You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Hardened infrastructure for always-on AI agents.**
7
7
8
-
Baudbot is an open framework for running always-on AI agents that support software teams — coding agents, automated SREs, QA bots, monitoring, triage, and more. Agents run as isolated Linux processes with defense-in-depth security. Baudbot assumes the worst: that an agent *will* be prompt-injected, and builds kernel-level walls that hold even when the LLM is fully compromised.
8
+
Baudbot runs AI agents as isolated Linux processes with defense-in-depth security. Agents code, test, deploy, monitor, and triage. They work on real repos with real tools. The infrastructure assumes agents *will* be prompt-injected and builds kernel-level walls that hold when the LLM is compromised.
9
9
10
-
**Built for Linux.** Baudbot uses kernel-level features (iptables, `/proc` hidepid, Unix users) that don't exist on macOS or Windows. Every PR is integration-tested on fresh **Ubuntu 24.04** and **Arch Linux** droplets.
10
+
Built for Linux. Uses iptables, `/proc` hidepid, and Unix user isolation. Every PR is integration-tested on fresh Ubuntu 24.04 and Arch Linux droplets.
11
11
12
12
## Why
13
13
14
-
Every AI agent framework gives the model shell access and hopes for the best. Baudbot doesn't hope — it enforces:
14
+
Every agent framework gives the model shell access and hopes for the best. Baudbot enforces:
15
15
16
-
-**OS-level isolation**— dedicated Unix user, no sudo, can't see other processes
-**Source/runtime separation**— agent can't read or modify its own infrastructure code
19
-
-**Dual-layer command blocking**— dangerous shell patterns caught before execution at two independent layers
20
-
-**Self-healing**— permissions hardened on every boot, secrets redacted from logs automatically
16
+
-**OS-level isolation.**Dedicated Unix user, no sudo, can't see other processes.
17
+
-**Network control.** iptables per-UID port allowlist. Standard ports only (80/443/22/53). No listeners, no reverse shells on non-standard ports.
18
+
-**Source/runtime separation.**Agent can't read or modify its own infrastructure.
19
+
-**Dual-layer command blocking.**Dangerous patterns caught at two independent layers.
20
+
-**Self-healing.**Permissions hardened on every boot, secrets redacted from logs.
21
21
22
-
Agents work on real files in real repos — no sandbox friction. They make real git branches, run real tests, and push real PRs. But they can't exfiltrate data, escalate privileges, or phone home.
22
+
No sandbox friction. Agents make real branches, run real tests, push real PRs. But they can't escalate privileges or open reverse shells.
The installer detects your distro, installs dependencies, creates the agent user, sets up the firewall, and walks you through API keys interactively. Takes ~2 minutes.
40
+
The installer detects your distro, installs dependencies, creates the agent user, sets up the firewall, and walks you through API keys. Takes ~2 minutes.
|**sentry-agent**| Watches Sentry alerts, investigates via API, reports triage to control agent |
76
+
77
+
Agents can read/write files, run shell commands, create git branches and PRs, build Docker images (via a security wrapper), message each other across sessions, monitor email inboxes, automate cloud browsers, and manage shared todos.
Slack is the primary human interface. Email is for agent-to-agent and automated workflows.
91
+
92
+
## How it works
93
+
94
+
The control agent spawns sub-agents in tmux sessions and starts the Slack bridge. Messages flow through layered security:
95
+
96
+
```
97
+
Slack → bridge (access control + content wrapping) → pi agent → tools (tool-guard + safe-bash) → workspace
98
+
```
99
+
100
+
Every layer assumes the previous one failed. The bridge wraps content and rate-limits, but tool-guard blocks dangerous commands even if wrapping is bypassed. Safe-bash blocks patterns even if tool-guard is evaded. The firewall blocks non-standard ports even if all software layers fail.
101
+
102
+
## Architecture
103
+
104
+
```
105
+
admin_user (your account)
106
+
├── ~/baudbot/ ← source repo (agent CANNOT read)
107
+
│ ├── bin/ deploy, firewall, security scripts
108
+
│ ├── pi/extensions/ 🔒 tool-guard, auto-name, etc.
Deploy is a one-way push: `~/baudbot/bin/deploy.sh` stages source to `/tmp`, copies as `baudbot_agent` via `sudo -u`, stamps an integrity manifest, and cleans up.
Baudbot runs a **control-agent** that spawns specialized sub-agents in tmux sessions and starts a Slack bridge. Out of the box it ships with a dev-agent (coding), sentry-agent (monitoring/triage), and a control-agent (orchestration) — but you can add any agent role. Messages flow:
170
+
An agent role is a skill file. Baudbot ships three but you can add more.
113
171
114
-
```
115
-
Slack → bridge (access control + content wrapping) → pi agent → tools (tool-guard + safe-bash) → workspace
116
-
```
117
-
118
-
Every layer assumes the previous one failed. The bridge wraps content and rate-limits, but tool-guard blocks dangerous commands even if wrapping is bypassed. Safe-bash blocks patterns even if tool-guard is somehow evaded. The firewall blocks exfiltration even if all software layers fail. Defense in depth, all the way down.
119
-
120
-
## Architecture
121
-
122
-
```
123
-
admin_user (your account)
124
-
├── ~/baudbot/ ← source repo (agent CANNOT read)
125
-
│ ├── bin/ deploy, firewall, security scripts
126
-
│ ├── pi/extensions/ 🔒 tool-guard, auto-name, etc.
0 commit comments