How It Works
AgentVisor™ provides containment and observability for agent execution, with continuous authorization at the execution boundary. It combines sandbox isolation, credential brokering, policy-based governance, durable execution, and comprehensive observability into a layered architecture where every agent action is isolated, tracked, and auditable.
Overview
The workflow is straightforward:
AgentVisor wraps your agent in a secure, observable runtime where every operation is contained and auditable—without requiring changes to your agent code.
Every request in to your agent, as well as any request your agent makes going out, flows through AgentVisor's permission and audit layer. The agent runs in a security sandbox completely isolated from the host — no network, no filesystem, no process visibility. All external communication is proxied and policy-checked.
Key Features
| Feature | Description |
|---|---|
| Sandbox Isolation | Complete host isolation; gVisor adds syscall-level interception for maximum security on Linux |
| HTTP Proxy | Transparent proxying works with any HTTP library—no code changes |
| PolicyEngine Integration | Rego-based policies govern every request, evaluated inline at the boundary |
| Temporal Workflows | Durable execution with automatic checkpointing and horizontal scaling |
| Threads & Runs API | OpenAPI/REST (LangGraph Agent Protocol) |
| Human-in-the-Loop | Built-in support for interrupt() and resume |
| SSE (Server-Sent Events) Streaming | Real-time streaming for LLM token responses |
| Multi-Sandbox Modes | none (in-process, no isolation), Docker, or gVisor |
| Credential Brokering | Real API keys never enter the sandbox |
| Store API | Key-value storage with namespace isolation and search |
| OpenTelemetry + Prometheus | Distributed tracing, metrics, and structured logging |
| Payload Encryption | AES-256-GCM encryption for workflow data at rest |
| Multi-Protocol Transports | REST, MCP (/mcp), and A2A (/a2a) inbound; MCP Gateway, A2A Gateway, HTTP Proxy outbound |
| Exec Mode | Run interactive AI tools (Claude Code, Cursor, Aider) inside policy-enforced sandboxes |
Core Components
Durable Execution
Conversational threads are managed by a Temporal workflow, giving your agents automatic durability. You can scale and restart AgentVisor nodes at will—they automatically maintain state reliably. Run Temporal yourself or leverage Temporal Cloud. Horizontally scale your agents to handle as much traffic as you require.
Sandbox Isolation
Each agent runs in an environment fully isolated from the host—no network, no filesystem access, no visibility into other processes—with resource limits enforced. Every operation to and from the agent flows through AgentVisor's permission and audit layer. In gVisor mode, gVisor provides a userspace kernel that intercepts and validates every system call before it reaches the host kernel, providing the strongest available isolation. Docker mode provides equivalent container-level isolation using seccomp and nftables-based network restriction. This isolation is complete but transparent: your agent code runs unchanged in either mode.
Policy-Based Access Control
Manetu PolicyEngine evaluates every operation against Rego policies. Policies are contextual—considering who is making the request, what they're accessing, time-of-day restrictions, rate limits, and more. When multiple actors are involved (user, agent, MCP server), MPE recognizes each through scope conjunction, allowing fine-grained control at every layer of the delegation chain.
See Policy Engine for detailed policy configuration.
Credential Brokering
Agents need API keys to call LLM providers and external APIs, but passing real keys into sandboxed environments creates risk. AgentVisor solves this with credential brokering: real API keys are replaced with symbolic tokens (mav-tok-...) that are injected into the sandbox as environment variables. The guest proxy terminates TLS using an ephemeral CA, making request headers visible. The host then substitutes symbolic tokens with real credentials before making the upstream request.
This means agents use standard HTTP libraries with no code changes, while real credentials never enter the sandbox. See Credential Brokering for details.
Observability
AgentVisor provides comprehensive observability at multiple layers:
- OpenTelemetry distributed tracing — Full call stack from inbound request through sandbox execution to upstream API
- Prometheus metrics — Runtime performance, sandbox lifecycle, policy decision counters
- Structured logging — JSON logs from agent process, guest runtime, and host runtime with correlated context
- Runtime tracing — Syscall-level visibility via gVisor's seccheck facility
Multi-Protocol Compatibility
AgentVisor speaks the protocols your clients already use. Inbound, it exposes an OpenAPI/REST transport implementing the LangGraph Agent Protocol (threads, runs, state management, streaming), plus MCP (/mcp) for tool-server-style integrations and A2A (/a2a) for agent-to-agent. Outbound, agents reach external services through an MCP Gateway, A2A Gateway, and HTTP Proxy — each with the same policy and audit layer applied. Existing applications work without code changes regardless of which surface they speak to; AgentVisor adds security and durability around them.
See Supported Frameworks for current framework support and roadmap.