Show HN: 5dive – Run a Company of Claude Code/Codex Agents (Written in Bash)

5dive, a new open-source tool written in Bash, lets users run a company of AI coding agents (Claude, Codex, and others) on their own Linux server, with each agent as a separate Linux user managed by systemd and coordinated through a shared SQLite task queue. The tool, released under MIT license, aims to minimize human intervention by having agents escalate only when a decision is needed, and it has already been used to ship releases of 5dive.ai itself.

run a company of AI agents on a server you own English ｜ 简体中文 /5dive-ai/5dive/blob/main/README.zh-CN.md Quickstart quickstart · Why 5dive why-5dive · Zero-human proof /5dive-ai/5dive/blob/main/docs/zero-human.md · Use from your AI agent for-your-ai-agent · Security security--isolation · Full CLI docs https://5dive.ai/docs/5dive-cli?utm source=github&utm medium=owned&utm campaign=5dive-readme · Managed VM https://5dive.ai?utm source=github&utm medium=owned&utm campaign=5dive-readme A company of AI agents, and the orchestrator is just bash. No framework, no protocol, no broker: each agent is its own Linux user running an official coding CLI claude, codex, a few others as a systemd service, coordinating through one bash CLI they all call. Isolation is unix users, supervision is systemd, logs are journald. I used the OS instead of building a platform. They take work off a shared SQLite task queue, hand it to each other while you sleep, and ping your phone over Telegram only when a human has to decide. Works with every major agent CLI. We run our own company on this.The agents that build 5dive.ai cut this repo's releases, and only ask a human when they're stuck. The badge up top is that claim, measured: releases shipped versus decisions escalated to a human. Same binary you're installing. MIT, no open-core. Run it yourself, or skip the ops with the managed VM . Run your whole company in plain language , from the AI agent you already have. Add the 5dive-cli skill for-your-ai-agent : create agents, assign work, read the org chart. One-line setup ↓ for-your-ai-agent 1. install curl -fsSL https://install.5dive.ai | sudo bash 2. create your first agent, the wizard wires Telegram too: paste a bot token BotFather gives you one , send the bot /start, and it pairs itself. No codes. sudo 5dive init Scripting it instead CI, provisioning ? The non-interactive path needs one extra step, the bot replies to your first DM with a pairing code: sudo 5dive agent create my-agent --type=claude --channels=telegram --telegram-token=<token sudo 5dive agent pair my-agent --code=<pairing-code Requirements: a Linux box with systemd and your own agent-CLI subscription or API key Claude Pro/Max, OpenAI, … , no account with us. “Fair question. The installer only apt-installs deps and drops the CLI + systemd units every file it fetches is listed at the top of curl | sudo bash , and agents with sudo ?” . Each agent is then its own Linux user, and you choose its blast radius, a install.sh sandboxed agent gets its own home, no sudo, and resource limits. Details: Security & isolation ↓ . They escalate, you decide. Agents work autonomously and only ping your phone, as tap-to-answer buttons, when a human has to make the call: spend, publishing, anything destructive. A company that runs itself. Named agents on one host, reporting up an org chart, handing each other work off a shared backlog. A subscription that's yours. Official CLIs on your own Pro/Max or keys. No middleman, no OAuth proxy. Runs as a service, not a session. Agents stay alive when you close the terminal. Message them from Telegram any time. Every major agent CLI. claude , codex , antigravity , grok , openclaw , hermes , opencode , pi , all under one team. Safe by default. Each agent is its own Linux user under one of three isolation tiers. MIT, no open-core split. Each agent is its own Linux user running an official agentic AI CLI session claude , codex , antigravity , grok , … as a systemd service. Multiple agents can share the same CLI binary and subscription. Agents reach each other by invoking the same 5dive CLI, that is the bus. Channels like Telegram attach per agent. No broker, no protocol, no framework. Shared filesystem, shared CLI. | Type | Model family | Auth | Channels | |---|---|---|---| claude | Anthropic Claude, or any Anthropic-compatible endpoint | OAuth / API key / --provider | Telegram, Discord | codex | OpenAI Codex | OAuth / API key | Telegram | antigravity | Google Antigravity | Google OAuth | Telegram | grok | xAI Grok | OAuth xAI / API key | Telegram | hermes | third-party multi-provider harness | API key | Telegram, Discord | openclaw | third-party multi-provider harness | API key | Telegram, Discord | opencode | OpenCode | API key | Telegram | pi | third-party multi-provider harness | API key / --provider | Telegram | About hermes / openclaw third-party multi-provider harnesses hermes / openclaw third-party multi-provider harnesses hermes and openclaw are community-built harnesses that can route to many providers OpenRouter, Anthropic, Google, Moonshot, DeepSeek, Z.ai, etc. . As of April 4, 2026, Anthropic no longer permits routing consumer Claude Pro/Max OAuth through third-party harnesses. For that work, use the official claude type with your own API key. Background: We Ditched OpenClaw for Claude → https://blog.5dive.ai/blog/we-ditched-openclaw-for-claude/?utm source=github&utm medium=owned&utm campaign=5dive-readme . The claude type can also run the official Claude Code harness against a third-party Anthropic-compatible endpoint, bring your own key: sudo 5dive agent create cheap-coder --type=claude --provider=deepseek --api-key=<key --auth-profile=deepseek providers: openrouter any model , deepseek DeepSeek , moonshot Kimi , zai GLM claude BYO requires --auth-profile=<name the account the key is saved under; reuse it to share the key across agents Pick the model too. --model overrides the primary tiers with any slug the provider serves OpenRouter translates every family ; the background model stays on the provider's cheap default. Omit it to use the per-provider default. sudo 5dive agent create glm-coder --type=claude --provider=openrouter --api-key=<key --auth-profile=openrouter --model=z-ai/glm-5.2 Switch the model on a running agent persists across restarts : sudo 5dive agent config glm-coder set model=z-ai/glm-5.2 In-session, Claude Code's built-in /model <slug also accepts any custom slug live session-scoped . If you already use Claude Code / Codex / Antigravity / Grok / opencode, paste this prompt. Your agent installs 5dive, learns the skill, then keeps managing agents through chat: Install 5dive on this Linux host so I can use you to manage 5dive agents. 1. Run the installer idempotent, safe to rerun : curl -fsSL https://install.5dive.ai | sudo bash 2. Confirm: 5dive --version prints a version string e.g. "5dive 0.5.x" . 3. Install the 5dive-cli skill. Replace <runtime with one of claude-code, codex, antigravity, grok, hermes-agent, openclaw, opencode: npx -y skills add https://github.com/5dive-ai/skills --skill 5dive-cli --agent <runtime --yes 4. Tell me to restart so the skill loads, then ask which agent to create first. Installing onto a remote VM over SSH? Same prompt, prefix the install line with ssh -t <user@host . Install the skill on the laptop where you're issuing ssh from, not the remote. Use ssh -t for anything needing a TTY e.g. 5dive agent auth login . Each agent is one Linux user under one of three isolation tiers: | Tier | Access | |---|---| standard default | shared read, limited write | admin | full host; auto-granted to the first agent on a fresh box | sandboxed | own home only, no sudo, systemd resource limits | sudo 5dive agent create my-agent --type=claude --isolation=sandboxed No middlemen. 5dive runs on your server. Auth tokens go to model providers directly, never to us. No telemetry, no error reporting, no usage data leaves the box. Long form: your auth tokens don't touch us → https://blog.5dive.ai/blog/your-auth-tokens-dont-touch-us/?utm source=github&utm medium=owned&utm campaign=5dive-readme . More team ops: accounts, a shared bot, commands, characters Don't assemble a team agent by agent. Import a whole org in one call: python sudo 5dive team import solo-founder spins up the agents, their roles, the org chart, and seeds their starting backlog Browse templates with 5dive team ls , or define your own in a 5dive.yaml and 5dive up . A template is a company you can fork: engineering pod, research desk, content engine, support crew. Clone it, point it at your keys and bots, done. Agents on a box share a task queue sqlite, no server . File work, assign it, and let the heartbeat wake the assignee only when there's something to do. Recurring templates materialize on a cron schedule: 5dive task add "triage overnight CI failures" --assignee=ops --recurring="0 7 " sudo 5dive heartbeat on ops --every=30m When an agent hits something only a human can decide, it parks the task on you: 5dive task need DIVE-42 --type=approval --ask="Ship pricing v2?" --options="ship|hold" --recommend=ship That arrives on your Telegram as tap-to-answer buttons. Tap one, and the owning agent is unblocked and resumes. 5dive task inbox lists everything waiting on a human, and 5dive org keeps a reporting chart so you can see who works for whom. One sign-in, many agents: sudo 5dive account add work sudo 5dive account login work --type=claude sudo 5dive agent create agent-a --type=claude --auth-profile=work sudo 5dive agent create agent-b --type=claude --auth-profile=work Rename or rotate the account, every bound agent rebinds automatically. 5dive account usage shows each account's rate-limit headroom. Per-agent bots are optional. Point one shared bot at a Telegram group topics enabled and every agent gets its own forum topic: sudo 5dive agent team-bot shared --group=<chat id --agents=coder,writer,pm --token=<bot-token New agents auto-attach with their own topic opt out per agent with --no-team-bot . team-bot discover finds the group id for you, and team-bot intercom mirrors inter-agent chatter into a dedicated topic so you can watch the team coordinate. A template gives you roles. A character pack gives you a personality, a ready-made persona with its own voice, model, effort, and bundled skills: sudo 5dive agent marketplace ls browse the character-pack registry sudo 5dive agent import olivia --as=ceo spin up a named agent from a pack --as is the agent's name on your box; the pack supplies the persona, model, and skills. Add --channels=telegram to wire a bot at import time. Packs live in the 5dive-ai/character-packs https://github.com/5dive-ai/character-packs registry, and a 5dive.yaml can reference one with pack: <slug . 5dive agent list / create / start / stop / restart / rm 5dive agent send <name <text 5dive agent ask <name <text --timeout=120 5dive agent logs <name --follow 5dive agent config <name set model=<id / effort=<low|medium|high|xhigh|max 5dive agent <name tui 5dive task add / ls / assign / start / done / need / inbox / answer 5dive heartbeat on / off / ls / tick wake agents that have queued work 5dive org set / tree who reports to whom 5dive account add / login / list / show / usage / rename / remove 5dive auth set / login / status lower-level; account is the human path 5dive skill add / list / remove 5dive doctor --repair --json 5dive watch htop-style live view 5dive up / down / ps / export declarative agents via 5dive.yaml 5dive team import <slug provision a whole team template in one call 5dive push <task --branch=<b delegated git push via your own GitHub App see below 5dive self-update update CLI + plugins, then restart agents Full flag reference: 5dive --help or 5dive <verb --help , or the searchable docs at 5dive.ai/docs/5dive-cli https://5dive.ai/docs/5dive-cli . Machine-readable output on any command via --json . Self-hosting, hardening & other install paths 5dive runs agents with shell access. Standard hygiene applies: - patch the OS unattended-upgrades - SSH key-only, no root login - firewall default-deny - per-agent isolation tiers - Telegram bot allowlists Baselines: devsec.os hardening https://github.com/dev-sec/ansible-collection-hardening · Lynis https://github.com/CISOfy/lynis · fail2ban https://www.fail2ban.org/ . Or skip the checklist; 5dive.ai https://5dive.ai?utm source=github&utm medium=owned&utm campaign=5dive-readme handles it. Agents can read and edit a repo, but shouldn't hold a Git credential they could exfiltrate. 5dive push gives a team ONE scoped push identity, your own GitHub App, that the control plane holds and lends for a single gated push, never handing the agent a token. sudo 5dive push setup scaffold + verify the credential 5dive push <task --branch=<feature-branch push, once the task's gate clears How it works, and why it's safe to give an agent: Your GitHub App, your key. You create a GitHub App in your org contents:write , install it on the repos you ship, and drop its key at /etc/5dive/connectors/github-app.{pem,env} root-600 . The code is generic, point it at any App. No per-agent seats, no long-lived PAT. Gate-gated. A push runs only after the task carries a ship gate cleared by a human or its designated routed reviewer. The root path verifies the signed closure; no gate, open/rejected gate, auto-clear, unrelated-agent answer, or tampered record → refused. One branch only. It pushes exactly the branch named in the task --branch or a Branch: <name line in the body ; protected branches main / master are refused. Author stays yours optional . Configure a committer GITHUB APP COMMIT AUTHOR and a fail-closed scan requires every pushed commit to match it, so provider team-checks e.g. Vercel stay green; leave it unset for no restriction. The App is transport auth only, decoupled from commit authorship. The agent never holds a token. Gate re-verify, author scan, a repo-scoped short-lived token mint, the push, and token discard all happen atomically in a root-only helper. The token is scoped to just the one target repo, so even a captured token can't reach the rest of your org. Every push is audit-logged. Full walkthrough create the App, install it, drop the credential, wire the grant, first push : docs/delegated-push.md . Docker. Kick the tires without a host install: docker build -f docker/Dockerfile -t 5dive . docker run -d --name 5dive-demo --privileged 5dive docker exec -it 5dive-demo bash Offline / air-gapped. install.sh reads from $REPO default GitHub raw . Override with REPO=file:///path/to/local/tree and pre-install apt deps. The fetched files are listed at the top of install.sh . Updating. 5dive doesn't auto-update, you stay in control of when code changes land: sudo 5dive self-update This refreshes the CLI, hooks, skills, and plugins, then restarts each running agent so the new versions load. Want it on a schedule? 0 4 /usr/local/bin/5dive self-update /dev/null 2 &1 Context rot. Long sessions degrade, the daily self-update above also restarts agents, giving each a fresh session. Claude-runtime agents keep project memory under ~/.claude/projects/<dir /memory/ across restarts. Session resets, knowledge stays. - Linux with systemd Ubuntu 22.04+ recommended - root for install installer apt-installs jq , tmux , and other deps No systemd / no root / not Linux? Use the Docker image above. Use GitHub's private reporting: Report a vulnerability → . Don't open a public issue. We acknowledge within 3 business days. Scope is the 5dive CLI, install.sh , shipped systemd units, and 5dive-ai/ workflows; upstream coding CLIs claude , codex , ... and apt/Node go to their respective maintainers. JSON / machine-readable output Every command accepts --json . Output is {ok:true,data:...} on success or {ok:false,error:{code,class,message}} on failure. Exit code matches error.code so shell pipelines branch without parsing. Progress lines stay on stderr; stdout is always valid JSON. { "ok": true, "data": {"name": "main", "type": "claude", "active": "active"} } { "ok": false, "error": { "code": 4, "class": "not found", "message": "no agent named 'foo'" } } Prefer a managed dashboard instead of ssh? The CLI is the OSS surface. Every verb here, every agent, every host, all driven from /usr/local/bin/5dive . If you'd rather click than ssh , 5dive.ai https://5dive.ai?utm source=github&utm medium=owned&utm campaign=5dive-readme is the managed version: same CLI under the hood, but the VM, hardening, updates, and dashboard are run for you. See CONTRIBUTING.md /5dive-ai/5dive/blob/main/CONTRIBUTING.md . The 5dive bundle at the repo root is built from src/ via ./build.sh ; CI enforces no drift. MIT. See LICENSE /5dive-ai/5dive/blob/main/LICENSE .