# NVIDIA OpenShell

> NVIDIA OpenShell is an Apache-2.0, Rust-based agent runtime that enforces default-deny network egress in every sandbox: outbound connections are blocked at a proxy unless explicitly allowlisted in a declarative YAML policy, and blocked attempts are logged with destination, binary and reason.

Policy-governed agent runtime that blocks all outbound network traffic by default.

- **Category:** Execution Sandbox
- **License:** Apache-2.0
- **Language:** Rust
- **Self-hosted:** Yes
- **GitHub stars:** 14749 (2026-10-04)
- **Repository:** https://github.com/NVIDIA/OpenShell
- **Last verified:** 2026-10-04

> Caveat: The claim that OpenShell is the *only* open-source agent sandbox defaulting to deny-all egress is not independently verifiable and is not asserted here. OpenShell was labelled alpha as of mid-2026.

Source: https://agent.c8.fit/tools/nvidia-openshell/