Open Managed Agents (OpenMA)

Open-source managed agent runtime with durable sessions, execution and recovery — any model, any harness, any sandbox, any cloud.

Stars
★ 326
Last updated
2d ago
License
Apache-2.0
Primary language
TypeScript

At a glance

How it runs
Self-hosted serviceFrameworkHosted service
Works with
Universal · cross-platformCodex · Claude Code · OpenAI API · Claude API
Cost
Free tier plus a paid hosted plan
Setup effort
High · needs real infrastructure
You'll need
Node.js (version in .node-version)pnpmDocker with ComposeShell / CLINetwork accessLocal filesystemMCP Server
Typical use
Teams running long coding jobs that want Claude Code or Codex inside an isolated sandbox (E2B, Daytona, Cloudflare Sandbox and others) while OpenMA handles workspace persistence and output collection.
Not a fit if
  • Teams that want a turnkey hosted API and no infra to babysit
  • Users who cannot provide an isolated sandbox or Docker runtime
  • Anyone needing a fully offline setup that calls no cloud model
Source review
62/100 · Some gaps

What does this agent do, and when should you use it?

Open Managed Agents (OpenMA) is an open-source, self-hostable alternative to Claude Managed Agents and OpenAI Agents API that positions itself as a meta-harness: it does not ship one agent loop, it manages the sessions, execution resources and recovery around a loop you choose. You can keep the harness outside the sandbox (built-in Pi, or your own implementation of the host-side harness interface) and use the sandbox only to run tools, or put a mature harness such as Claude Code or Codex into a managed sandbox through the ACP runtime. Session history, workspace checkpoints and collected outputs are persisted independently of both the loop process and the sandbox, so a sandbox failure does not erase the conversation and a replacement harness can rebuild context from durable events. Models are wired in through Model Cards (Anthropic, OpenAI, DeepSeek, OpenRouter and other Pi providers, plus custom endpoints), and database, queue and object storage are all swappable adapters. Deployment paths include native Node.js, Docker Compose, Fly.io, Vercel (Beta) and Cloudflare, alongside a hosted console.

You create an agent (name, model, system prompt), an environment (networking and packages) and a session; from then on OpenMA runs the event loop for you. Events such as user.message are sent with client.beta.sessions.events.send, persisted as durable records, handed to the selected harness, and streamed back as progress and output events. Built-in tooling covers shell execution, file read/write/edit, glob and text search, web search and page fetching, and optional browser automation (navigation, clicks, text input, screenshots); sessions can also load MCP services, Skills, repositories, files and persistent memory stores. When work finishes, the workspace is checkpointed and outputs are collected so the session can be resumed later. Three interfaces are exposed: Claude Managed Agents style /v1/* (works with the official Anthropic SDK), OpenAI Agents API style /openai/v1/* (tested against [email protected]), and OpenMA extensions under /v1/oma/* for Model Cards and product features. For scale-out, Node replicas claim different sessions in parallel through a durable execution outbox with renewable leases and fencing while work inside one session stays ordered; in-sandbox harnesses use a separate Environment Work claim instead.

  1. Teams running long coding jobs that want Claude Code or Codex inside an isolated sandbox (E2B, Daytona, Cloudflare Sandbox and others) while OpenMA handles workspace persistence and output collection.
  2. Platform teams avoiding vendor lock-in: models, harnesses, sandboxes, deployment, database, queue and object storage are seven independently replaceable layers.
  3. Developers who already have Anthropic or OpenAI SDK code and want to self-host — point baseURL at your own server and keep using /v1/* or /openai/v1/*.
  4. Workflow teams automating issue-to-PR: combine GitHub issues/PRs, Linear, Slack and Feishu integrations with OpenMatter's Loop runtime to turn work events into agent turns and deliver results back.
  5. Security-conscious operators who need provider keys encrypted at rest via Model Cards and scoped access to private services through a Vault-backed gateway.
  6. Individual developers validating agent behaviour locally with the single-host SQLite Docker Compose quickstart and their own API key.

How do you install or deploy this agent?

The recommended path is to let a coding agent install the deployment skill:

npx skills add openma-ai/open-managed-agents --skill deploy-openma

Then ask it to "Deploy OpenMA on this machine": the agent checks the environment, prepares configuration, deploys the platform and verifies the Console plus one agent task, asking for credentials and confirming paid cloud resources before creating them.

Manual Docker setup (requires Docker with Compose):

git clone https://github.com/openma-ai/open-managed-agents.git
cd open-managed-agents
cp .env.example .env

Before starting, edit .env: generate the two secrets with

openssl rand -hex 32      # BETTER_AUTH_SECRET
openssl rand -base64 32   # PLATFORM_ROOT_SECRET

then select an isolated SANDBOX_PROVIDER with its network, storage and credential-proxy settings, and set PUBLIC_BASE_URL. Keep authentication enabled — the deployment does not fall back to running agent commands in an unisolated host subprocess.

docker compose up -d --build
curl --fail http://localhost:8787/health

Open http://localhost:8787, create an account, then configure a model and environment in the Console. The Compose stack mounts ./data; keep it across restarts and upgrades.

Cloudflare deploy needs the Node version from .node-version, the repository's pinned pnpm, Docker for container builds, plus jq and openssl:

git clone https://github.com/openma-ai/open-managed-agents.git
cd open-managed-agents
pnpm install --frozen-lockfile
npx wrangler login
pnpm setup:cloudflare

The script provisions Cloudflare resources in your account, updates the local Wrangler config, sets secrets and deploys the Workers; it may incur charges and currently prompts for an Anthropic API key unless supplied in the environment.

How do you use this agent?

Create an API key, a Model Card and an environment in the Console, then call the API from your own code.

With the official Anthropic SDK (repository pins @anthropic-ai/[email protected]):

npm install @anthropic-ai/[email protected]
import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic({
  apiKey: process.env.OPENMA_API_KEY,
  baseURL: process.env.OPENMA_BASE_URL ?? "https://app.openma.ai",
});

const agent = await client.beta.agents.create({
  name: "researcher",
  model: process.env.OPENMA_MODEL_ID!,
  system: "Help me investigate a task and explain your findings.",
});

const session = await client.beta.sessions.create({
  agent: { type: "agent", id: agent.id, version: agent.version },
  environment_id: process.env.OPENMA_ENVIRONMENT_ID!,
});

await client.beta.sessions.events.send(session.id, {
  events: [{
    type: "user.message",
    content: [{ type: "text", text: "Help me plan a code review." }],
  }],
});

With the OpenAI SDK (tested baseline [email protected]):

npm install [email protected]
import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.OPENMA_API_KEY,
  baseURL: `${process.env.OPENMA_BASE_URL ?? "https://app.openma.ai"}/openai/v1`,
});

const events = await client.beta.agents.sessions.create({
  agent: {
    model: process.env.OPENMA_MODEL_ID!,
    instructions: "Help me investigate a task and explain your findings.",
  },
  environment: { type: "none" },
  input: "Help me plan a code review.",
  stream: true,
});

for await (const event of events) console.log(event);

For self-hosting, set OPENMA_BASE_URL to your own origin without a trailing slash (e.g. http://localhost:8787) and set OPENMA_MODEL_ID to the Model Card's model_id, not its database record ID. The OpenAI example above requests no sandbox.

Local development:

pnpm install --frozen-lockfile
pnpm typecheck
pnpm test

What are this agent's strengths and limitations?

Pros
  • Seven independently replaceable layers — models, harnesses, sandboxes, deployment, database, queue, object storage — each behind a documented interface (ports.ts, host-side harness interface), so no single vendor is mandatory.
  • Sessions are decoupled from execution: history lives apart from the loop and the sandbox, and sandbox failures are recovered from durable events plus workspace checkpoints; Node replicas share sessions via outbox, leases and fencing while intra-session ordering holds.
  • Two compatibility layers ship at once: Claude Managed Agents style /v1/* for the official Anthropic SDK and OpenAI Agents API style /openai/v1/* for the openai SDK, so existing code mostly needs a baseURL change.
  • Existing mature harnesses can be reused in-sandbox through ACP adapters (Claude Code, Codex and others), with harness versions installed independently of the sandbox image.
  • Deployment choice spans Docker, Fly.io, Vercel (Beta), Cloudflare and a hosted console, letting small pilots and scaled rollouts use different stacks.
  • Apache-2.0 licensed, with provider keys encrypted at rest through Model Cards when self-hosting.
Limitations
  • Self-hosting is not a one-liner: BETTER_AUTH_SECRET, PLATFORM_ROOT_SECRET, SANDBOX_PROVIDER, PUBLIC_BASE_URL and provider networking/credential-proxy settings all need hands-on configuration, and unisolated host execution is explicitly unsupported.
  • An isolated sandbox provider (E2B, Daytona, LiteBox, Cloudflare Sandbox, …) is required for real use, and remote sandboxes need reachable services rather than a bare private Docker hostname.
  • The two compatibility layers are not equivalent: the OpenAI adapter documents limits on environments, plugins and some model/tool settings, dynamic subagent control is currently Node-only and single-level, and hosted Cloudflare coverage differs.
  • The Cloudflare quickstart provisions chargeable resources in your own cloud account and by default asks for an Anthropic API key.
  • Some integration work is still proposed rather than shipped — unified Bond/Loop hosting with OpenMatter appears only as ADR 0011.
  • Scaled capacity depends on the chosen database, storage, sandbox provider and model rate limits; the SQLite single-host path is a quickstart, not a scale-out answer.

How does this agent compare with similar options?

The README explicitly frames OpenMA as an open-source, self-hostable alternative to Claude Managed Agents and OpenAI Agents API, and backs that up with two compatibility surfaces: /v1/* implementing the Claude Managed Agents contract for the official Anthropic SDK, and /openai/v1/* mapping the OpenAI Agents API onto native OpenMA agents and sessions. It also states plainly that it is an independent implementation and that API/runtime coverage should be checked before migrating. Claude Code and Codex are not rivals here — they are harnesses the platform can host inside a managed sandbox via its ACP runtime.

Key facts side by side with the most closely related agents.

Agent Source review Form / cost Stars Updated Language Full support on
Open Managed Agents (OpenMA) This agent 62 · Some gaps Self-hosted serviceFreemium ★ 326 2d ago TypeScript Codex · Claude Code · OpenAI API · Claude API
OtoDock 77 · Good Self-hosted serviceFreemium ★ 191 5d ago Python Codex · Claude Code
Runtm 63 · Some gaps CLIFreemium ★ 302 2d ago Python Codex · Claude Code
n8n-skills: Expert Claude Code skills for n8n workflows 52 · Major gaps Agent plugin / skillFree + model costs ★ 6.5k 3d ago Shell Claude Code

How does FollowAgents rate this agent?

FollowAgents source review · FARS-2.1
Some gaps
62/ 100 5-point scale 3.1 / 5
Trust 14/29
Reliability 8/14
Adaptability 14/18
Convention 14/18
Effectiveness 7/13
Verifiability 5/8
Why each dimension lost points
Trust14 / 29 · 2.4/5

Least privilege: README requires an isolated SANDBOX_PROVIDER and states the deployment does not fall back to running agent commands in an unisolated host subprocess; ACP state-binding tests show session state forced into per-session isolated directories (CODEX_HOME, CLAUDE_CONFIG_DIR) with percent-encoded sessionId to prevent path traversal, so 2. User confirmation: only the README mentions the deployment skill confirming paid cloud resources; no verifiable confirmation mechanism in the repo, so 1. Data-flow transparency: README describes session events, workspace checkpoints, credential proxy and outbound context (setOutboundContext/revokeOutboundContext); the certification worker demonstrates the egress proxy and revocation path, so 2. Sensitive data handling: Model Cards claim provider keys encrypted at rest; the certification worker writes codex auth to a 0600 file and removes it in finally; the ACP recovery prompt explicitly avoids copying tool inputs and tokens, so 2. Dependency security: package.json pins some versions (@anthropic-ai/sdk 0.120.0, ai 7.0.123, zod 4.3.6) but many deps use ^ ranges and no audit/lockfile policy is visible, so 1. External effects: setup-cf.sh provisions cloud resources that may incur charges; README warns but there is no enforced confirmation or dry-run in the repo, so 1. Rollback: README and the certification worker show checkpoint/restore, lease renewal, fencing and destroy semantics, so 2. Source attribution: LICENSE and NOTICE are referenced, but NOTICE content is not in the evidence, so third-party attribution cannot be verified, so 1.

Reliability8 / 14 · 2.9/5

Self-consistency: README architecture matches package.json scripts and test files (ACP state binding, recovery prompt), and explicitly distinguishes Node vs Cloudflare coverage, so 2. Dependency availability: many deps use ^ ranges and no lockfile evidence is provided, so reproducible install cannot be confirmed, so 1. Failure messages: the certification worker returns structured errors (method_not_allowed, unauthorized, invalid_request, checkpoint_required) and ACP recovery gives an explicit reason for missing native state, so 2.

Adaptability14 / 18 · 3.9/5

Audience and scenarios: README covers self-hosting, hosted, CLI, API, multi-model/multi-sandbox/multi-cloud with rich scenarios, so 3. Capability boundaries: explicitly states OpenAI adapter limits, single-level delegation, Cloudflare coverage differences, Vercel Beta, so 2. Trigger precision: this is a platform rather than a single agent; triggers are user-configured and no precise trigger contract is defined in the repo, so 1. Environment fit: provides Node/Docker, Fly, Vercel, Cloudflare paths and adapter interfaces, so 3.

Convention14 / 18 · 3.9/5

Information architecture: README is well structured with layered tables, architecture notes, API examples and self-host steps, so 3. Install notes: two quickstart paths (Docker Compose, Cloudflare) with environment variable guidance, so 3. Naming stability: package names and API paths (/v1, /openai/v1, /v1/oma) are stable, but version is 0.1.0 and an integration (OpenClaw) was removed, so 2. Examples and FAQ: Anthropic and OpenAI SDK examples are provided, but no standalone FAQ, so 2. Known limitations: API coverage, delegation, credentials and backend extension limits are listed but not consolidated, so 2. License: full Apache-2.0 text present, so 3. Versioning/changelog: changesets and a release workflow exist, but CHANGELOG content is not in the evidence, so 2. Maintenance responsibility: publisher identity is unverified; SECURITY.md gives reporting channels and supported-version policy, but the maintaining entity is unclear, so 1.

Effectiveness7 / 13 · 2.7/5

Output usability: API examples are directly runnable and sessions can be followed in the Console, so 2. Marginal value: as a self-hosted alternative it provides sessions, execution, recovery and many adapters, but requires self-operation, so 2. Cost-benefit: requires self-built database, queue, object storage and sandbox; operational cost is high and unquantified, so 1.

Verifiability5 / 8 · 3.1/5

Claim traceability: README claims link to concrete files and doc paths, so 2. Cross-source corroboration: README claims are corroborated by package.json scripts, test files and workflow files, so 2. Fact/inference separation: README labels Beta, proposed integration and adapter limits, distinguishing implemented from planned, so 2.

Risks and how to mitigate them
  • Publisher identity is unverified; the maintaining entity and update path are unclear, so confirm governance and support responsibility before enterprise adoption.
  • Many dependencies use ^ ranges and no lockfile evidence is provided, so reproducible installs and supply-chain safety cannot be confirmed.
  • The Cloudflare setup script provisions paid cloud resources with no enforced confirmation or dry-run in the repo; review manually before running.
  • NOTICE content is not included in the evidence, so third-party attribution and license compliance cannot be verified.
  • This is a static source review; no code was executed and tests/runtime behavior were not independently verified.
Evidence confidence: Low Reviewed Oct 16, 2026 Reviewed revision fa3a68cf9eb8 New commits since this review; the score may not cover them
See the full review method →

Recent releases

Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.

  1. Release notes excerpt
    Patch Changes - 57906b3: Pi harness skill mounting strategies (skill_mount: progressive default, budgeted, tool, inline) replace default full SKILL.md system-prompt inlining for default/Pi harnesses. Deferred skills in budgeted mode are discoverable via tool_search; tool mode adds a skill loader tool.
    View on GitHub ↗
  2. Release notes excerpt
    Patch Changes - 57906b3: Pi harness skill mounting strategies (skill_mount: progressive default, budgeted, tool, inline) replace default full SKILL.md system-prompt inlining for default/Pi harnesses. Deferred skills in budgeted mode are discoverable via tool_search; tool mode adds a skill loader tool.
    View on GitHub ↗
  3. Release notes excerpt
    Patch Changes - 38f58cb: Pi agent-core is the default harness; legacy ai-sdk remains available but deprecated (one-time session.warning per session). Agents accept compaction via _oma.context_management (Anthropic Messages shape) or _oma.model_settings (OpenAI Agents SDK shape); conflicting dual definitions are rejected at save time. MCP tool results preserve content blocks on the wire. Agent max_tokens above the catalog window is accepted with a warning; pi-ai clamps output per request. …
    View on GitHub ↗

FAQ

Can I self-host without a sandbox and just run agent commands on the host?
No. The README states the deployment does not fall back to running agent commands in an unisolated host subprocess, so you must select and configure an isolated SANDBOX_PROVIDER. The only documented sandbox-free path is certain OpenAI adapter sessions that request environment: { type: "none" }.
How are models and API credentials handled?
Models are attached through Console Model Cards covering Anthropic, OpenAI, DeepSeek, OpenRouter and other Pi providers, plus custom endpoints; provider keys are encrypted at rest by Model Cards. A Vault-backed gateway can scope access to private services, but the README notes that enforced credential isolation depends on the chosen provider and runtime profile.
Do the official Anthropic and OpenAI SDKs work against it directly?
Yes. The repository pins the official Anthropic SDK to 0.120.0 and the OpenAI adapter's tested baseline is [email protected]; you point baseURL at the OpenMA server. Bear in mind the contracts are separate, and the OpenAI adapter has additional limits around dynamic subagents and environment settings that do not describe the whole platform.
What does it actually cost to run?
The software is Apache-2.0 and the hosted console has a free login entry point; real spend comes from model API calls, the sandbox provider you pick, and the deployment target. Be aware that the Cloudflare quickstart creates chargeable resources in your own account, as do the Fly.io and Vercel paths.
Is multi-replica execution safe, and can sessions go out of order?
Per the README, Node deployments can share PostgreSQL or MySQL. For harnesses outside the sandbox, replicas claim different sessions in parallel through a durable execution outbox with renewable leases and fencing, while work within a single session stays ordered. In-sandbox harnesses use the separate Environment Work claim rather than nesting a second Session execution claim.
View on GitHub ↗ Install ↓

Compare agents like this one

The same FARS review applied across the shortlist this agent qualifies for.

Related agents