Open infrastructure for dependable AI agents

Build the boundary.
Measure the result.

Hullwork gives AI agents a secure place to execute and an evidence-backed path to ship. Self-hosted, Kubernetes-native, and designed to fail closed.

Explore the systems ↓ Read the source ↗

Self-hostedKubernetes nativeMCP readyMIT licensed

hullwork / control path● LIVE

AGENT WORKLOADRun → Ship → Verify

01IntentHTTP · CLI · MCP

02SandboxgVisor runtime

03SiteKubernetes delivery

04EvidenceHTTP 200 · SHA-256

boundary enforced deployment measured

RUNTIMEgVisorisolated

✓

Proof recordedstatus + body digest

01Execution boundaryOne gVisor Pod per runtime

02Credential boundaryTenant identity from the key

03Delivery evidenceReal HTTP status + body digest

04Operator ownershipYour cluster, state, and credentials

One dependable path

From agent intent
to observable evidence.

Models propose. Hullwork makes the surrounding system explicit: who is asking, where code runs, what gets deployed, and how success is proven.

Agent intent

A narrow request enters through HTTP, CLI, SDK, or MCP.

authenticated request

Secure runtime

Untrusted work executes inside a tenant-scoped gVisor Pod.

fail closed

Verified delivery

The workload converges through Kubernetes and becomes reachable.

desired → observed

Evidence

The live address is fetched and bounded proof is recorded.

status + sha256

Public systems

Two hard problems.
Two focused products.

01 Secure execution plane

Sandbox

Run an agent's shell and file operations inside its own Kubernetes gVisor Pod. Durable workspaces outlive disposable runtimes. Missing dependencies never become permission to execute on the host.

gVisor RuntimeClass
Tenant-scoped credentials
Durable workspaces
Python SDK · CLI · MCP

Open Sandbox site ↗Source on GitHub ↗

sandbox — quickstart

$ make quickstart

[1/5] checking host prerequisites
✓ kubeadm cluster ready
✓ gVisor kernel verified
✓ workspace survived restart
✓ host fallback blocked

sandbox-ready

runtime / gvisor● HEALTHY

02 Verified delivery plane

Site

Turn an agent request into a real Kubernetes deployment. Site handles admission, builds, workloads, ingress, observability, and scale-to-zero—then proves the address serves traffic.

HTTP verification
Status + SHA-256 evidence
Multi-tenant admission
HTTP · CLI · MCP · Console

Open Site website ↗Source on GitHub ↗

site / run details● LIVE

APPLICATIONhello-site

RUNNING

REVISIONrev-18a42c

REPLICAS1 / 1

ROUTEREADY

✓

TRAFFIC VERIFIEDHTTP 2005e7f06f9…12178242

desired stateworkload readyresponse measured

Engineering posture

Trust is an output.
Not an input.

Boundaries over promises

Identity, runtime, resource, and network boundaries are concrete architecture—not prose around a model call.

tenant ≠ request field

Evidence over labels

A green API response proves admission. Hullwork follows the system until the running result can be measured.

deployed → fetch → record

Fail closed

If isolation, control, or runtime dependencies disappear, the operation stops. There is no convenient local escape hatch.

fallback_to_host = false

Operator owned

Workspaces, credentials, control-plane state, and the Kubernetes substrate stay in the environment you operate.

your infra · your data

Start from source

Pick the boundary
you need first.

Both systems are independent, MIT-licensed, and include an end-to-end quickstart that is designed to finish with evidence.

Sandboxsecure execution

git clone https://github.com/hullwork/sandbox.git
cd sandbox
make quickstart

Siteverified delivery

git clone https://github.com/hullwork/site.git
cd site
make quickstart

Hullwork on GitHub