Start with the open-source Codex image, then add Claude Code, Gemini, Copilot, OpenCode, Pi, Cline, Continue, Grok Build, LLM, DeepAgents, Browser Use, OpenHands, and Bash through local installs or plugins. Submit a prompt from the web dashboard, watch the agent work in a live terminal, review the diff, approve the commit. A kernel-level firewall forces traffic through the configured proxy mode, and requests are logged.
Most teams either trust their agents blindly or don't use them at all. Starbase is the other path: let agents work freely inside a sandbox that enforces isolation, logs everything, and keeps the final decision with you.
Submit a prompt, pick an agent and a working directory, stream the live terminal, review the git diff, approve or reject the commit — from desktop or your phone. No SSH, no juggling terminals.
iptables blocks all direct egress at the kernel; every packet is forced through a Squid proxy that enforces the selected allowlist mode and logs requests. Non-root containers, setuid binaries stripped, and configurable CPU/RAM/PID caps defaulting to 1 CPU, 8 GB RAM, and 3072 PIDs.
Cron recurring jobs, one-time scheduled runs, batch-submit queues, and dependency graphs on the built-in task board let agents keep moving while you are away.
One agent orchestrates many. A manager job spins up sub-agents, delegates tasks, collects results, and synthesizes a final diff — all inside the same isolated stack. Included in the free tier.
When a job hits rate limits or stalls, Teleport packages the git state, transcript digest, and task context into a bootstrap prompt and hands it to a fresh agent — even a different kind of agent. Nothing is lost, nothing re-briefed by hand.
Usage dashboards track Claude windows plus persisted per-agent token and cost estimates. Budget caps, exports, per-user breakdowns, and anomaly alerts are available as gated cost controls.
The agent runs as a non-root user with setuid binaries stripped and resource caps enforced. Direct egress is blocked at the kernel. All traffic is forced through Squid.
You set the mode. The agent cannot override it.
Live terminals, job queue, diff review, cost tracker, task board. Mobile-friendly.
Non-root · setuid stripped · iptables egress blocked · 1 CPU / 8 GB / 3072 PID defaults.
Domain whitelist enforced, every request logged, mode hot-swappable from the dashboard.
Only what you allow, logged to the byte. EGRESS DENIED is a feature, not an error.
The core platform is Apache 2.0 and self-hostable. Pro and Team gate selected hosting, cost, collaboration, and support features on the same codebase.
It's a self-hosted platform that runs AI coding agents inside Docker containers with real network isolation. The open-source image starts with Codex; optional local installs and plugins add Claude Code, Gemini, Copilot, OpenCode, Pi, Cline, Continue, Grok Build, LLM, DeepAgents, Browser Use, OpenHands, and Bash. You submit a prompt via the web UI, an agent works your codebase, and you review the git diff before anything merges.
Each agent container has iptables rules that block all direct outbound traffic at the kernel. The only allowed path is through a Squid proxy that enforces the configured allowlist and logs requests. Strict and Default modes keep egress limited to configured provider and tool domains; Open mode is an explicit elevated capability for unrestricted debugging. Copilot/GitHub and full-internet access are handled as per-job capabilities.
Yes. Run make start-open-source and open https://localhost:6886. First run generates random passwords — there are no default credentials. The full stack (agent, proxy, web-ui, postgres) runs in Docker Compose.
The codebase is prepared for Apache 2.0 publication. The AgentStarbase name and logo are covered by a separate trademark policy so forks cannot impersonate the project. The public GitHub launch is tracked separately from the local release checklist.
Self-hosted deployments run on your infrastructure. Code, prompts, proxy logs, job logs, and database state stay in the stack you operate.
A flag you set per-job that gives the agent access to bin/sandbox — a CLI for starting, monitoring, and killing other agent jobs inside the same stack. The manager agent delegates sub-tasks to specialized sub-agents, waits for results, and synthesizes a final output. Useful for large refactors, multi-file migrations, and parallel test runs. It's included in the free tier.
Clone it, run make start-open-source, and submit your first prompt — safely.