Most agent tooling is designed for a laptop. The moment an agent is expected to run unattended, touch production data, or act on behalf of a whole team, the requirements change: you need to know where it runs, what it is allowed to do, who approved it, and what happens when it fails. Self-hosting is usually framed as a privacy preference, but in practice it is an operational decision about the trust boundary. The projects below are recent attempts to make that boundary explicit.
Platforms you operate yourself
OtoDock is a self-hosted platform for a company's AI agents. Your team builds agents on Claude Code, Codex or local models, and those agents then work in chats, on schedules, over the phone and on your own machines. It deploys with Docker, speaks MCP, and is released under a fair-source licence. The interesting part is the surface area: agents are reachable from more than one channel rather than only from a terminal you have to keep open.
For teams that want review rather than a platform, Proval is a self-hosted LLM code review agent for GitLab, Forgejo and GitHub. You connect it to your Git host and bring your own model through any OpenAI-compatible Chat Completions API, including local Ollama or llama.cpp. It reads the diff, groups changed files into review units and runs specialist sub-agents over each one. Because it runs inside your own network, the diff never has to leave it.
Guardrails and permission kernels
The strongest version of the self-hosting argument is not privacy but control. Talos is a self-hosted open-source AI agent for the terminal and Telegram that runs with Ollama or Claude behind a deterministic permission kernel, with scoped approvals and an audit trail of each deed. The framing on the project site is blunt: the model proposes, it never decides.
Aura applies the same instinct to infrastructure. It is a production-tested SRE agent platform in Rust that supplies the guardrails, APIs, state management, streaming and failure handling needed to put AI to work safely on production systems, with integrations for Mezmo traces and logs, Prometheus metrics and Kubernetes deployment history, plus MCP and OpenTelemetry support. A published demo walks through an agent correlating traces, latency and deployment history to identify a regression and recommend a rollback, which is a more honest description of the job than "autonomous SRE".
Keeping sessions and data alive
Two smaller tools handle the unglamorous parts. Hydra is an open-source agentic terminal for macOS and Linux that finds the coding-agent sessions already on your machine, including ones started outside Hydra, and keeps them alive after you close the app through a local PTY daemon, with optional browser access and no inbound port. RDST is an always-on agent that watches a PostgreSQL or MySQL database for slow queries, connects read-only, and keeps a ranked plan of the regressions it finds, with desktop builds for macOS, Windows and Linux. Read-only access is the point: a watchdog that can write to your database is not a watchdog.
Environments built for agents
Agents that drive real desktop applications need more than a virtual machine. Isle provides managed application environments for computer-use agents: the application is installed, configured and open before your agent starts, health checks confirm the intended app is ready, and guardrails, artifact checkpoints and automatic recovery wrap the run. It is framework agnostic, so you bring your own computer-use model.
For testing agents before they ever meet production, Era generates complete simulated companies. Each is built as one coherent business, from cloud databases and object storage to Salesforce, Slack, SharePoint, Jira and Google Drive, with the same customers, deals and employees across every system, exposed through MCP servers and APIs compatible with the real vendors. The project is explicit that every environment is synthetic and therefore no substitute for a staging system carrying real data, which is the right caveat.
Shipping what the agent built
The mirror image of self-hosting is the moment an agent-built app has to leave the laptop. Shpyrd takes an app that AI got working and puts it online behind a sign-in, supplying the database and backups alongside it. Your coding agent can deploy, read logs, pull metrics and roll back with the same CLI commands you would type, and a one-click security door puts authentication in front of an app that has no sign-in code of its own.
On the test side, E2E is an open-source end-to-end testing framework for web and mobile apps from TesterArmy, positioned as a next-generation AI testing framework, installable from npm and Apache-2.0 licensed. It is younger than the established alternatives, so expect the API to move, but it covers both web and mobile from one package.
Model supply without a single owner
Finally, self-hosting depends on being able to get the model. Pirate Face is a censorship-resistant, checksum-verified mirror that turns open models, including LLMs, image and audio models and datasets, into magnet links, so there is no single owner or point of failure that can take a model down. Availability depends on peers seeding each torrent, but as a preservation layer for open weights it addresses a real dependency risk.
How to choose
Pick by failure mode. If the risk is data leaving your network, Proval and OtoDock are the direct answers. If the risk is an agent acting without approval, Talos and Aura are built around that constraint. If the risk is that you have nowhere safe to test, Era and Isle are the environments, and if the risk is that your agent-built app cannot leave your laptop, Shpyrd is the deploy path.
