Open-source framework for building internal coding agents that accept tasks via Slack, Linear, or GitHub, execute code changes in isolated cloud sandboxes, and open draft pull requests automatically.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
63
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
No reviewed flag detected in metadata.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 24/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
No review metadata found; increase manual validation.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Missing required evidence: Metadata review. Risk score 31.
Source repository/provenance is listed.
Required in this preset
Review metadata is missing.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required gaps: Metadata review
Decision timeline
Blocking gaps: Check metadata review status. Risk 28.
triage
Source/provenance metadata is available.
triage
Review metadata is missing.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
Blockers: Check metadata review status
Prerequisite readiness
5 prerequisites to line up before setup. Have accounts and credentials ready first.
Safety & privacy surface
5 safety and 4 privacy notes across 5 risk areas. Review closely: credentials & tokens, permissions & scopes, third-party handling.
Disclosure: editorial
## Overview
Open SWE is a practical reference implementation for teams that want to run
coding agents against their own repositories without building the orchestration
layer from scratch. It mirrors patterns used by engineering teams at Stripe,
Ramp, and Coinbase for internal coding agents.
The framework composes on LangGraph and the Deep Agents harness. Each task
runs in a dedicated cloud sandbox (Modal, Daytona, Runloop, or LangSmith),
executes the agent loop with roughly fifteen curated tools, and opens a draft
PR on completion. Parallel tasks get separate sandboxes with no queuing.
## Features
- Multi-platform invocation through Slack mentions, Linear comments with
`@openswe`, and GitHub PR comment replies.
- Isolated, reusable cloud sandboxes per task thread with pluggable providers
(Modal, Daytona, Runloop, LangSmith).
- Automatic draft pull request creation and linking back to the source task.
- Subagent orchestration for parallel subtasks via the `task` tool.
- Configurable model support and a curated tool set covering shell execution,
file operations, web fetches, and API requests.
- A web dashboard for authentication, team settings, and direct agent chat.
## Use Cases
- Triage and resolve routine engineering tasks raised in Linear or Slack.
- Stand up an internal coding agent that respects organization conventions via
an `AGENTS.md` or `CLAUDE.md` context file.
- Run multiple coding tasks in parallel without manual environment setup.
- Prototype a customizable, self-hosted alternative to closed coding agents.
## Disclosure
Editorial listing. No paid placement or affiliate relationship.Open SWE is a practical reference implementation for teams that want to run coding agents against their own repositories without building the orchestration layer from scratch. It mirrors patterns used by engineering teams at Stripe, Ramp, and Coinbase for internal coding agents.
The framework composes on LangGraph and the Deep Agents harness. Each task runs in a dedicated cloud sandbox (Modal, Daytona, Runloop, or LangSmith), executes the agent loop with roughly fifteen curated tools, and opens a draft PR on completion. Parallel tasks get separate sandboxes with no queuing.
@openswe, and GitHub PR comment replies.task tool.AGENTS.md or CLAUDE.md context file.Editorial listing. No paid placement or affiliate relationship.
Show that Open SWE is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/tools/open-swe)Open SWE side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Submitter).
| Field | Open-source framework for building internal coding agents that accept tasks via Slack, Linear, or GitHub, execute code changes in isolated cloud sandboxes, and open draft pull requests automatically. Open dossier | Open-source infrastructure for securely running AI-generated code in isolated sandboxes that start in milliseconds, with SDKs for Python, TypeScript, and other languages, persistent snapshots, and an optional managed cloud. Open dossier | AI software engineering agent for planning, coding, debugging, and executing development tasks with autonomous workflows. Open dossier | AI-driven software development platform with a local GUI, CLI, Software Agent SDK, agent sandboxes, terminal/browser tools, and hosted cloud options. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| SubmitterDiffers | JPette1783 | JPette1783 | — | oktofeesh1 |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety · Privacy · | Safety ✓ Privacy ✓ |
| Brand | — | |||
| Category | tools | tools | tools | tools |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | LangChain | Daytona | Cognition | OpenHands |
| Added | 2026-06-05 | 2026-06-05 | 2026-04-27 | 2026-06-03 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓Each task runs in an isolated cloud Linux sandbox (Modal, Daytona, Runloop, or LangSmith) to prevent production impact. The agent executes shell commands, file operations, web fetches, and HTTP requests inside the sandbox without confirmation prompts — review sandbox provider permissions before deployment. GitHub operations are performed through a GH_TOKEN proxy; scope token permissions to the minimum required repositories. Subagent orchestration can spawn parallel child agents — set appropriate step limits and monitor LangSmith traces to prevent runaway execution. AGENTS.md or CLAUDE.md at the repository root is injected into the system prompt; review this file to control agent behavior and conventions. | ✓Daytona is purpose-built to execute arbitrary, AI-generated code; only run untrusted code inside its isolated sandboxes, never on the host. Each sandbox has its own kernel, filesystem, and network stack, but sandboxes can make outbound network requests unless network limits are configured. Sandboxes support computer use, Git operations, and command execution; scope what an agent can do and review declarative builder configurations before use. Self-hosting runs runner compute nodes and Docker services that need elevated host privileges; isolate the deployment from production systems. Persistent snapshots retain sandbox filesystem state across sessions, which can preserve secrets or sensitive files written during execution. | — missing | ✓OpenHands agents can edit files, run terminal commands, browse websites, start servers, and interact with repositories, so each workspace needs a clear permission boundary. The documentation recommends Docker sandboxing for local use; process-based execution is faster but has no container isolation and should be treated as unsafe for sensitive projects. Mounts into the sandbox can be modified by the agent when granted write access, so avoid broad host mounts and review exactly which project files are exposed. Confirmation mode and security analyzers can reduce risk by pausing high-risk actions, but they do not prove that an action is correct, reversible, policy-compliant, or safe to merge. Hosted, cloud, enterprise, and integration workflows add additional access-control, audit, retention, budget, and organization-policy requirements beyond the local open-source project. Benchmark performance, agent planning, context compression, and security analysis are useful signals, but human review is still required before generated changes affect protected branches or production systems. |
| Privacy notes | ✓Repository code, Linear issue history, and Slack thread history are sent to the configured model provider API. Sandbox providers (Modal, Daytona, Runloop, LangSmith) process task execution data according to their own privacy policies. LangSmith tracing, when enabled, logs full agent traces including tool inputs and outputs — configure retention and access controls in your LangSmith organization. GitHub OAuth tokens and model API keys should be stored as secrets and never committed to the repository. | ✓Using the managed cloud sends your code, files, and execution data to Daytona-operated infrastructure; review their terms before processing sensitive data. The platform emits OpenTelemetry metrics, log streaming, and audit logs that can capture command output and activity. API keys grant access to your sandboxes and organization; store them as secrets and never commit them to source control. Self-hosting keeps execution data on your own infrastructure but you become responsible for log retention, access control, and isolation. | — missing | ✓OpenHands may process prompts, issue text, source snippets, diffs, terminal output, browser context, logs, traces, uploaded files, repository metadata, and generated patches. Model providers, local model routes, OpenHands Cloud, enterprise deployments, or connected gateways may receive task context depending on the selected configuration. Local GUI, CLI, SDK, and sandbox workflows can save conversation history, workspace state, logs, screenshots, browser artifacts, and server output on the machine or managed workspace. Cloud and enterprise integrations with GitHub, GitLab, Bitbucket, Slack, Jira, and Linear should be reviewed for repository access, user identity, issue data, retention, and audit visibility. Operators should define retention and redaction rules before sharing OpenHands conversations, trajectories, screenshots, generated patches, or benchmark artifacts outside the project team. |
| Prerequisites |
|
| — none listed |
|
| Install | — | — | — | — |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Open-source sandbox infrastructure for executing AI-generated code in isolated environments, with SDKs, snapshots, and an optional managed cloud.
AI software engineering agent for development tasks.
Source-backed guides for putting this to work.
Set autoMode.hard_deny rules to block risky actions in auto mode.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.