AGRO Sandbox Runtime
One Docker sandbox plus shared agent procedures to run and govern Claude Code, Codex, Pi, and other coding agents side by side.
- Source repo
- mifunedev/agro
- Stars
- ★ 42
- Last updated
- today
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 49/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Developers already using Claude Code or Codex who want several agents working on one project in parallel without overwriting each other.
- Not a fit if
- Developers who don't want Docker and Node.js on the host
- Teams that want zero-config, single-command agent setup
- Organizations that need vendor-hosted SaaS instead of self-run sandboxes
- Source review
- 49/100 · Major gaps
What does this agent do, and when should you use it?
AGRO is a governance and runtime orchestrator for autonomous coding agents, built around the agro CLI, a Docker sandbox definition, and shared agent procedures (skills and hooks). Each project lives in one Docker sandbox, with tools, secrets, harnesses, and project clones managed under ~/harness inside it. You can run several coding harnesses at once — Claude Code, Codex, Pi, OpenCode, Hermes, T3 Code, and more — and use git worktrees to give parallel tasks their own branches and checked-out files. Tools and harnesses install on demand, and agro gateway can bridge Hermes or Pi into Slack. The deployment boundary is your own laptop or a remote VM; host prerequisites are Docker with the Compose plugin, Git, and Node.js 22 or newer.
The agro CLI is the only front door. agro sandbox install docker runs a setup wizard to create a Docker sandbox, with --checkout and --home-mount binding a project checkout and a persistent home path; agro shell <name> enters it. Inside, agro tool install and agro tool list manage tools such as herdr, agent-browser, cloudflared, microsandbox, tailscale, gh, and docker-cli, while agro harness install claude-code|codex|pi|opencode|hermes|grok-build|muse-code|antigravity-cli|fx|prime-agent|t3code installs and launches a coding harness, after which the harness itself handles conversation and code edits. Shared skills and hooks live under the documented AGRO directory layout and are exposed to each provider. agro secret set stores tokens through hidden input, agro gateway hermes|pi starts the matching Slack gateway, agro gateway status reports it, and agro update/agro --version handle upgrades and version checks. Inside ~/harness, agents clone repositories into projects/ and create branches plus worktrees under .worktrees/ per issue, cleaning them up after merge.
- Developers already using Claude Code or Codex who want several agents working on one project in parallel without overwriting each other.
- Teams running coding agents on a remote VM who want project code isolated inside a container.
- Engineering teams standardizing tool and harness installation across Claude Code, Codex, Pi, and others.
- Organizations that want Pi or Hermes reachable from Slack so tasks can be triggered in chat.
- Backend engineers using VS Code with Dev Containers who want to attach to the running sandbox.
- Individual developers who want to trial a sandboxed agent workspace first in GitHub Codespaces.
How do you install or deploy this agent?
The host needs Docker with the Compose plugin, Git, and Node.js 22 or newer.
Install globally with npm:
npm install -g @mifune/agroOr use the curl installer, which places AGRO in ~/.local/bin and offers Node.js setup if needed:
curl -fsSL https://github.com/mifunedev/agro/releases/latest/download/install.sh | bashCheck the version and update:
agro --version
agro update
agro --helpHow do you use this agent?
Create a sandbox from any directory and enter it (replace <name> with your sandbox name):
agro sandbox install docker
agro shell <name>Inside the sandbox, install the terminal workspace and any tools you need:
agro tool install herdr
herdr
agro tool listInstall and authenticate a coding harness (Claude Code shown):
agro harness list
agro harness install claude-code
claude auth login
claude auth status
claudeOptional GitHub authentication:
gh auth login
gh auth setup-git
gh auth statusOptionally store Slack tokens with agro secret set PI_SLACK_APP_TOKEN and similar, then run agro gateway pi or agro gateway hermes and check agro gateway status. In ~/harness, ask the agent to clone projects, create worktrees per issue, and clean up after merge.
What are this agent's strengths and limitations?
- A single
agroCLI covers sandbox lifecycle, tool installs, and harness installs, replacing hand-maintained containers and toolchains. - Runs a dozen harnesses side by side, including Claude Code, Codex, Pi, OpenCode, Hermes, and T3 Code, so teams can switch without re-platforming.
- Git worktrees isolate each parallel task's branch and checked-out files, and the docs state agents will not overwrite each other's work.
- Ships shared skills and hooks, hidden-input secret storage via
agro secret, and Slack bridging throughagro gateway. - Self-hostable on a laptop or remote VM, with documented Dev Containers and GitHub Codespaces paths.
- The host must already have Docker with the Compose plugin, Git, and Node.js 22+, a higher bar than a plain CLI tool.
- Most harnesses and optional tools (herdr, agent-browser, tailscale, etc.) install on demand and need separate authentication, so first-time setup takes several steps.
- The runtime, CLI, container definitions, and harness spec are Apache-2.0, but Mifune Console, the control plane, and billing/enterprise policy/RBAC/hosted operations are proprietary, limiting fleet-scale operations.
- T3 Code requires an already-authenticated Claude Code, Codex, or OpenCode provider, and each Slack gateway needs its own Slack app and tokens.
- The docs do not describe native Windows support; the workflow assumes Docker and a shell.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| AGRO Sandbox Runtime This agent | 49 · Major gaps | CLIFree + model costs | ★ 42 | today | TypeScript | Codex · Claude Code |
| DevSpace | 50 · Major gaps | CLIFree + model costs | ★ 5.3k | today | TypeScript | ChatGPT |
| Gas Town — Multi-Agent Workspace Manager | 49 · Major gaps | CLIFree + model costs | ★ 19k | 1d ago | Go | Codex · Claude Code |
| Solo Agent | 48 · Major gaps | Self-hosted serviceFree + model costs | ★ 594 | 1mo ago | Go | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Security docs clearly separate ENFORCED vs DOCTRINE boundaries and disclose Docker socket, bypassPermissions, and cc-safety-net bypass routes, so transparency is decent. But defaults disable the permission engine, aliases inject --dangerously-skip-permissions, sudoers grants ALL=(ALL) ALL, install is curl|bash, and socket mount equals host root — high-privilege defaults deduct. Rollback is weak: agro destroy has no undo and deletes the home volume; only stop preserves. Attribution is limited to README/LICENSE copyright with no NOTICE or third-party attribution list.
README, quickstart, installation, and security docs are largely consistent on commands, paths, and defaults, and CI runs typecheck/build/test/boot-lint. However some dependencies (agent-browser, ffmpeg, microsandbox KVM) are unavailable or conditional inside the sandbox, so dependency availability is only partial. Failure messages appear in test scripts via exit codes and named errors, but overall CLI failure paths are not fully evidenced.
Targets developers using multiple coding harnesses, with local/remote/VM/Codespaces scenarios, so audience and scenarios are clear. Trigger precision is weaker: agent behavior relies on skill text and doctrine rather than deterministic triggers. Environment fit requires Docker, Node>=22, and Linux for host tools, narrowing applicability on Windows/macOS.
Docs have a clear TOC and topic pages; install notes are thorough (PATH, non-interactive shells, upgrades); known limitations are explicit in security and microsandbox docs; license is full Apache-2.0 with proprietary carve-out noted. Naming stability is weaker (--repo deprecated alias, CalVer→SemVer migration); versioning/changelog is only a rolling SemVer note in SECURITY with no standalone CHANGELOG; maintenance responsibility points to a personal email and an unverified publisher, so ownership is unclear.
CLI commands, wizard, harness install, and worktree flows are usable with concrete example outputs. Marginal value is limited by the heavy Docker+Node requirement and many optional tools, and core governance is largely doctrine rather than enforced, so real gain is uncertain. Cost is high: ~10-minute cold build, ~1GB agent-browser download, and multi-harness auth upkeep.
Docs cite concrete file paths (hooks, compose, scripts, tests), giving moderate traceability. But most security claims are prose without reproducible evidence; ADR #1378 is referenced but not shown. Cross-source corroboration is limited — README and security echo each other but lack independent third-party verification. Fact/inference separation is helped by ENFORCED/DOCTRINE labels, yet some claims (e.g., no egress bypass) are assertions without in-repo verifiable data.
- Permission engine is off by default with --dangerously-skip-permissions injected, giving agents broad autonomy; assess risk yourself.
- Docker socket mount equals host root; off by default but wizard can enable it, after which the sandbox is no longer a security boundary.
- cc-safety-net can be bypassed via script files, and Hermes has no hook/guard, so protection is incomplete.
- agro destroy has no undo and deletes the home volume (all logins and installs); rollback options are limited.
- curl|bash install and unverified publisher identity warrant supply-chain caution.
- Host-level tools (docker-engine, desktop) install as root and modify system config; removal is manual and includes destructive commands.
FAQ
Does AGRO cost anything?
Can agents in the sandbox read my host files?
--checkout and --home-mount bindings. Permission and trust-boundary details are covered in the security-considerations docs.Will parallel agents overwrite each other's changes?
~/harness/projects/<owner>/<repo>/.worktrees/, keeping checked-out files separate, and remove the worktree after the PR merges.Which coding harnesses are supported?
npx), each installed or launched with agro harness install <id>.Can I connect it to Slack?
xoxb- and xapp- tokens, then start agro gateway hermes or agro gateway pi and check agro gateway status.