Letting an agent run anything, safely

Temenos is a secure runtime for AI agents. Your agent runs on the host, where it works best. The code it executes runs inside a sandbox. The boundary holds whether you supervise one agent by hand or run a thousand of them in allow-all mode.

The trust problem

Coding agents are useful in proportion to how much they are allowed to do. An agent that has to ask permission for every shell command is slow. An agent that can do anything is fast, but a single bad output can delete files, leak secrets, or break the network.

Most teams compromise by approving every command. That works for a while. It does not scale to the point where you want twenty agents working in parallel overnight, and it stops the team from really trusting any of them.

The Temenos approach

Run the agent on the host. Run the code it executes in a box.

That single line is what Temenos is about. The agent itself stays on the host machine, where its model keys, its updates, and its tool integrations work the way they always have. The shell commands, file writes, and network calls the agent issues are routed into a sandbox where they cannot touch the host.

cd ~/code/my-repo
temenos claude   # Claude runs on the host; everything it executes runs in a box

The sandbox is gVisor, a userspace kernel. The host filesystem is invisible to it beyond what the policy explicitly mounts. Most kernel CVE surface is intercepted before it reaches the host. Network can be cut with a single flag.

How the boundary is enforced

Temenos does not ask the agent to be careful. It removes the tools that could do damage. The native Bash, Read, Write, and Edit tools that a coding agent normally has are banned. The only execution path left is through Temenos's own MCP server. A stray .mcp.json cannot re-open a host-capable server.

This is the point. The dangerous capability is not discouraged. It is removed. Allow-all mode stays safe because there is no path to the host left to allow.

What this unlocks

• Overnight swarms. Spin up a hundred agents on a hundred repos. Each one in its own box. None of them can step on each other or the host.
• Multi-tenant agent platforms. Run customer agents on shared infrastructure without giving them a path to each other's data.
• Real allow-all. The team stops approving every command. The agent moves faster. Nothing on the host gets touched.
• Auditability. Every command, every file write, every network call goes through Temenos. The audit log is complete and structured.

Boxes are first class

Each box is named, persistent, checkpointable, and inspectable. You can temenos exec into one, temenos shell for an interactive session, temenos diff to see what changed, and temenos audit to read the full log. Everything lives in a .temenos/<box>/ directory you can delete with rm -rf when you are done.

Background checkpointing is on by default. The box restores in tens of milliseconds the next time the same workflow runs, so a session that spans days does not pay the startup cost on every call.

Where this fits

Temenos sits underneath the agent. If you are running OpenVibe or any other coding agent at scale, Temenos is what lets you stop manually approving and start trusting the system. Same box, any scale.