Open Managed Agents (OpenMA)
Open-source managed agent runtime with durable sessions, execution and recovery — any model, any harness, any sandbox, any cloud.
- Source repo
- openma-ai/open-managed-agents
- Stars
- ★ 326
- Last updated
- 2d ago
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 62/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code · OpenAI API · Claude API
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- High · needs real infrastructure
- You'll need
- Typical use
- Teams running long coding jobs that want Claude Code or Codex inside an isolated sandbox (E2B, Daytona, Cloudflare Sandbox and others) while OpenMA handles workspace persistence and output collection.
- Not a fit if
- Teams that want a turnkey hosted API and no infra to babysit
- Users who cannot provide an isolated sandbox or Docker runtime
- Anyone needing a fully offline setup that calls no cloud model
- Source review
- 62/100 · Some gaps
What does this agent do, and when should you use it?
Open Managed Agents (OpenMA) is an open-source, self-hostable alternative to Claude Managed Agents and OpenAI Agents API that positions itself as a meta-harness: it does not ship one agent loop, it manages the sessions, execution resources and recovery around a loop you choose. You can keep the harness outside the sandbox (built-in Pi, or your own implementation of the host-side harness interface) and use the sandbox only to run tools, or put a mature harness such as Claude Code or Codex into a managed sandbox through the ACP runtime. Session history, workspace checkpoints and collected outputs are persisted independently of both the loop process and the sandbox, so a sandbox failure does not erase the conversation and a replacement harness can rebuild context from durable events. Models are wired in through Model Cards (Anthropic, OpenAI, DeepSeek, OpenRouter and other Pi providers, plus custom endpoints), and database, queue and object storage are all swappable adapters. Deployment paths include native Node.js, Docker Compose, Fly.io, Vercel (Beta) and Cloudflare, alongside a hosted console.
You create an agent (name, model, system prompt), an environment (networking and packages) and a session; from then on OpenMA runs the event loop for you. Events such as user.message are sent with client.beta.sessions.events.send, persisted as durable records, handed to the selected harness, and streamed back as progress and output events. Built-in tooling covers shell execution, file read/write/edit, glob and text search, web search and page fetching, and optional browser automation (navigation, clicks, text input, screenshots); sessions can also load MCP services, Skills, repositories, files and persistent memory stores. When work finishes, the workspace is checkpointed and outputs are collected so the session can be resumed later. Three interfaces are exposed: Claude Managed Agents style /v1/* (works with the official Anthropic SDK), OpenAI Agents API style /openai/v1/* (tested against [email protected]), and OpenMA extensions under /v1/oma/* for Model Cards and product features. For scale-out, Node replicas claim different sessions in parallel through a durable execution outbox with renewable leases and fencing while work inside one session stays ordered; in-sandbox harnesses use a separate Environment Work claim instead.
- Teams running long coding jobs that want Claude Code or Codex inside an isolated sandbox (E2B, Daytona, Cloudflare Sandbox and others) while OpenMA handles workspace persistence and output collection.
- Platform teams avoiding vendor lock-in: models, harnesses, sandboxes, deployment, database, queue and object storage are seven independently replaceable layers.
- Developers who already have Anthropic or OpenAI SDK code and want to self-host — point baseURL at your own server and keep using /v1/* or /openai/v1/*.
- Workflow teams automating issue-to-PR: combine GitHub issues/PRs, Linear, Slack and Feishu integrations with OpenMatter's Loop runtime to turn work events into agent turns and deliver results back.
- Security-conscious operators who need provider keys encrypted at rest via Model Cards and scoped access to private services through a Vault-backed gateway.
- Individual developers validating agent behaviour locally with the single-host SQLite Docker Compose quickstart and their own API key.
How do you install or deploy this agent?
The recommended path is to let a coding agent install the deployment skill:
npx skills add openma-ai/open-managed-agents --skill deploy-openmaThen ask it to "Deploy OpenMA on this machine": the agent checks the environment, prepares configuration, deploys the platform and verifies the Console plus one agent task, asking for credentials and confirming paid cloud resources before creating them.
Manual Docker setup (requires Docker with Compose):
git clone https://github.com/openma-ai/open-managed-agents.git
cd open-managed-agents
cp .env.example .envBefore starting, edit .env: generate the two secrets with
openssl rand -hex 32 # BETTER_AUTH_SECRET
openssl rand -base64 32 # PLATFORM_ROOT_SECRETthen select an isolated SANDBOX_PROVIDER with its network, storage and credential-proxy settings, and set PUBLIC_BASE_URL. Keep authentication enabled — the deployment does not fall back to running agent commands in an unisolated host subprocess.
docker compose up -d --build
curl --fail http://localhost:8787/healthOpen http://localhost:8787, create an account, then configure a model and environment in the Console. The Compose stack mounts ./data; keep it across restarts and upgrades.
Cloudflare deploy needs the Node version from .node-version, the repository's pinned pnpm, Docker for container builds, plus jq and openssl:
git clone https://github.com/openma-ai/open-managed-agents.git
cd open-managed-agents
pnpm install --frozen-lockfile
npx wrangler login
pnpm setup:cloudflareThe script provisions Cloudflare resources in your account, updates the local Wrangler config, sets secrets and deploys the Workers; it may incur charges and currently prompts for an Anthropic API key unless supplied in the environment.
How do you use this agent?
Create an API key, a Model Card and an environment in the Console, then call the API from your own code.
With the official Anthropic SDK (repository pins @anthropic-ai/[email protected]):
npm install @anthropic-ai/[email protected]import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic({
apiKey: process.env.OPENMA_API_KEY,
baseURL: process.env.OPENMA_BASE_URL ?? "https://app.openma.ai",
});
const agent = await client.beta.agents.create({
name: "researcher",
model: process.env.OPENMA_MODEL_ID!,
system: "Help me investigate a task and explain your findings.",
});
const session = await client.beta.sessions.create({
agent: { type: "agent", id: agent.id, version: agent.version },
environment_id: process.env.OPENMA_ENVIRONMENT_ID!,
});
await client.beta.sessions.events.send(session.id, {
events: [{
type: "user.message",
content: [{ type: "text", text: "Help me plan a code review." }],
}],
});With the OpenAI SDK (tested baseline [email protected]):
npm install [email protected]import OpenAI from "openai";
const client = new OpenAI({
apiKey: process.env.OPENMA_API_KEY,
baseURL: `${process.env.OPENMA_BASE_URL ?? "https://app.openma.ai"}/openai/v1`,
});
const events = await client.beta.agents.sessions.create({
agent: {
model: process.env.OPENMA_MODEL_ID!,
instructions: "Help me investigate a task and explain your findings.",
},
environment: { type: "none" },
input: "Help me plan a code review.",
stream: true,
});
for await (const event of events) console.log(event);For self-hosting, set OPENMA_BASE_URL to your own origin without a trailing slash (e.g. http://localhost:8787) and set OPENMA_MODEL_ID to the Model Card's model_id, not its database record ID. The OpenAI example above requests no sandbox.
Local development:
pnpm install --frozen-lockfile
pnpm typecheck
pnpm testWhat are this agent's strengths and limitations?
- Seven independently replaceable layers — models, harnesses, sandboxes, deployment, database, queue, object storage — each behind a documented interface (ports.ts, host-side harness interface), so no single vendor is mandatory.
- Sessions are decoupled from execution: history lives apart from the loop and the sandbox, and sandbox failures are recovered from durable events plus workspace checkpoints; Node replicas share sessions via outbox, leases and fencing while intra-session ordering holds.
- Two compatibility layers ship at once: Claude Managed Agents style /v1/* for the official Anthropic SDK and OpenAI Agents API style /openai/v1/* for the openai SDK, so existing code mostly needs a baseURL change.
- Existing mature harnesses can be reused in-sandbox through ACP adapters (Claude Code, Codex and others), with harness versions installed independently of the sandbox image.
- Deployment choice spans Docker, Fly.io, Vercel (Beta), Cloudflare and a hosted console, letting small pilots and scaled rollouts use different stacks.
- Apache-2.0 licensed, with provider keys encrypted at rest through Model Cards when self-hosting.
- Self-hosting is not a one-liner:
BETTER_AUTH_SECRET,PLATFORM_ROOT_SECRET,SANDBOX_PROVIDER,PUBLIC_BASE_URLand provider networking/credential-proxy settings all need hands-on configuration, and unisolated host execution is explicitly unsupported. - An isolated sandbox provider (E2B, Daytona, LiteBox, Cloudflare Sandbox, …) is required for real use, and remote sandboxes need reachable services rather than a bare private Docker hostname.
- The two compatibility layers are not equivalent: the OpenAI adapter documents limits on environments, plugins and some model/tool settings, dynamic subagent control is currently Node-only and single-level, and hosted Cloudflare coverage differs.
- The Cloudflare quickstart provisions chargeable resources in your own cloud account and by default asks for an Anthropic API key.
- Some integration work is still proposed rather than shipped — unified Bond/Loop hosting with OpenMatter appears only as ADR 0011.
- Scaled capacity depends on the chosen database, storage, sandbox provider and model rate limits; the SQLite single-host path is a quickstart, not a scale-out answer.
How does this agent compare with similar options?
The README explicitly frames OpenMA as an open-source, self-hostable alternative to Claude Managed Agents and OpenAI Agents API, and backs that up with two compatibility surfaces: /v1/* implementing the Claude Managed Agents contract for the official Anthropic SDK, and /openai/v1/* mapping the OpenAI Agents API onto native OpenMA agents and sessions. It also states plainly that it is an independent implementation and that API/runtime coverage should be checked before migrating. Claude Code and Codex are not rivals here — they are harnesses the platform can host inside a managed sandbox via its ACP runtime.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Open Managed Agents (OpenMA) This agent | 62 · Some gaps | Self-hosted serviceFreemium | ★ 326 | 2d ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
| OtoDock | 77 · Good | Self-hosted serviceFreemium | ★ 191 | 5d ago | Python | Codex · Claude Code |
| Runtm | 63 · Some gaps | CLIFreemium | ★ 302 | 2d ago | Python | Codex · Claude Code |
| n8n-skills: Expert Claude Code skills for n8n workflows | 52 · Major gaps | Agent plugin / skillFree + model costs | ★ 6.5k | 3d ago | Shell | Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Least privilege: README requires an isolated SANDBOX_PROVIDER and states the deployment does not fall back to running agent commands in an unisolated host subprocess; ACP state-binding tests show session state forced into per-session isolated directories (CODEX_HOME, CLAUDE_CONFIG_DIR) with percent-encoded sessionId to prevent path traversal, so 2. User confirmation: only the README mentions the deployment skill confirming paid cloud resources; no verifiable confirmation mechanism in the repo, so 1. Data-flow transparency: README describes session events, workspace checkpoints, credential proxy and outbound context (setOutboundContext/revokeOutboundContext); the certification worker demonstrates the egress proxy and revocation path, so 2. Sensitive data handling: Model Cards claim provider keys encrypted at rest; the certification worker writes codex auth to a 0600 file and removes it in finally; the ACP recovery prompt explicitly avoids copying tool inputs and tokens, so 2. Dependency security: package.json pins some versions (@anthropic-ai/sdk 0.120.0, ai 7.0.123, zod 4.3.6) but many deps use ^ ranges and no audit/lockfile policy is visible, so 1. External effects: setup-cf.sh provisions cloud resources that may incur charges; README warns but there is no enforced confirmation or dry-run in the repo, so 1. Rollback: README and the certification worker show checkpoint/restore, lease renewal, fencing and destroy semantics, so 2. Source attribution: LICENSE and NOTICE are referenced, but NOTICE content is not in the evidence, so third-party attribution cannot be verified, so 1.
Self-consistency: README architecture matches package.json scripts and test files (ACP state binding, recovery prompt), and explicitly distinguishes Node vs Cloudflare coverage, so 2. Dependency availability: many deps use ^ ranges and no lockfile evidence is provided, so reproducible install cannot be confirmed, so 1. Failure messages: the certification worker returns structured errors (method_not_allowed, unauthorized, invalid_request, checkpoint_required) and ACP recovery gives an explicit reason for missing native state, so 2.
Audience and scenarios: README covers self-hosting, hosted, CLI, API, multi-model/multi-sandbox/multi-cloud with rich scenarios, so 3. Capability boundaries: explicitly states OpenAI adapter limits, single-level delegation, Cloudflare coverage differences, Vercel Beta, so 2. Trigger precision: this is a platform rather than a single agent; triggers are user-configured and no precise trigger contract is defined in the repo, so 1. Environment fit: provides Node/Docker, Fly, Vercel, Cloudflare paths and adapter interfaces, so 3.
Information architecture: README is well structured with layered tables, architecture notes, API examples and self-host steps, so 3. Install notes: two quickstart paths (Docker Compose, Cloudflare) with environment variable guidance, so 3. Naming stability: package names and API paths (/v1, /openai/v1, /v1/oma) are stable, but version is 0.1.0 and an integration (OpenClaw) was removed, so 2. Examples and FAQ: Anthropic and OpenAI SDK examples are provided, but no standalone FAQ, so 2. Known limitations: API coverage, delegation, credentials and backend extension limits are listed but not consolidated, so 2. License: full Apache-2.0 text present, so 3. Versioning/changelog: changesets and a release workflow exist, but CHANGELOG content is not in the evidence, so 2. Maintenance responsibility: publisher identity is unverified; SECURITY.md gives reporting channels and supported-version policy, but the maintaining entity is unclear, so 1.
Output usability: API examples are directly runnable and sessions can be followed in the Console, so 2. Marginal value: as a self-hosted alternative it provides sessions, execution, recovery and many adapters, but requires self-operation, so 2. Cost-benefit: requires self-built database, queue, object storage and sandbox; operational cost is high and unquantified, so 1.
Claim traceability: README claims link to concrete files and doc paths, so 2. Cross-source corroboration: README claims are corroborated by package.json scripts, test files and workflow files, so 2. Fact/inference separation: README labels Beta, proposed integration and adapter limits, distinguishing implemented from planned, so 2.
- Publisher identity is unverified; the maintaining entity and update path are unclear, so confirm governance and support responsibility before enterprise adoption.
- Many dependencies use ^ ranges and no lockfile evidence is provided, so reproducible installs and supply-chain safety cannot be confirmed.
- The Cloudflare setup script provisions paid cloud resources with no enforced confirmation or dry-run in the repo; review manually before running.
- NOTICE content is not included in the evidence, so third-party attribution and license compliance cannot be verified.
- This is a static source review; no code was executed and tests/runtime behavior were not independently verified.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Patch Changes - 57906b3: Pi harness skill mounting strategies (skill_mount: progressive default, budgeted, tool, inline) replace default full SKILL.md system-prompt inlining for default/Pi harnesses. Deferred skills in budgeted mode are discoverable via tool_search; tool mode adds a skill loader tool.View on GitHub ↗ -
Release notes excerpt
Patch Changes - 57906b3: Pi harness skill mounting strategies (skill_mount: progressive default, budgeted, tool, inline) replace default full SKILL.md system-prompt inlining for default/Pi harnesses. Deferred skills in budgeted mode are discoverable via tool_search; tool mode adds a skill loader tool.View on GitHub ↗ -
Release notes excerpt
Patch Changes - 38f58cb: Pi agent-core is the default harness; legacy ai-sdk remains available but deprecated (one-time session.warning per session). Agents accept compaction via _oma.context_management (Anthropic Messages shape) or _oma.model_settings (OpenAI Agents SDK shape); conflicting dual definitions are rejected at save time. MCP tool results preserve content blocks on the wire. Agent max_tokens above the catalog window is accepted with a warning; pi-ai clamps output per request. …View on GitHub ↗
FAQ
Can I self-host without a sandbox and just run agent commands on the host?
SANDBOX_PROVIDER. The only documented sandbox-free path is certain OpenAI adapter sessions that request environment: { type: "none" }.