Open Source Agent Tools: November 4, 2026

1. Agent Autoloop Runs Claude Code and Codex in the Background on Events and Only Interrupts for Decisions

Agent Autoloop, released as v1.0.0 on November 3 and starred about 1,150 times on GitHub in its first day, is a small self-hosted dispatcher that turns cron schedules, GitHub webhooks, HTTP calls and issue polling into events, routes each one by rules in rules.json to an agent (Claude Code, Codex, any ACP agent or any CLI that takes a prompt) in a chosen directory, and lets the agent exit after each round. When an agent needs a decision, such as deleting data, restarting a service, spending money or messaging outsiders, it ends its last reply with an agent-autoloop JSON block; the kernel pushes a card to a desktop notification, Feishu, DingTalk, WeCom, Slack or Discord, and resumes the same session once the user answers, so no process runs and no tokens are spent while it waits. The kernel is about 1,650 lines with no runtime dependencies and is event-sourced from an append-only log; external text such as issue bodies goes into files rather than the prompt, events that try to set cwd, agent or access are rejected, and a hop counter stops dispatching after 8 levels of agent-generated events. A delivery plugin takes PRs labelled deliver through review, CI, merge and a check of the deployed version. The maintainer reports an 88.78 ms cold start, 2,394 durable writes per second and 1.82 ms p99 dispatch on an Apple M5 Pro; it needs Node 24 on macOS or Linux, and CLI output and default notifications are currently in Chinese. License: MIT. Source Repository

Sandcastle, Matt Pocock’s TypeScript library for orchestrating sandboxed coding agents with sandcastle.run(), shipped v0.13.0 and v0.14.0 on November 2. Version 0.13 adds bwrap() for Linux and WSL2 (Bubblewrap with read-only system directories, a private home and /tmp, and its own PID namespace) and seatbelt() for macOS 14 and later (a deny-by-default sandbox-exec profile), both needing no container or image, and makes them the documented default in sandcastle init. It also adds session resume for the Copilot, Cursor and OpenCode agents (OpenCode can fork too) and fixes two sandbox escapes: a bind-mounted agent could make host-side git run code through files in .git, which is now mounted read-only with host git ignoring repository hooks and program-running config, and an isolated sandbox could make sync-out write outside the worktree, which now fails with SyncOutPathError. Runs now fail when an agent reports an error in its stream despite exiting 0. Version 0.14 adds isolated providers for E2B, Modal and Fly.io Sprites alongside the existing Docker, Podman, Vercel and Daytona ones. License: MIT. Source v0.14.0

3. Elpis 0.5 Adds a Desktop App Where a Planning Agent Designs Teams of Agents Under Rust-Style Ownership Rules

Elpis, an independent Linux coding-agent harness built on OpenAI’s Codex CLI, released v0.5.0 with its first desktop app on November 3 (followed by v0.5.1 the same day) and was posted to Show HN. In Workflows, a “Mother” agent either does a job itself or designs a team on an editable board, with Sequential, Parallel, Kahn graph wave, Recursive (with a round limit) and Voting patterns and a per-agent model choice. Write access follows Rust’s ownership idea: each agent owns its own folder and Git worktree, every writer must be followed by a check agent that can only read its work, two agents linked to work side by side cannot share a folder, and the Mother agent must pass the combined commit with evidence before Elpis fast-forwards the project. A Context Ledger lists every instruction file, chosen file and memory with its token cost so each can be included or excluded. Models come from a ChatGPT or Claude subscription (Claude runs through the user’s Claude Code install) or an API key, and a Voting team finished on GPT-6 Luna and Claude Haiku 5.5 in 74 to 100 seconds in the project’s live test. It ships only for Linux x86_64, Smart Prune is experimental, and the author says 0.5.0 is his last release. License: Apache-2.0. Source Show HN

4. CoworkOS Is an Academic Harness for Long-Running Work That People and Agents Edit Together, Including CAD and Blender

CoworkOS, published by Renmin University of China’s NLPIR lab with v0.1.3 on November 3 and an accompanying arXiv paper (2611.03178), is a CLI and Apple Silicon desktop app for multi-day, human-in-the-loop projects in code, research, documents, presentations, CAD, Blender and scientific workflows. Its runtime has three layers: a Main Agent that plans, delegates and evaluates, a Coordinator Runtime that dispatches subtasks and tracks their lifecycles, and optional Subagents for scoped assignments; long-running Jobs keep status and logs so work resumes after waits or interruptions, and agents propose revision-aware candidate changes that people review before integration, backed by hierarchical workspaces and semantic memory. In the paper’s study, five rounds of agent-driven post-training raised Qwen3.6-35B-A3B’s average score from 33.19 to 42.95 across eight benchmarks. It installs with npm install -g coworkos-app (Node 22.19 or later) and needs a user-supplied model service and API key; the Mac app is ad-hoc signed and not notarized, and the release notes report 3,019 passing, 71 skipped and 4 failing regression tests. License: MIT. Source Release

5. mcp-toolsearch-proxy Puts Five Search and Call Tools in Front of Catalogs of Hundreds of MCP Tools

mcp-toolsearch-proxy, released as v0.9.0 (which adds stdio transport) and posted to Show HN on November 3, is a Go MCP server that sits in front of a large upstream such as an MCP gateway and exposes only search_tools, describe_tool, call_read_tool, call_read_tools and call_write_tool, which together cost 1,735 tokens of definitions. Search combines BM25 with the multilingual potion-multilingual-128M embedding model running in pure Go without a GPU (recall at 5 of 81% in English and 79% in Lithuanian, versus 52% and 0% for lexical search alone), calls with arguments that do not match the tool’s schema are refused before they reach the upstream, and a tool counts as read-only only when the upstream marks it with readOnlyHint, so clients can auto-approve reads while each write keeps its own prompt. The proxy holds no credentials: it forwards each caller’s Authorization header and keeps a per-caller catalog for ten minutes. On the project’s 500-tool benchmark, requests carry 97% fewer tool-definition tokens and a task costs about half as much, with the right tool reached 90% of the time versus 95% with every tool loaded and 87% with Anthropic’s tool search; the authors note that clients which already defer tools, such as Claude Code, gain less. It is in early development. License: MIT. Source Show HN

6. MiniMax Publishes the BYOB Table Protocol, a Shared Ledger Where Agents Owned by Different People Debate and Act

MiniMax’s MiniMax Code team published mcode-agent-table on November 3, the Bring Your Own Bot (BYOB) Table Protocol v0.1 with a TypeScript reference implementation, for multi-agent work in which each bot stays on its owner’s machine with its own model, memory and permissions. A table host keeps an append-only JSONL ledger that only Table Core writes, seats are joined with Ed25519 signatures from the owner, and tables run as broadcast, debate, pipeline, hub-and-spoke, delegation or sub-table topologies with floor control, per-post budgets and a mandatory end condition (a table without one is refused). Cross-owner actions follow one rule: bots propose, the affected owner approves, that owner’s own bot executes, and a different seat verifies before a task counts as done; each seat reads a stable hashed prefix plus an append-only tail so prompt caches keep hitting. Bots connect through an MCode adapter, a client library, the byob CLI or a 12-tool stdio MCP server for Claude Code, Codex or Cursor, whose byob_approve asks the owner through MCP elicitation. It needs Node 22.19 or later, and the three-agent MCode demo needs a MiniMax API key. License: MIT. Source

7. Privato Gives Personal Agents Minutes-Long, Filtered Passes to Gmail, Calendar, Drive and Slack Instead of Logins

Privato (formerly Nonce) by Roe AI, released as v0.2.0 and posted to Show HN on November 3, sits between MCP apps such as ChatGPT, Claude and Cursor and a user’s Gmail, Google Calendar, Google Drive and Slack, holding the logins itself and handing apps only grants: a filter, a time limit and a call cap for one question, such as United emails about Tokyo for 10 minutes. Each request, each search inside a grant and each item read is scored by a pluggable detector (OpenAI’s Decisions API with the user’s key, an HTTP service, a Python class, or none, in which case every request goes to the user) and fixed policy rules then allow it, send it to the user’s phone, or block it; money, health and login-code requests ask first, whole-inbox syncs are refused, access ends when an app’s searches drift from the question, and emails that try to instruct the AI are withheld. Users can put their own MCP servers or HTTP APIs behind the same approvals, with per-tool Auto, Ask me or Off rules. A hosted version runs at privato.dev, and self-hosting needs Python 3.12 with uv and Node 20. License: AGPL-3.0. Source Show HN

8. Shim Is a 7 MB Go Agent Harness That a Local Mini-Model Configures From Plain-Language Requests

Shim, released as v0.1.0 on November 2, is a single static Go binary for Windows, macOS and Linux (7.29 MiB, with a 9.96 ms median startup on the maintainer’s machine) that runs a terminal coding agent against OpenAI-compatible, Anthropic, Gemini, GitHub Models, Hugging Face, OpenRouter or local Ollama, LM Studio and llama.cpp endpoints, with MCP over stdio and Streamable HTTP and lazy loading of SKILL.md files from .shim/skills, .agents/skills and .claude/skills. Management requests such as “show my tools” are turned into allowlisted commands by fixed English and Russian phrases or by a local router model set with shim router use ollama/qwen3:4b, and commands that change anything require confirmation. The default ask mode allows workspace reads but asks before writes, shell commands and MCP calls; the project states plainly that it is not an OS sandbox. Config is plain JSON, sessions are append-only JSONL, API keys stay in environment variables, and there is no TUI, daemon or telemetry. License: MIT. Source