Open Source Agent Tools: October 29, 2026

1. Silo Runs Untrusted Agents in Hardened Docker Sandboxes With Policy-Governed Egress

Silo. Silo, published and posted to Show HN on October 28, is a self-hosted CLI for running AI agents that are not trusted with the host. Each agent runs in a capability-restricted Docker container with resource limits, while a host-side proxy intercepts and logs LLM and outbound HTTP requests, injects credentials so the agent never holds them, and checks egress against declarative YAML policies. All proxy and tool-call events are written to JSONL audit logs, stored keys are encrypted at rest with machine-bound AES-256-GCM, and the project lists support for OpenClaw browser automation, framework trace collection and multi-agent orchestration. It installs with npm install -g cli-silo and needs Node.js 18+ and Docker. License: MIT. Source

2. Parley Puts Several Coding-Agent Sessions and Their User on One IRC Channel

Parley. Parley connects long-running Claude Code, Codex and OpenCode sessions on a single IRC channel hosted by a local ergo server, so sessions tell each other when something changes instead of the user relaying handoffs. Messages reach each harness through its own push path (a Claude Code channel, codex queue, or the OpenCode server’s HTTP API), every peer message is stamped as peer input so only the user’s registered nick carries authority, and a breaker stops waking sessions after a burst of posts without the user. It supports three modes: a “line” of sessions on separate jobs, a “table” of agents from different model families discussing one question, and a “build” where two sessions split work across worktrees. It is a single Go binary using only the standard library; v0.4.2 shipped October 27 and was posted to Show HN on October 28. License: Apache-2.0. Source

3. taw Shows Which tmux Pane’s Coding Agent Is Blocked, Working or Done

tmux-agent-wizard (taw). taw is a tmux plugin that uses herdr’s detection engine to read the state of 22 coding agents (including Claude Code, Codex and OpenCode) across tmux sessions. prefix + A opens a tree of every session and agent marked blocked, working, done or idle, Tab jumps to the one waiting on the user, and a toast plus prefix + O handle notifications outside the popup. It also folds in session picking and tmux-resurrect-style save and restore, bringing agents back into their previous conversations after a reboot once each agent’s hook is installed. It runs one roughly 9 MB watcher per pane with no daemon or account, needs tmux 3.2+ on macOS or Linux, and v0.1.0 shipped October 28 with v0.1.1 following on October 29. License: MIT. Source

4. Weir Plants Fake Keys to Catch Agents Leaking Credentials Into Traces and Context

Weir. Weir, posted to Show HN on October 28 following its v0.8.0 release on October 26, tests whether agents leak API keys. For agents a team builds, weir-run plants unique fake keys wherever real ones would live, runs the agent’s own flows against a local fake model, and weir canary judge reports a leak, clean or incomplete verdict for each destination (spans, logs, console output, the model, other services); a GitHub Action posts the verdict on pull requests. For Claude Code users, a status line counts how many real credentials entered the session or left in a tool call, and an optional hook redacts known keys from Read, Bash, Grep, Glob and WebFetch results before the model sees them. The author credits Weir with finding CVE-2026-116691, the MLflow CrewAI autologging key leak. Install with pip install weir-scan. License: Apache-2.0. Source

5. ReplySlip Is an MCP Task Inbox Where Agents Only Receive Schema-Valid Answers

ReplySlip. ReplySlip lets one agent send another a task over MCP with a JSON Schema for the answer; replies that do not match are rejected with the validation errors, and the sender is only woken once a valid result arrives. Receiving agents do not need a live session: they are woken by a webhook, by a local watcher that nudges their terminal, or by polling. Tasks go to exactly one named agent, which answers with complete_task, ask or fail_task, and agents can be shared with other workspaces under addresses like @handle/agent with instant revocation. It works with Claude Code, Codex, Cursor and other MCP clients and was posted to Show HN on October 28. License: AGPL-3.0; a free hosted plan covers 10 agents and 1,000 tasks a month. Source

6. Nuvrail Stages Every Email Write an Agent Makes Until a Human Approves It

Nuvrail. Nuvrail is a self-hosted IMAP/SMTP proxy that sits between an AI agent and a real mail server such as Gmail, iCloud or Outlook. Reads pass straight through, but every move, delete, flag change and outbound send is acknowledged to the agent and staged until the user approves it from a phone or browser push notification; rejected actions are reverted locally and surfaced on the agent’s next command, and EXPUNGE is never forwarded, so the agent cannot permanently delete mail. It deploys with Docker Compose and needs no agent-side changes since the agent sees an ordinary mail server. v0.1.4 shipped October 26 and it was posted to Show HN on October 28. License: AGPL-3.0. Source