Safe by default
The agent runs only inside a container. It sees only the folders you mount, and your data can be mounted read-only. Cut its network down to an allowlist when you need to.
Safe by default
The agent runs only inside a container. It sees only the folders you mount, and your data can be mounted read-only. Cut its network down to an allowlist when you need to.
Your agent, your login
Claude Code, Codex, DeepSeek Harness or OpenCode, signed in with your own subscription or an API key.
Where your data is
Docker or Podman on a workstation, Apptainer on an HPC cluster as a Slurm job. Same commands everywhere.
Reports, not just chats
The agent writes its findings as interactive HTML reports you can comment on, and keeps your project’s environment for next time.