A coding agent that jails model commands and uses editable state machines for long-running tasks.
The model can write code and ask to run commands, but those commands go through a jail with restricted filesystem and network access. Long-running workflows can be written, reviewed, edited, resumed, and replayed as declarative state machines instead of being left to an open-ended agent loop.
Full documentation: agent6.dev
| the TUIthe full agent, as a live dashboard |
the full agent, in any terminalthe CLI the full agent, in any terminal
the full agent, desktop or phonethe web UI the full agent, desktop or phone
Jailed commands: Landlock + seccomp, and understrict
(what the defaultauto
picks when the host allows it) user namespaces,pivot_root
, read-only.git
, no route off the box (Security)Providers: Anthropic and any OpenAI-compatible endpoint (OpenAI, OpenRouter, Ollama, vLLM, llama.cpp, LM Studio); model + thinking level per role (Config)Clean checkout: per-step commits on a detached ref,sessions merge
to land them, snapshot resume, fork at any turnVerify gate: inferred when unset, pinned for the run, green/red on every surface; a worker can propose a replacement gate instead of revertingBudget: hardmax_usd
cap, token cap for calls the provider does not priceSessions: run, plan, ask (plan and ask never edit);--from <id>
seeds from another, cross-session reads,/btw
asks beside a live runFour front-ends, one engine: CLI, TUI,browser(stdlib server, no JS deps, phone), andeditor over ACP;attach
,exec
,forward
,history
Background commands:background: true
hands back a handle,read_background
polls,/shells
lists them; none outlive the runContext control: compaction visible on every surface,/compact [focus]
,/pin
, repo memory injected per runState machines: LLM-drafted, operator-reviewed, journaled, replayable; they for input, take events, steer from any front-end (State machines)Task graph: the worker keeps its plan in a persistent DAG (dependencies, acceptance criteria, statuses) journaled with the run; it survives crash and compaction restarts, shows live on every surface, anddecompose = "auto"
front-loads it for models measured to need itCode review:agent6 review
on any diff, plus an in-loop panel of adversarial reviewers where only blocking-category findings gateParallel fan-out:--parallel N|model-a,model-b
clone-based lanes, auto-compared into a ranked report;sessions compare
for past runs,/parallel
mid-run (Architecture)Skills: SKILL.md packs (the format Claude Code and most agents share) index into the prompt, load on demand, fire as/name
or--skill
; repo instructions fromAGENTS.md
Fixed tool surface: extended only by operator-configured MCP servers, off by default, jailed by default** Eight runtime dependencies**, no telemetry, no auto-update
uv tool install agent6 # or: pipx install agent6
If agent6
is not found, you can add the uv or pipx bin dir (~/.local/bin
) to your PATH with uv tool update-shell
or pipx ensurepath
.
Enable shell completion with agent6 completions
(supports bash, zsh, fish, and xonsh).
agent6 requires Python 3.12+ and the sandbox only supports Linux (x86_64/aarch64). Other platforms run without the sandbox behind a warning. See installation for the full requirements and building from source.
agent6 connect # interactive: pick provider, paste API key
agent6 model worker anthropic claude-sonnet-5
cd your-repo
agent6 run "add a --json output mode to the CLI"
agent6 plan "how to add a --json output mode to the CLI"
agent6 ask "how to add a --json output mode to the CLI"
agent6 attach <session-id> # follow + answer a run live (--raw for events)
agent6 tui # full-screen dashboard hub
agent6 web # browser UI on http://127.0.0.1:7658
agent6 acp # speak ACP on stdio; an editor spawns this
agent6 config show
agent6 check
agent6 resume <session-id>
agent6 fork <session-id> --at-turn 7
See usage for the full command tour, the web UI for driving runs from a phone, configuration for every field, and the security model for what the sandbox enforces.
Config is layered, lowest precedence first: built-in defaults, the global ~/.config/agent6/config.toml
, the per-repo config (in the state dir, out of the workspace, per-machine, never committed), then --config FILE
.
agent6 config show
prints every effective value with the layer that set it.
Every field has a default, and security-sensitive fields default to the safe value: isolation = "auto"
, network = "auto"
, run_commands = "ask"
, protect_git = true
.
Under "auto"
the sandbox picks the most secure option available on the host and warns if it cannot enforce the full policy; an explicitly set value it cannot enforce refuses to run.
protect_git = true
re-binds .git
read-only, which needs strict
; on hardened
the default warns and an explicitly set true
refuses to run.
agent6 itself does not push, rewrite history, or reset --hard
, and no config key can enable them.