Omnara Managed Agent Platform

The permissions guide says agents can use only tools in the current config, changing the set requires a config update, and tools support always_allow, always_ask, and always_deny. This supports least privilege and human approval, but built-in and custom tools default to always_allow, so the scores are not full. The README and docs describe connections to models, tools, machines, and external integrations, and give some visibility into permissions, credential sharing, and event records. Self-hosted history stays in the operator's Postgres and credentials use secrets, but the supplied files do not detail encryption, retention, or access auditing. CI declares govulncheck and the dependency manifest is substantial, but no scan result or remediation evidence is supplied. Agent cancellation/archive and durable event logs offer partial recovery paths; no rollback mechanism is described. Repository and project naming provide some attribution, but publisher identity is unverified, so provenance is only partly clear.

The README's account of the API, Postgres event log, and stateless workers is consistent with its persistence and event-stream descriptions. The CI workflow lists static checks, unit, integration, and end-to-end jobs, but this review did not run them. Operation depends on Docker, databases, Redis, model services, machines, or cloud resources; the supplied material does not establish their availability guarantees. API and CLI examples provide limited HTTP error-handling detail, and the supplied files say little about runtime error messages, retries, or diagnosis, so these scores remain partial.

The README identifies cloud and self-hosted deployments, multiple models, machines, tools, integrations, schedules, and developer APIs as supported audiences and scenarios, justifying a high score. Tool permissions, machine sources, and model configuration show capability boundaries, but high-level claims include command execution, file edits, and third-party services; concrete isolation limits depend on deployment and config and are not fully explained. Triggers include CLI/API, Slack, Discord, GitHub, and cron, with examples but not complete trigger constraints. Docker Compose, local development, production-guide links, and several interfaces support environment fit, while the supplied files do not cover every environment requirement or production setting.

The README is organized into quickstart, self-hosting, architecture, features, examples, FAQ, development, and community, with clear documentation links. It gives cloud and self-host install steps, while production details are external; it explicitly says local defaults are insecure. Product, CLI, SDK, API, and config naming are mostly consistent, and examples and FAQ are substantial, but the supplied files do not establish naming stability across versions. The LICENSE clearly provides Apache 2.0, earning full marks. The README links a changelog and the security policy says fixes track main before stable releases, but no concrete release history is supplied here. Security reporting routes and contact are clear; maintenance responsibility rests on project statements and an unverified publisher, with no named maintainers or support commitment in the supplied material.

Users can launch through CLI, REST, SDK, or dashboard, and the repository provides event streaming, inputs, permission modes, and agent examples. This is useful for common integrations, though the evidence is mostly documentation and claims rather than concrete runtime outputs. Hosting, durable state, multiple models and machines, and permission controls add substantial capability beyond an agent loop embedded in an application. Self-hosting has no platform fee but requires operating Postgres, Redis, storage, workers, and machines; cloud pricing is described as usage-based for models and sandboxes, but the supplied information is not enough to estimate total operating cost.

The README links major architecture and capability claims to configuration, permissions, API, and deployment documentation; examples and the API definition are also identified. The permissions guide gives concrete modes and defaults. The README, quickstart, permissions guide, and CI corroborate some concepts, but the supplied material lacks implementation source or scan output, so runtime enforcement cannot be independently checked here. Documentation distinguishes defaults, config examples, and product descriptions, but claims about provider compatibility, recovery, and isolation are still assertions in places and do not always state their conditions, so full marks are not justified.