Semagentic is a secure multi-agent harness. Every agent runs inside its own sandbox, bound to its own workspace, network, and capabilities. It can reach nothing you didn't hand it.
Several prompts, one memory space, one filesystem, one credential. A single poisoned document, a web page it fetched or a repo it cloned, and the agent can read what it shouldn't, spend what isn't yours, or quietly ship your data somewhere. Semagentic draws the boundaries the others skip.
The model runs in a sandbox with no secrets in its environment. Credentials are injected outside the boundary, at the moment of use. If the agent dumps its whole environment, nothing of value leaves.
process isolationEach agent mounts only the folder you point it at. Nothing else on disk exists as far as it's concerned. No stray reads of ~/.ssh, no wandering into a sibling project.
per-agent workspaceA default-deny egress proxy sits in front of every socket the agent opens. Only allowlisted destinations get through. Exfiltration isn't policed after the fact. It never connects.
egress controlYou wanted the agent in your files. That's the product. So each turn is a reviewable diff over a snapshot. A destructive mistake goes from a disaster to a one-command undo.
reversible workspaceRun many agents: a researcher, a bookkeeper, a reviewer, each with its own role and its own slice of your data. The bookkeeper never touches the code repo. Grants are per agent, not one blanket set.
per-agent grantsEvery tool call, every credential minted, every byte that crossed the egress line is logged and attributed to a named agent. You get a real trail, not a promise that the model behaved.
full audit logAssembling a prompt and streaming tokens isn't privileged, so it stays inside the boundary with the agent. Spending a credential or reaching past the workspace is privileged, so those powers, and every secret, live outside where the model can't reach them.
Today, an install runs for one person: you, so the adversary isn't another customer sharing your runtime. The thing to contain is the agent itself, behaving badly on your machine with your access, through an injection, a poisoned page, or a confident mistake.
Read, Write, Edit, Bash, acting only on your mounted folder, contained by the sandbox itself.
Answers one question: may I use this capability? Checks the grant, mints a short-lived token, returns the result.
Answers a different one: may this leave? Sees every socket the sandbox opens; drops anything off the allowlist.
Held in the OS keychain, injected at the boundary. They never enter the sandbox and never reach anyone's infrastructure but yours.
One small YAML file per agent declares its role, the folders it may touch, the tools it holds, where it may connect, and what it may spend. The harness turns that into real, enforced boundaries.
Persona, workspace paths with read or write mode, tool grants, egress allowlist, credential grants. No Dockerfiles to write.
Each running agent gets its own container, its own network, and only its own mounts. Two agents at once are two cages, not two threads.
Credentialed actions go through the gateway; every outbound packet passes the proxy. The model meets a policy, not your secrets.
Each turn is a diff you can inspect and roll back, and a line in an audit log attributed to that agent. Trust, but verify. Literally.
The same software runs wherever you put it. Start on your machine, move to a host you own, spread a swarm of agents across several. The process topology never changes, only the machine assignment and the transport do.
Everything on one machine over loopback. No open ports, no TLS, no accounts. The default, and the fastest way to run.
The same build on a box in your own network. Your data and credentials never leave the building, so security review stays short.
Any machine you rent, from a small VM upward. The client talks to it over TLS; the agents run where you point them.
The machine boundary is optional. Only an env file changes between targets, so what you proved safe on your laptop is the same thing running on your server.
Run many agents at once, each sealed in its own sandbox with its own workspace, network, and grants, spread across the machines you choose and driven from one place. One way to deploy them all, wherever they physically run.
Nothing's shipped yet. The core engine is being built now, with the security boundaries staged right behind it.
We're not shipping yet, still building the boundaries. Leave your email and we'll reach out when there's something real to run and more to share.