cost is the server and your ops time. **When it's worth it:** If you're running untrusted code from AI agents at any meaningful volume, self-hosted sandboxing saves significantly over pay-per-use commercial alternatives.
GitLab MCP fills the gap Anthropic left open. GitHub has an official MCP server for AI coding assistants. GitLab does not. This community-built server connects Claude Code, Cursor, Copilot, VS Code, and Codex to your GitLab instance, exposing merge requests, issues, pipelines, wiki, releases, and labels as callable tools. Setup is simple for local use: one npx command plus a personal access token. Self-hosted GitLab works fine with a custom API URL. For team deployments, there's a Docker image with OAuth2 support and multi-user remote authorization. Four auth methods cover everything from quick local testing to production multi-tenant setups. Solo developers on GitLab get AI coding assistant integration that was previously GitHub-only. Teams running self-hosted GitLab get the same MCP capabilities without migrating to GitHub. There's a read-only mode toggle for safety if you want to prevent the AI from making changes. The catch: community-maintained, not official GitLab or Anthropic. Feature parity depends on one maintainer keeping up with GitLab's API surface. The multi-user OAuth setup requires a public HTTPS endpoint and pre-registered GitLab app, which is non-trivial.
Completely free. Brings GitLab into the MCP ecosystem that was previously GitHub-only.
## Free Tier Everything. MIT licensed. Full GitLab API coverage, all auth methods, all transport modes. ## Self-Hosted Local: npx command + PAT environment variable. Remote/multi-user: Docker + public HTTPS URL + registered GitLab OAuth app. Moderate setup for team deployments. ## Paid Alternatives No direct paid competitor. GitHub's official MCP server is also free but only works with GitHub. GitLab's own AI features (GitLab Duo) are paid ($19-99/user/mo) and don't expose an MCP interface.
Mirage mounts S3 buckets, Google Drive, Slack, Gmail, and Redis side by side as one filesystem so an AI agent can use familiar Unix commands across all of them. Instead of teaching the agent five different SDKs, you point it at a virtual filesystem and let it grep, cat, cp, and pipe between services the way it would on a local disk. It's an abstraction layer designed for how agents already think.
Install is pip or npm or a curl one-liner. Python 3.12+ or Node 20+, macOS or Linux. You provide credentials for whichever backends you want to mount (AWS, Google, Slack, etc.) and Mirage exposes them as paths. There's no central service; everything runs locally inside the agent's environment.
Solo developers building agent workflows: this is the kind of glue you'd otherwise hand-roll, and having it as an Apache 2.0 package is useful. Small teams shipping agents: worth testing as part of your tooling stack. Large teams: monitor the project; it's young but the design is right.
The catch: v0.0.1, released May 6th, 2026. First public release. The abstraction is interesting but the implementation is brand new. Expect rough edges and breaking changes. Pin the version and read release notes carefully.
Free Apache 2.0 with no current commercial tier. Brand new project; pin your version.
**Free:** Apache 2.0, full source, no enterprise tier mentioned. Pip and npm packages, no account. **Self-hosted:** Runs in the agent's local environment. You manage credentials for whichever backends you mount. No central server to operate. **Paid:** None at this time. Strukto AI may build commercial offerings on top of it later, but the core is open.
LLM Space is a desktop workbench for people building AI agents. Write the prompt, wire up the tools, run it, and watch every model call and tool invocation as it happens. Replay a failed run out of history and step through it. Threads are plain files on your machine and API keys stay local. MIT licensed and free, and the DeerFlow team says every release of bytedance/deer-flow is built and debugged inside it. There is no server to stand up. Download the DMG and go. Packaging is the constraint: the desktop app is macOS only, in a 27 MB edition on the system WebView or a 130 MB one with its own renderer. Linux gets a headless server build with no UI. It runs its own agent runtime, so it hosts your agent rather than observing one you already deployed. Use it while you are still shaping an agent and want to see what the model actually did instead of inferring it from logs. Solo builders: free, and the replay view alone earns the download. Small teams: free, though file-based threads make sharing a run manual. If you need hosted traces and production monitoring the whole team can see, langfuse/langfuse or LangSmith is the right shape. promptfoo/promptfoo fits better when evaluation is the main job. The catch: they only merge pull requests from the DeerFlow core team, so this is open source you can read and fork but not contribute to. Anonymous telemetry is on by default with a documented opt-out. And the public repo dates to mid-2026 even though the project claims a 2023 start, so treat the visible history as short.
Free and MIT; the only line item is model tokens, and replay-heavy debugging burns more of them than you expect.
### Free Everything that ships today. MIT license, both desktop editions, the Linux server build, the local runtime with models, tools, skills, MCP, and plugins, plus the generator that turns a thread into a runnable LangGraph agent. No account, no seat count, no gated features. The project is funded by sponsors and donations. ### Paid Nothing from the project. Your bill is model tokens paid straight to whichever provider you point it at. Worth knowing before you take the setup advice at face value: the README recommends ByteDance's BytePlus Coding Plan as the default model provider, and BytePlus is the project's gold sponsor. The repo describes itself as "cloud-ready for managed agents," but no hosted tier and no pricing exist today. ### Self-Hosted Costs Not really self-hosted, since it is a desktop app. The standard edition is about a 27 MB download and the performance edition about 130 MB; both share ~/.llm-space, so you can install either or both. Building from source needs Bun 1.3 or newer, or mise if you want the exact toolchain CI uses. The recurring cost is API spend, and it is easy to underestimate: an agent loop that retries, replays, and re-evaluates burns tokens considerably faster than chat does. Watch a long debugging session on a frontier model and you can clear $10 to $20 without noticing. ### When to Pay Pay when you outgrow one machine. Hosted platforms like LangSmith, Langfuse Cloud, and Weights & Biases Weave sell shared traces, dataset versioning, and production monitoring across a team, generally per seat or per trace. LLM Space does not try to be that, and its file-based threads make sharing a run a manual step. Also pay attention if you are not on a Mac, because the desktop app is macOS only and the Linux artifact is a headless server build.
Commonly gives coding agents a shared workspace instead of a fresh amnesiac session every time. Claude Code, Cursor, Codex, and your own agents each get persistent identity, their own memory, their own skills, and a workstation, and you talk to them in a chat room where the work actually accumulates. The problem it targets is real and annoying: every new agent session starts by re-explaining the project. Commonly keeps that context attached to the agent rather than to a terminal tab you closed. Task management and cross-runtime handoff sit on top. Installation is Docker with the Compose v2 plugin, then clone and run the install script, and you are on localhost:3000. Apache 2.0, self-hosted by default, with no per agent fee and no seat pricing. There is a live demo at commonly.me if you want to see it before committing a machine to it. The catch is that the README says the project is early, and it means it. This is a category where the shape of the right answer is still being argued about, and multi-agent workspaces have a habit of being rewritten. Self-host it, keep your data local, and do not build a team process on it yet.
Completely free and Apache 2.0 with no per agent or per seat charges. The cost is betting on a project that describes itself as early.
**Free:** Everything. Apache 2.0 licensed with no per agent fees, no seat pricing, and no feature gates. Persistent agent identity, memory, skills, task management, and multi-runtime support across Claude Code, Cursor, Codex, and custom agents. **Self-hosted:** Docker with the Compose v2 plugin. Clone the repository, run the install script, and the workspace is on localhost:3000. Self-hosting is the default deployment mode and keeps agent memory on your own infrastructure. **Paid:** No paid tier. A live demo runs at commonly.me, but there is no commercial edition or hosted plan being sold.
PilotDeck is an AI agent workbench: hand it a task and it works inside a project WorkSpace, then lands finished files (slides, spreadsheets, reports, code) on disk. It plays in Claude Cowork's lane, but it's free under AGPL-3.0 and runs on the model you choose: OpenAI, Anthropic, Gemini, DeepSeek, Qwen, Kimi, MiniMax or local Ollama. Version 2.0 shipped in October with desktop installers for macOS, Windows and Linux, plus a one-line installer and Docker. Each WorkSpace keeps its own files, memory and skills. Memory is white-box, so you can edit, pin or roll back the entry that sent the agent sideways. A router hands easy calls to cheaper models, and Always-on mode keeps working after you log off. No paid tier; you pay your model provider. The team's routing numbers ($2.83 versus $12.58 on one workload) are their own benchmark. Solo and small teams: free, start with the desktop app. Larger teams: pilot it on internal work first. The catch: releases land several times a week, and an unattended agent running shell commands belongs on a sandboxed machine (the latest release was still closing permission-parser gaps). Community skills come from ClawHub, where researchers found hundreds of malicious skills this year.
Free under AGPL-3.0 with no paid tier; the only bill is your model provider. The routing savings the team publishes ($2.83 versus $12.58 on one workload) are self-reported, so measure on your own tasks.
**Free:** Everything, under AGPL-3.0: WorkSpace isolation, white-box memory with Dream Mode consolidation and one-click rollback, Smart Routing, Always-on background tasks, native MCP support, plugin hooks, the Web UI, CLI and IM front-ends, and the desktop apps. No paid edition and no hosted cloud on the project site. Anonymous usage telemetry exists in the code but defaults to off. **Self-hosted:** Desktop installers (.dmg, .exe, .deb, .rpm, x64 and arm64) on every GitHub release; a one-line `curl | bash` installer for macOS and Linux that needs Node.js 22.13 or newer and below 23; a PowerShell installer for Windows; or `docker compose up -d --build` (UI on port 3001, gateway on 18789). Providers and API keys are set in onboarding or `~/.pilotdeck/pilotdeck.yaml`; Ollama needs no key. Budget real effort for isolating an always-on agent that runs shell commands. **Paid:** No paid tier. You pay your model provider. The team's published routing benchmarks: Opus 4.5 main plus Sonnet 4.5 sub-agent cost $2.83 versus $12.58 all-Opus on a social-media workload, and Sonnet 4.6 plus MiniMax-M2.7 cost $3.15 versus $18.36 for Sonnet 4.6 alone across 7 complex tasks. Both are self-reported.
Steel Browser is browser infrastructure for AI agents: a Chrome instance behind an API that an agent drives, with sessions that keep cookies and local storage alive between requests. It is the self-hosted answer to paying by the browser hour, and it is Apache-2.0. Docker is the fast path, and it also deploys to Railway or Render or runs on bare Node with Chrome. Control is Puppeteer and CDP, so everything you already know about driving Chrome still applies. What it saves you is assembly: stealth plugins and fingerprint management, proxy chain support for IP rotation, Chrome extension loading, and endpoints that turn a page straight into markdown, a screenshot, or a PDF. Solo developers and small teams building agents that browse: self-host it and the marginal cost of a session becomes your own compute. Medium teams: still self-host, but budget real operational time, because headless Chrome at concurrency is memory hungry and crashed sessions are normal rather than exceptional. Large teams running a fleet: compare honestly against Steel Cloud or Browserbase, because managed browser services exist precisely because scaling this is miserable. The catch: releases are still tagged beta and arrive months apart even though commits keep landing. The bigger one is that self-hosting means you personally own the anti-bot arms race. The stealth plugins are in the box, but keeping them effective against sites that actively fight automation is continuous work, and absorbing that work is most of what the hosted providers are actually charging for.
Self-hosting is free and Apache-2.0. Steel Cloud exists for teams who would rather not run headless Chrome at scale.
**Free tier:** The full open source browser API, Apache-2.0. No feature gating between the self-hosted build and what the hosted product runs. **Self-hosted:** One Docker command locally. For anything real, size the host for memory rather than CPU, because each Chrome session is expensive and concurrency is what breaks first. Deploy targets include Docker, Railway, Render, and plain Node with a system Chrome. You own session cleanup, crash recovery, proxy credentials, and keeping stealth measures current. Call it moderate ops that turns significant once concurrency climbs. **Paid cloud:** Steel Cloud is the managed version from the same team, for teams that want sessions without owning the infrastructure. Browserbase is the larger commercial competitor in the same space. **The real comparison:** per browser hour pricing looks expensive until you have run headless Chrome at concurrency yourself. The self-hosted route is genuinely free of licensing and genuinely not free of engineering time. Small volumes favor self-hosting decisively; large, spiky, adversarial workloads are where the hosted bill starts looking reasonable.
Archestra sits between your AI agents and your company's data, and tries to make that connection safe enough for a real enterprise. It is an open-source control plane: an LLM gateway that fronts any model provider, a registry and gateway for MCP servers, an agent orchestrator, and a layer of guardrails (SSO, RBAC, sandboxed code execution, prompt-injection defense). The pitch is that you can let agents touch internal systems with auditing and cost limits instead of hoping nothing goes wrong. Self-hosting is free for teams under 30 people. This is enterprise infrastructure, and it installs like it. Docker, Helm, and Kubernetes are the deployment paths, so standing it up is a platform-team job, not an afternoon. The upside of self-hosting is the whole point of the product: your prompts, your data, and your agent traffic stay inside your own boundary, which is exactly the property security teams want before they let an LLM near anything sensitive. Solo builders and small teams experimenting with agents can run it free, but it is heavier than you need unless governance is the actual problem you are solving. Where it earns its keep is the mid-size company standardizing how dozens of agents reach internal tools: the AGPL self-host covers you up to 30 users, and past that you are into enterprise licensing. The comparison set is commercial AI gateways like Portkey or Kong's AI Gateway; Archestra's bet is open source plus security as the differentiator. Two catches. It is young and venture-backed, which means fast movement but also a roadmap that answers to investors, so watch how the open-core line shifts over time. And the README's talk of migrating from Claude Cowork and similar reads more like marketing than the substance underneath, which is solid. Judge it on the gateway and guardrails, not the launch copy.
Free to self-host under AGPL-3.0 below 30 users; enterprise licensing kicks in above that. Priced and built for companies, not solo tinkering.
**Free (self-hosted):** AGPL-3.0, free for teams under 30 users. The full control plane: LLM gateway, MCP registry and gateway, orchestrator, and guardrails. **Self-hosted:** Deploy via Docker, Helm, or Kubernetes. Your model traffic and data stay inside your infrastructure. Expect a platform-team effort to run it. **Paid (Enterprise):** Above 30 users you need a separate enterprise license. A managed cloud tier exists; pricing is not public. Contact-sales territory.
Codex-console is an integrated control panel for that workflow. Task management, batch processing, data export, auto-upload, log viewing, and packaging in one place. Built in Python with MIT license. The project provides compatibility fixes and experience optimizations for managing multiple concurrent AI coding sessions. The catch: the README and documentation are entirely in Chinese. If you don't read Chinese, you'll be navigating the tool through translation or code reading. The project is a console/dashboard wrapper. It doesn't do the AI work itself, it just helps you manage it. And at with limited English documentation, community support outside Chinese-speaking developers will be thin.
Free. Self-hosted Python console.
Fully open source under MIT. No paid tier, no hosted version. A Python application you run locally.
This MCP server wraps 41 Brazilian public APIs into one standardized interface your agent can query. The smart part: it doesn't dump all 200+ tools on your agent at once. BM25 search filters to show only relevant tools per query, and a query planner can combine multiple APIs in a single call. 24 of the APIs need no authentication at all. The remaining ones use 2 optional API keys you get with free registration. MIT licensed. Built in Python with async httpx, Pydantic v2, and rate limiting with backoff. The catch: this is Brazil-specific. If you're not working with Brazilian data, there's nothing here for you. And wrapping government APIs means you inherit their reliability issues: downtime, rate limits, and data quality are the API provider's problem, not Floci's. The project is brand new and maintained by what appears to be a single developer.
Free. Government APIs are free. The MCP wrapper is free.
Fully open source under MIT. No paid tier. The underlying Brazilian government APIs are free (24 need no key, rest require free registration).
This gives you a local control center with full visibility. You get a dashboard that shows what OpenClaw is doing in real time, how much each task costs, and lets you set guardrails. It turns OpenClaw from 'fire and pray' into something you can actually trust and control. You see every API call, every decision branch, every token spent. You set budget limits, approve expensive operations, and kill tasks that go off the rails. MIT licensed, TypeScript. The catch: this is OpenClaw-specific. If you're using Claude Code, Cursor, or Codex, this does nothing for you. And 'control center' implies oversight, but you still need to understand what you're looking at. It surfaces the data, it doesn't interpret it for you. Early stage, so expect UI rough edges.
Free. Requires OpenClaw (also free/open source).
Fully open source under MIT. No paid tier. Runs locally alongside your OpenClaw installation. No separate hosting or account needed.
Qclaw is a GUI wrapper for OpenClaw that removes the command-line barrier. If you want to use AI coding tools but the terminal feels intimidating, Qclaw puts a graphical interface on top of OpenClaw's capabilities. Chinese-language interface, built for users who prefer visual interaction over command-line workflows. It translates OpenClaw's CLI operations into clickable buttons and forms. The catch: Chinese-language only, and it wraps another tool rather than providing standalone functionality. You still need OpenClaw installed underneath. If you're comfortable with a terminal, OpenClaw directly is more flexible. And because it depends on another project's API, breaking changes upstream can break Qclaw.
Free - GUI wrapper for OpenClaw.
Free and open source.