What is NVIDIA OpenShell?
NVIDIA OpenShell is an open-source runtime that runs autonomous AI agents in isolated sandboxes and enforces a declared policy on files, system calls, network connections and credentials. Use it when an agent needs real tools but should not reach your secrets or the open internet. It is free under Apache 2.0 but needs Docker, Podman or a VM runtime to set up.
What can you do with NVIDIA OpenShell?
OpenShell is for people who want an AI agent to read files, install packages, call APIs and use credentials without giving it unrestricted access. Each agent runs in its own sandbox. You write a policy that lists which files, processes and network destinations it may use, and OpenShell enforces it at the kernel level on every file access, system call and connection.
Agents never see your real credentials: OpenShell adds them only to requests bound for approved endpoints. When an agent needs something new, such as a new host, the change waits for approval, and a built-in prover uses formal verification to flag access that a policy change would newly allow. For teams, a gateway acts as the control plane, and it can be deployed on Kubernetes with Helm.
Try it on a small task
Suggested workflow: install the CLI and local gateway with the installer from the README, create a sandbox, then follow NVIDIA's Run Your First Agent tutorial, which runs the OpenCode agent against a free OpenRouter model. Give the agent a small task in a test repository.
Watch which requests it makes and which ones OpenShell blocks or sends for approval. Approve only what the task needs and read what the prover says a change would allow. Keep real production credentials out of the first test.
Pricing, platforms and releases
OpenShell is free under the Apache 2.0 license; you pay only for your own compute and any model provider you connect. The CLI and gateway are supported on Debian and Ubuntu Linux (x86_64 and arm64) and on macOS with Docker Desktop on Apple Silicon; Windows with WSL 2 is experimental. SDKs are available for Python, TypeScript, Go and Rust.
The project is on the 0.1.x line, with v0.1.5 released on October 20, 2026, and NVIDIA targets weekly stable releases. Security fixes cover the latest and the previous minor release. The repository has existed since February 2026. OpenShell collects anonymous operational telemetry by default; set OPENSHELL_TELEMETRY_ENABLED=false on the gateway to turn it off.
What stands out
- Kernel-level sandbox for files, system calls and network
- Credentials injected only into requests to approved endpoints
- Policy prover that flags risky new access before approval
Before you choose
- Needs Docker, Podman or host virtualization; Windows via WSL 2 is experimental.
- The default sandbox has no agent installed; you add one yourself.
- Anonymous operational telemetry is on by default and can be disabled.
Go to the source
Sources & further reading
Based on the official documentation below. Features and access can change; check the provider before making a decision.
Was this page useful?
Help us make our coverage more useful. This is feedback on the page, not a rating of the tool.
Go a little further