new: v0.3 — kubernetes-native sandboxes and the multi-user control plane. read the changelog ›
the open-source control plane for ai agents

agents do the work.you keep the veto.

fluidbox runs your ai agents in disposable sandboxes, checks every action against your rules, and keeps a complete record of every run — so you can hand them real work without holding your breath.

mit open source~5 min to first runyour infra — self-hosteddocker + k8s deploys
How it protects you

Routine work flows. Risky calls stop.

Every action an agent takes is checked first — against your spending limits, your rules, and your list of things that need a human. A denial is safe: the agent simply hears "no" and keeps working.

Autonomous runs follow the same rules. Nothing bypasses the gate.

How decisions are made ›
budgetspending and time limits, checked first
frozen surfaceonly the tools you attached exist
schemaarguments checked before anything runs
trust tierfork PRs stay read-only, always
policyallow · deny · ask a human
approvalno answer means no
The receipts

Watch it decide — then keep the receipts.

Every run ends with a diff, a cost, and a timeline of every decision — what was allowed, what was denied, and who approved what. When someone asks what the agent did, you have the answer.

run 0198f2c4agent fixer · policy default v7 · RunSpec frozen
14tool.requestedEdit crates/core/src/policy.rs
15tool.decisionallowpolicy · paths /workspace/**
16tool.requestedRead ~/.ssh/id_ed25519
17tool.decisiondenypolicy · outside /workspace/** — run continues
18tool.requestedmcp__linear__create_issue (brokered)
19tool.decisionapprovepolicy · pausing for a human · ttl 600s
── awaiting_approval · 38s · approved_once by an owner ──
22tool.brokeredokcontrol-plane call · 212ms · result sha256:9f2c…
23usage2,148 tokens · $0.011 of $2.50 budget · wall 4m12s
prompts ▮▮▮▮▮▮▮▮▮▮ redacted at ingest — only digests reach the ledger
Open source

Free, open, and tested like infrastructure.

MIT-licensed, all of it — the whole product, not a limited edition. You can read every line that governs your agents, and the test suites that prove it behaves.

Star on GitHubMIT license
850tests, green in seconds
10end-to-end suites against live sandboxes
2agent harnesses supported today
0cloud resources left behind after teardown
Get started

Your first governed run in about five minutes.

Run it on your own machine with Docker, or on your cluster with the Helm chart. Your code and your credentials never leave your infrastructure.

Give your agents rules, receipts, and a place to run.