Agyn

The deciding trait is where the work happens. Agents stop being processes on a developer's machine and become workloads on infrastructure somebody operates, which is either exactly what you needed or completely beside the point. There is no middle audience here. If you are one person with one repository, installing this is a weekend you will not get back.

If you are the person who gets asked where the agents are running and cannot answer, this is the answer. Pick it when that question has already been asked twice. Pick a terminal agent when it never has.

The failure surface moves rather than shrinks. Every task an agent was going to get wrong on a laptop it will get wrong in a pod, and now the pod can also fail to schedule, lose its overlay network or be evicted. The bundled agents are the same vendor CLIs everyone else runs, wrapped. The improvement is in where they run, not in what they produce.

What it does right is the local start. One command brings up the whole control plane in a virtual machine, so you can see the failure modes before you commit a cluster to them.

1. Keeping secrets out of the context window is a structural answer to prompt injection rather than a filtering one, and structural answers survive model changes while filters do not. 2. Isolating each tool server in a separate container makes the trust boundary match the process boundary, so a compromised server cannot read the conversation it was called from. 3. Per-conversation sandboxing gives the same property to the workspace.

2. All three are asserted in project documentation and none is accompanied by a published threat model or an audit, so a reader should record them as documented intent rather than verified behaviour.

The licence choice is the business plan, and it is a sound one. A strong copyleft on a platform product means every vendor who wants to embed it needs a commercial exception, which is real pricing power over exactly the buyers who can pay. What is missing is the demand: two hundred and twenty-nine stars and no published commercial tier means nobody has asked for the exception yet.

Moat: the copyleft, plus the switching cost of infrastructure. Likely acquirer: a cloud vendor filling an agent gap in its platform catalogue. Position: safe to run, and worth watching for the day a hosted tier appears.

This is the first tool in the category that answers the questionnaire without a follow-up call. Access control, directory login and an audit trail are product features rather than an upgrade tier, and the spend caps are the item I never get: a ceiling I set per team, before the invoice, instead of an alert after it.

The cost is headcount. Agents are declared as Terraform resources and run as scheduled workloads, which fits how we already deploy, but it needs the platform team that deploys them. Approved with conditions: the platform team owns it, and no product team gets a cluster.

Strong copyleft is the licence I want on infrastructure I depend on: whatever happens to the company, the code stays open and a fork stays legal. Installation is a helm chart pulled from an OCI registry, which means the whole platform is a values file I keep in version control rather than a console somebody clicks through.

Model access is my own provider keys, so the platform never becomes a reseller. What it will not do is run inference on my hardware; the agents it ships are hosted-model CLIs and the weights stay somebody else's. That is the one box unticked.