AI Agent Platforms & Workspaces Comparison Matrix
Comprehensive forensic benchmark evaluating 16 open-source AI agent workspaces, control planes, and developer runtimes across collaboration, isolation, transport durability, and governance.
16 Platforms4 Category Groups19 Evaluation CriteriaVerified Evidence
Sort:
Tier:
Showing 16 of 16 platforms
16 PlatformsSelect any number to compare side-by-side | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼Core Collaboration Dimensions (D1–D7)7 | ||||||||||||||||
D1: Document & File Sharing | 8.5 /10 3-tier visibility model (`private`, `restricted`, `project`), public link genera… | 6 /10 Immutable snapshot links with file stripping; role/agent inheritance; **no real-… | 7 /10 DB-backed shares, fork continuation, PFS project files; no live co-op | 7 /10 Directed permission graph DAG with lazy revocation; 128-bit URL-fragment bearer … | 6.5 /10 Versioned artifacts, 7-day public nonce shares, tar downloads, Office Online OTK… | 5 /10 GeeseFS S3 prefix mounts; project-scoped file downloads (`router.py:630`); SSE s… | 5.5 /10 **Overstated in Master Summary**; DocumentSets and Personas share cleanly, but s… | 3 /10 **Primitive / Local**; Flat local filesystem outbox/inbox (`.opencode/openwork/`… | 7.5 /10 Single-table polymorphic asset delivery (`LoopNode` / `Delivery` in models/deliv… | 6 /10 Dedicated Agent File System (`AFS`), unguessable 128-bit public export bearer to… | 8.5 /10 Snapshots for shared links; Channels (Slack-like); Yjs/Pycrdt multiplayer notes.… | 3 /10 Workspace files can be downloaded or previewed via iframe with session cookies (… | 2 /10 Generated files write directly to the local filesystem (`session.working_dir` in… | 1.5 /10 **Dead last in cohort.** Strictly local on-disk storage (`$DSH_HOME/sessions/` a… | 2 /10 Generated artifacts are strictly scoped to `(spaceId, userId)`. Queries in apps/… | 1.5 /10 **Absent.** Generated files download strictly to the local client DOM via `trigg… |
D2: MCP & Multi-Tenant Auth | 8 /10 Enterprise account/project RBAC hierarchy with SCIM 2.0 and SAML/OIDC SSO. OpenC… | 8.5 /10 3-tier MCP registry (`MCPServersRegistry.ts`), Entra ID OBO token exchange, Mong… | 8 /10 Benchmark two-token resolution (`pickInstallForCaller`); single-org constraint | 6.5 /10 Flawless 4-tier DO/Worker tenant isolation; Cloudflare Access / Zero Trust integ… | 9 /10 **Cohort Joint Winner**; 4-layer relational MCP schema (`Template` → `Connector`… | 8.5 /10 Three-tier Org → Workspace → Project RBAC with 44 permissions (`types.py:4-259`)… | 8.5 /10 **Cohort Standout**; Schema-per-tenant PostgreSQL, Vespa tenant filtering, dual-… | 9 /10 **Cohort Standout (Co-Winner with CubePlex)**; Centralized Den MDM governance; g… | 8 /10 Strict CRD identity triplet `(namespace, name, user_id)` (AGENTS.md:76). Dynamic… | 7 /10 Secure MCP loopback reverse proxy; OAuth tokens keyed strictly `(user_id, server… | 7.5 /10 Native MCP Python SDK, OAuth 2.1 per-user tokens, Fernet-encrypted `UserValves`.… | 2 /10 **Critical flaw:** Self-hosted Agent Server enforces a single pre-shared `X-Sess… | 1.5 /10 **Critical Deficit:** Completely single-tenant. Flat SQLite schema without `user… | 1.5 /10 **Zero multi-tenancy.** No user database, sessions, or roles. Web authentication… | 3 /10 Multi-tenancy schema exists, but Better Auth plugins explicitly hard-block invit… | 2 /10 **Single-Tenant Only.** Hardcoded to a single user `system_default_user` (runLeg… |
D3: Sandboxes & Environments | 9 /10 AES-256-GCM encrypted project secrets with HKDF key derivation. Formal delivery … | 5.5 /10 Delegated HTTP execution (`codeapi`), attached worker pairing; **lacks org/proje… | 7 /10 Dagger BuildKit `/home/sandbox`, K8s egress; no team/project secret hierarchy | 7.5 /10 V8 dynamic worker isolates with `<5ms` cold start; `compatibilityFlags: ["disall… | 9.5 /10 **Cohort Winner (#1 Overall)**; OpenSandbox integration, zero Docker socket moun… | 8.5 /10 Daytona microVM isolation; host-bound opaque secret substitution (`daytona-secre… | 6 /10 Hardened container runtime (`cap-drop ALL`, UID 1000:1000, mitmproxy credential … | 4 /10 **Bounded Isolation**; Unsandboxed local host execution by default; `.env` restr… | 7 /10 Multi-repo workspace environments (up to 20 Git repos, 50 setup steps in workspa… | 5 /10 Alibaba OpenSandbox + `env-runner-k8s`; credentials injected into `/root/.agent-… | 4 /10 Client-side Pyodide Wasm; server Jupyter has **zero OS/container isolation** (VU… | 4.5 /10 Supports local host, Docker (`DockerWorkspace`), and Kubernetes (`AgentSandboxWo… | 3 /10 Executes shell commands directly on the host operating system, sourcing the user… | 2.5 /10 Exceptional single-machine OS confinement (bwrap/Landlock/Seatbelt), but agent s… | 5 /10 Native Daytona microVMs (`@daytonaio/sdk` v0.211.2), E2B Desktop, and Docker sup… | 2 /10 **Unsandboxed Host Execution.** CLI agents run as native child processes on the … |
D4: Image & Multimodal RAG | 4 /10 Vision *input* supported via LLM gateway with image bounding (20 inline max) and… | 6 /10 Provider-bound video/audio/image ingress, Mistral OCR, Whisper STT; **text-only … | 4 /10 Excludes generative vision/audio; RAG connector images only; zero audio/video | 3.5 /10 **Severe platform blind spot**. Text & PDF input only (via base64 protocol bridg… | 5.5 /10 Generative image tool (`generate_image` via OpenAI/Doubao/SiliconFlow/Together) … | 4 /10 Claude/Codex/Pi vision input up to 10MB inline base64 (`attachments.ts:96-113`).… | 6 /10 Full OpenAI `gpt-image-` and DALL-E image editing (up to 16 reference images); h… | 4 /10 **Basic Vision / No Vector RAG**; OpenAI `gpt-image-2` tool generation; PDFium W… | 7.5 /10 **COHORT LEADER (Rank #1 in D4)**. Dedicated image/video generation schemas (`Im… | 3 /10 **Cohort Laggard (Tied #13)**; Inbound chat vision attachments and FunASR/Whispe… | 6.5 /10 Multi-engine image generation (DALL-E, ComfyUI, A1111); **RAG embeddings are str… | 4 /10 Excellent vision *input* processing (base64 URL inlining, image downsampling, br… | 3 /10 Ingests image base64 blocks and PDF documents (images.rs:18-36, documents.rs:13)… | 2.5 /10 Ingestion of raster images only (PNG, JPEG, WebP, GIF admitted in `attachment/ad… | 2 /10 **Severe blind spot:** Zero image generation models (no DALL-E, Midjourney, Flux… | 4.5 /10 **Partial (Single-Turn API).** Image generation via `executeImageGeneration` cal… |
D5: Background Tasks & Automation | 9 /10 First-class Git-backed triggers supporting `cron`, signed `webhook`, and 24/7 `m… | 9.5 /10 Cron engine with distributed lease fencing, durable Mongo queue (`/api/agents/v1… | 9.5 /10 **Cohort Joint Winner**; A2A 1.0 JSON-RPC, cron triggers, MS Graph email | 8 /10 Dual background automation engine: `gatekeeper-scheduler` (cron rules, calendar … | 8.5 /10 Distributed cron/interval scheduler with atomic DB state claiming; HMAC-SHA256 a… | 8.5 /10 Taskiq distributed broker; public webhook ingestion (`POST /triggers/composio/ev… | 7 /10 Celery cron schedules for Craft agents (`ScheduledTask`), automated Slack/Discor… | 6 /10 **Polled / Scheduled Leases**; Den automations support once/daily/weekly cron sc… | 8.5 /10 Autonomous headless dispatch (`ProjectAutomationExecution` in project_automation… | 8 /10 **Top Tier**; HMAC-SHA256 authenticated `channel-gateway`, dot-notation pre-filt… | 8.5 /10 RRULE cron; PostgreSQL `SKIP LOCKED` distributed worker claiming; inbound webhoo… | 8.5 /10 Industry-leading headless automation service (`openhands-automation` on port 180… | 5 /10 Robust headless CLI execution via `goose run -t` and `-i` (running-tasks.md:16-9… | 4 /10 Session-local background jobs (`ctx.jobs`, `tool-jobs`) and session crons (`ctx.… | 8 /10 Fully production-ready headless automation engine. Independent worker process (`… | 6.5 /10 **Strong Cron / Headless Scheduler.** Comprehensive background cron daemon backe… |
D6: Reusable & Shared Agents | 9 /10 Agents defined as Git code in `.kortix/opencode/agents/*.md` and governed in `ko… | 9 /10 Granular bitwise ACLs (`VIEW`, `EDIT`, `DELETE`, `SHARE`), Entra ID groups, stri… | 9 /10 **Cohort Joint Winner**; Personal/Team/Org scoping, spend limits, conversation i… | 8 /10 Blueprints packaging (`.gadget` binary format) allows instant multi-tenant agent… | 7.5 /10 "Workspace-as-an-Agent" paradigm; 3-tier memory (`personal`, `workspace`, `organ… | 7.5 /10 Git-like revisions, variants, and structured changesets (`change_set.py`); proje… | 8.5 /10 **Enterprise Benchmark**; Granular Persona sharing (`owner_group_id`, `is_public… | 6 /10 **Split Architecture**; Cloud marketplace plugins with RBAC team grants in Den; … | 8 /10 `TeamShareService` shares agent definitions via `ResourceMember` without cloning… | 5.5 /10 Library Templates snapshotting prompts/MCP/skills with team RBAC grants; strict … | 8.5 /10 Custom Modelfiles with tool/doc bindings; strictly partitioned `ix_memory_id_use… | 5 /10 Custom agents declared via Git-versioned Markdown specs (`.agents/agents/*.md`) … | 2 /10 Custom agents and skills declared as Markdown files with YAML frontmatter in `.a… | 3 /10 Agent Presets (`agent.cordis.yml`) package modular skills, tools, and personas m… | 2 /10 **Architectural lockout:** `Thread.botId` has a `@unique` database constraint (p… | 3 /10 **Local File Reusability.** Structured `Assistant` definitions (assistantTypes.t… |
D7: Multi-Agent Orchestration | 8.5 /10 Multi-agent runtime orchestration via OpenCode `task` tool with parent-child sub… | 9.5 /10 Directed graph edges (`handoff`, `direct`), subagent spawning, cross-provider he… | 8.5 /10 Synthetic `agent__<slug>` tools, cycle detection, Dual-LLM quarantine, Advisor p… | 8 /10 `AgentSpawnerBinding.spawnCallable()` enables dynamic subagent spawning with cus… | 3.5 /10 **Cohort Laggard**; ad-hoc depth-1 subagents only (`SubagentMiddleware`); subage… | 6 /10 Native sub-agent delegation via `_call_workflow_tool` (`router.py:1660-1750`) wi… | 4.5 /10 **Overstated in Master Summary**; No composable multi-agent DAG or persona chain… | 8 /10 **Advanced Subagent Trees**; OpenCode hierarchical subagent trees; deterministic… | 8.5 /10 5 native collaboration topologies (`solo`, `pipeline`, `route`, `coordinate`, `c… | 7.5 /10 High-grade multi-agent runtime (`call_agent`/`get_agent_result`); task-scoped Te… | 7.5 /10 Native subagent delegation loop (`delegate` tool) with memory mutation stripping… | 8 /10 Sophisticated runtime hierarchical delegation (`DelegateAction` with `spawn` and… | 8 /10 **Outstanding Multi-Agent Engine:** Asynchronous subagent delegation via `summon… | 8.5 /10 **Elite tier.** Multi-agent orchestration across 6 execution providers (in-proce… | 8 /10 Outstanding single-user multi-agent orchestration. Real-time group chat handoffs… | 8.5 /10 **Industry-Leading Local Swarm ("Team Mode").** Sophisticated Leader/Teammate to… |
▼Overall Ranking & Performance4 | ||||||||||||||||
Overall Score | 7.9 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 7.7 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 7.5 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 6.8 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 6.8 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 6.8 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 6.5 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 5.7 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 7.6 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 5.5 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 7.5 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 4.8 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 2.5 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 2.3 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 3.5 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… | 3.5 /10 Weighted holistic composite score across all 7 core collaboration dimensions and… |
Tier | S | S | S | A | A | A | A | B | S | B | S | B | D | D | C | C |
Streaming Durability Score | 9.3 /10 cseq` cursor in `Last-Event-ID`, 2,000-envelope ring buffer, and CSS `content-vi… | 9.1 /10 Two-phase decoupled SSE (`POST` + `GET`), `GenerationJobManager`, Redis Lua CAS,… | 9.5 /10 **Rank #2 Cohort-wide**; SSE `tee()`, PG `LISTEN/NOTIFY`, detached `tmux` | 9.47 /10 **Top-tier edge durability**. Bidirectional Cap'n Web RPC over WebSocket; statef… | 9.4 /10 **Tier 1 Enterprise Grade (Cohort Rank #5)**; autonomous `asyncio.create_task`, … | 9.3 /10 Triple-tier protocol separation (ACP over SSE → NDJSON sidecar → Edge AI SDK SSE… | 9.1 /10 **Tier 1 Enterprise Grade (Cohort Rank #7)**; Detached `chat-stream-writer` back… | 9.25 /10 **Tier 1 Enterprise Grade (Cohort Rank #8)**; Electron IPC bypass for loopback S… | 9.1 /10 High durability. Rust Tokio worker loop (`StreamingEventDispatcher` in process/m… | 9.2 /10 **Tier 1 Enterprise Resilient (Rank #10)**; Two-tier client decoupling (24h upst… | 8.2 /10 Socket.IO detached task dispatch (<50ms POST), Redis `overlay_response_streams`,… | 8.7 /10 Modern typed WebSocket protocol (`/sockets/session/{id}`) using `SessionFrame` e… | 9.2 /10 ACP over WebSocket with SQLite WAL `BEGIN IMMEDIATE` transactions. **Deliberate … | 9.7 /10 **#1 Cohort Leader (S-Tier Benchmark).** Multiplexed WebSocket (`/api/remote.mux… | 9.5 /10 **Rank #2 tied in Cohort:** HTTP POST Server-Sent Events via oRPC (`@orpc/server… | 7.6 /10 **Cohort Laggard (Rank #16/16).** While the Rust `ManagedProcess` isolates child… |
Customizability Score | 7.5 /10 Tailwind CSS v4 design system. Split codebase: apps/web monolith (AI-Edit 3/10) … | 7.6 /10 Authoritative Score: 7.6 / 10 (WL: 8.0, Asset Independence: 6.5, AI-Editability:… | 8.5 /10 AGPL-3.0 copyleft license with commercial OEM white-label restrictions. Monolith… | 7.8 /10 The customizability audit reveals an extreme dichotomy between zero-code adminis… | 7.4 /10 Architecturally exceptional, legally proprietary. Monorepo Tailwind 4 `@theme`, … | 7.8 /10 Agenta provides a modular, token-based theming architecture, but completely omit… | 7.1 /10 Modern Web Framework / React 19 / Tailwind 4 stack with standalone Opal design s… | 8.2 /10 Clean MIT core vs EE licensing boundary; modern React 19 + Tailwind v4 + Shadcn … | 6.5 /10 WL: 4.5 / AI-Edit: 5.0 / Licensing: 9.5. Permissive Apache 2.0 license. Electron… | 9.2 /10 Database-driven OEM white-labeling (139_branding_settings.sql) with /favicon.svg… | 3.5 /10 ```
WHITE-LABELING & LICENSING FRICTION POINTS
┌─────────… | 8.5 /10 - Design System & CSS Token Architecture: Built on Tailwind CSS v4, HeroUI v2, a… | 9.16 /10 Cohort Benchmark (Rank #2): Comprehensive 28 KB `CUSTOM_DISTROS.md` manual. Asse… | 8 /10 100% permissive MIT license with clean Cordis typed Slots; modular terminal shel… | 7.25 /10 Rakazo exhibits an optimal licensing foundation contrasted with a split frontend… | 7.6 /10 Code-Level Forking Only. UnoCSS utility tokens map to strict CSS custom properti… |
▼Infrastructure, Security & Licensing5 | ||||||||||||||||
Telegram Tier | Workaround / Gateway Webhook bridge via HMAC-SHA256 signed triggers (`type: webhook`). Lacks native T… | Workaround / Gateway ✅ Native First-Party Bot | Native First-Party Native first-party Telegram bot with inline [Approve]/[Decline] HITL callbacks; … | Workaround / Gateway `ExternalMessageGateway` Worker bridge entrypoint. Headless prompt execution and… | Workaround / Gateway Workaround (API bridge) | Workaround / Gateway External webhook bridge via REST API (`POST /services/agent/v0/invoke`). No nati… | None / Rejected **Workaround** (Requires IM gateway bridge) | Workaround / Gateway No native Telegram bot listener in `apps/server` or `ee/apps/den-api`. Contrast … | Native First-Party **Native First-Party** (Computer bot) | Workaround / Gateway Native IM limited to Slack and WeCom bridges; no first-party Telegram bot integr… | Native First-Party **Native (1st-Party Provider)** | None / Rejected Community bridge daemon (e.g. ClawWorks) bridging WebSocket `/ws` and REST `/api… | Native First-Party Workaround Bridge | Plugin Driven via community Cordis context plugins (`ben7am1n/dsh-telegram`, `andiven/d… | Native First-Party Native `@chat-adapter/telegram` Chat SDK with outbound long-polling or webhook. … | Native First-Party **First-Party Plugin.** Native `TelegramPlugin` under Settings → Channels → Tele… |
Sandbox Grade | A Native Daytona SDK (`@daytonaio/sdk`) + Kortix Platinum UFFD CoW microVMs (~2.3s… | A ClickHouse `codeapi` (NsJail + libkrun KVM microVMs), Daytona MCP; strict `pids.… | B- Dagger BuildKit `/home/sandbox` (daemon runs privileged); relies on K8s CNI | A+ V8 dynamic worker isolates (`worker_loaders`), DO facets, CSP iframes. `<5ms` st… | A OpenSandbox, `kill_pending` container reaping, zero host socket exposure, `_touc… | A+ Native dual SDK (TS runner + Python snapshot baking `build_snapshot.py`); Dayton… | A- Docker/K8s execution under unprivileged UID 1000:1000, `cap_drop = ["ALL"]`, cgr… | B Subprocess signal escalation (SIGTERM 1,000ms → SIGKILL 500ms); local MCP URL gu… | C+ Rust local executor + cloud Docker over `/var/run/docker.sock` + E2B envd emulat… | B- OpenSandbox microVMs/containers, ~2–6s provisioning, zero Docker socket mount; d… | C+ Open Terminal mounts `/var/run/docker.sock` with passwordless sudo; zero IMDS me… | B Docker workspace, Kubernetes agent sandboxes (gVisor `runsc` / Kata), Apptainer,… | B+ Drives official `daytona-mcp` over `rmcp`; V8 Code Mode isolate (`pctx_code_mode… | A **#1 Bare-Metal OS Hardening.** `dsh-sandbox-local`: Linux Landlock LSM + Bubble… | A- Daytona hardware-isolated microVMs (`@daytonaio/sdk`), E2B Desktop VMs, Docker s… | C+ **Unsandboxed Host Execution with Good Process Hygiene.** No Linux namespaces, c… |
License | Elastic-2.0 Elastic-2.0 governing license. See dealbreaker notes. | MIT MIT governing license. See dealbreaker notes. | AGPL-3.0 AGPL-3.0 governing license. See dealbreaker notes. | Apache-2.0 Apache-2.0 governing license. See dealbreaker notes. | Community Community governing license. See dealbreaker notes. | MIT MIT governing license. See dealbreaker notes. | MIT MIT governing license. See dealbreaker notes. | MIT MIT governing license. See dealbreaker notes. | Apache-2.0 Apache-2.0 governing license. See dealbreaker notes. | Apache-2.0 Apache-2.0 governing license. See dealbreaker notes. | Proprietary Proprietary governing license. See dealbreaker notes. | MIT MIT governing license. See dealbreaker notes. | Apache-2.0 Apache-2.0 governing license. See dealbreaker notes. | MIT MIT governing license. See dealbreaker notes. | Apache-2.0 Apache-2.0 governing license. See dealbreaker notes. | Apache-2.0 Apache-2.0 governing license. See dealbreaker notes. |
Docker Escape Trap (/var/run/docker.sock mount) | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ⚠ TRAP CRITICAL VULNERABILITY: Mounts /var/run/docker.sock with root execution, allowin… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ⚠ TRAP CRITICAL VULNERABILITY: Mounts /var/run/docker.sock with root execution, allowin… | ⚠ TRAP CRITICAL VULNERABILITY: Mounts /var/run/docker.sock with root execution, allowin… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… | ✓ Clean Clean: No /var/run/docker.sock host socket mount. Employs hypervisor or containe… |
IMDS SSRF Vulnerability (169.254.169.254 leak) | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ⚠ TRAP CRITICAL VULNERABILITY: Unblocked cloud metadata endpoint (169.254.169.254), per… | ⚠ TRAP CRITICAL VULNERABILITY: Unblocked cloud metadata endpoint (169.254.169.254), per… | ⚠ TRAP CRITICAL VULNERABILITY: Unblocked cloud metadata endpoint (169.254.169.254), per… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ✓ Clean Clean: Cloud IMDS (169.254.169.254) is filtered or unreachable from sandbox gues… | ⚠ TRAP CRITICAL VULNERABILITY: Unblocked cloud metadata endpoint (169.254.169.254), per… | ⚠ TRAP CRITICAL VULNERABILITY: Unblocked cloud metadata endpoint (169.254.169.254), per… |
▼Forensic Superpowers & Critical Vulnerabilities3 | ||||||||||||||||
Superpower | Gold-standard Daytona + Platinum UFFD CoW microVMs (~2.3s cold start, README.md:216); composite cursor epoch|seq|cepoch|cseq dual-channel SSE ring buffer (apps/api/src/projects/routes/session-stream.ts:15-33); zero-secret guest egress shim (apps/kortix-sandbox-agent-server/src/egress-shim/shim.ts & apps/api/src/secrets/http-broker.ts); reactive disk quota auto-archiving (apps/api/src/projects/disk-quota-guard.ts). | Best-in-cohort multi-agent orchestration (D7: 9.5) and heterogeneous cross-provider routing (packages/api/src/agents/discovery.ts:432-453); decoupled two-phase SSE with GenerationJobManager and Redis Lua CAS (packages/api/src/stream/GenerationJobManager.ts:120-185); ClickHouse codeapi NsJail + libkrun microVMs; word-level fade-in rendering. | Premier enterprise Telegram ChatOps with inline [Approve]/[Decline] HITL callback buttons and chat attachments auto-mounted to /home/sandbox/attachments/; Fastify SSE closing gate holding EOF until DB commits (packages/server/src/routes/ui-stream-response.ts:32-88); two-token MCP credential decoupling (packages/server/src/routes/mcp-client.ts:2348-2384). | Ultra-low latency cold start (<5ms) and economic efficiency ($5/mo baseline, $0 idle) via V8 dynamic worker isolates (packages/workshop-backend/src/overseer.ts:8583-8604); Cap'n Web bidirectional RPC over WebSocket with promise pipelining (packages/workshop-backend/src/server.ts:944-978); Overseer Durable Object with transactional SQLite; native /admin panel with OKLCH injection. | #1 Security & Isolation in entire cohort (9.3 composite; D3: 9.5, D2: 9.0); opaque egress secret substitution replacing credentials with 160-bit base32 cbxref_ placeholders; Alibaba OpenSandbox with kill_pending DB state (backend/cubeplex/services/sandbox_manager.py:210-255); headless @cubeplex/core with cohort-best AI-editability (9.5). | Grade A+ Daytona sandboxing with dual SDK (TS runner + Python snapshot baking build_snapshot.py, services/runner/src/engines/sandbox_agent/daytona-provider.ts:53-276); wire-level opaque secret substitution (dtn_secret_<id>) with Differential Credential Preflight; ACP over SSE with 30fps grapheme typewriter (useTypewriter.ts:18-35); 100% MIT Expat core. | Enterprise hybrid RAG benchmark with query-time document-level ACL synchronizers across Google Drive, Slack, Confluence, Jira, GitHub (backend/onyx/tools/search.py:959); detached chat-stream-writer thread with zlib-compressed Redis resumption; hardened container runtime (cap_drop = ['ALL'], UID 1000:1000, mitmproxy IMDS drop). | Elite credential governance (D2: 9.0) with centralized Den MDM brokering; native MDM white-labeling (desktop-bootstrap.json) dynamically rewriting app icons and Windows AppUserModelID without recompilation (apps/desktop/electron/brand-app-name.mjs:18-30); dual-lane RAF batching (60fps fg / 100ms bg); clean MIT core + rolling EE license. | Best-in-cohort multimodal support (D4: 7.5, backend/app/services/execution/request_builder.py:1111-1154); native first-party Telegram bot with real-time tool badges (🔧 使用工具, ⏳ 正在思考) and /use [chat|cloud] command switching (backend/app/services/channels/telegram/); 5 native multi-agent topologies; codepoint-safe delta streaming. | #1 Customizability & Native OEM White-Labeling in entire cohort (9.2 / WL: 9.6 / AI-Edit: 9.0) with database-driven branding (139_branding_settings.sql), /favicon.svg dynamic SVG interception, and compact @neutree-ai/ui-sdk (control-plane/src/routes/branding.ts:25-45); double-layered streaming resilience with SessionSink ring buffers and crash recovery; Apache 2.0 license. | Cohort-best human collaboration core (D1: 8.5) with Pycrdt/Yjs multiplayer co-editing and Slack-like Channels (backend/open_webui/models/channels.py:44); Open WebUI Computer Telegram bot with Whisper voice transcription and stdio/SSE MCPs; sub-50ms turn admission (backend/open_webui/main.py:1776-1854). | Autonomous coding engine with detached libtmux execution; embeddable npm library @openhands/agent-canvas (src/root.tsx:230); typed WebSocket with _SessionSubscriber buffering live pub/sub during disk replay (openhands/server/session/session_socket.py:174-235); 100% permissive MIT license. | Native first-party Telegram CLI gateway daemon (goose gateway start) with in-chat interactive tool approval prompts (crates/goose/src/gateway/handler.rs:52-85); SmartApprove LLM permission judge (crates/goose/src/permission/permission_inspector.rs:162-195); documented CUSTOM_DISTROS.md (28 KB manual) with complete ACP protocol decoupling; Apache 2.0 license. | #1 Streaming Transport Durability in entire cohort (9.7/10): monotonic sequence framing, append-only .jsonl.zstd, fractional sequence projection resuming assistant streams mid-token on reconnect, deterministic interruptedTurnClosers crash repair; #1 Bare-Metal Sandboxing (Grade A): in-kernel Linux Landlock LSM + bubblewrap with zero container overhead and <10ms cold start; clean Cordis typed Slots. | Native Daytona microVM integration (@daytonaio/sdk v0.211.2, packages/adapters/src/daytona-sandbox.ts:85-112) with signed VNC preview URLs; native first-party Telegram Chat SDK with browser/desktop automation; Tier-1 streaming durability (9.5) with Hono RPC over SSE (oRPC) and dynamic markdown fence repair. | Graphical orchestration cockpit driving and coordinating headless CLI coding agents (Claude Code, Codex, OpenCode, Gemini CLI) with D7: 8.5; native first-party Telegram bot plugin with pairing code handshake (packages/desktop/src/process/services/database/migrations.ts:158-214); modular Rust aioncore daemon with Windows Job Objects and PID recycling checks (crates/aionui-process/src/process.rs:196-215). |
Fatal Flaw / Dealbreaker | Upstream $39,000 unbounded 24h Axios hang (README.md:235); Elastic License 2.0 commercial SaaS hosting ban (LICENSE:18-20); dynamic branding paywalled behind Enterprise tier with HTTP 402 (apps/api/src/accounts/branding.ts:390); weak multimodal (D4: 4.0, apps/llm-gateway/src/server.ts:348-428). | 357,241 LOC frontend monolith (AI-edit 5.0) with Recoil/Jotai split and monolithic hooks (client/src/hooks/useResumableSSE.ts:1-4667); no native Telegram bot listener (Discussion #3549); chat sharing lacks granular team-level ACLs or multiplayer real-time co-editing. | Single-organization deployment constraint (platform/AGENTS.md#L127); AGPL-3.0 copyleft license with commercial OEM white-label restrictions; non-chat generative media explicitly excluded (D4: 4.0, openai.ts:45-90); monolithic frontend routes (page.client.tsx 4,088 LOC). | Hard vendor lock-in to Cloudflare Workers (zero self-hosting on standard servers); zero POSIX shell/bash capabilities (cannot execute Linux binaries); MCP server bindings are strictly owner-only (cannot collaborate on MCP tools, packages/mcp-shared/src/facet.ts:239-242); 6,428-line ChatInterface.tsx monolith. | Weakest multi-agent orchestrator among enterprise runtimes (D7: 3.5); no Telegram bot driver (Slack/Teams/Feishu prioritized); Community License §2 brand lock mandates keeping logos in frontend/packages/web/ (LICENSE:Section 2); siloed per-conversation document uploads. | Developer-focused sharing (D1: 5.0) lacking consumer chat sharing; zero image generation (D4: 4.0); no native messaging/Telegram bots; hardcoded PostHog telemetry fallback key in api/oss/src/utils/env.py:1539. | Weak multi-agent DAG orchestration (D7: 4.5); zero Telegram bot with Feature Request #776 formally closed as NOT_PLANNED; GUI theme administration EE-gated (HTTP 402, AppearanceThemeSettings.tsx); user project folders enforce single-owner SQL constraints. | Near-zero multi-user collaboration (D1: 3.0); executes directly on developer workstation host by default without OS virtualization (D3: 4.0); no native Telegram bot; session-route.tsx is a 4,097 LOC monolith. | Critical host takeover trap via /var/run/docker.sock mount in Cloud Executor (backend/app/services/execution/executor_manager/executors/docker/executor.py:562); unblocked cloud IMDS (169.254.169.254) SSRF vulnerability; web frontend hardcodes Weibo branding with zero runtime white-label config. | Severe multimodal blind spot (D4: 3.0); default Kubernetes CNI lacks egress filtering, leaking link-local IMDS (169.254.169.254); native IM gateway strictly limited to Slack and WeCom (zero Telegram); heavy Kubernetes operational footprint. | Open Terminal companion mounts /var/run/docker.sock with passwordless sudo (instant root host takeover); unblocked cloud IMDS SSRF (169.254.169.254, _reviews/im-sandbox-eval.md:147); Section 4 proprietary license trap legally forbidding name changes for >50 users with backend actively appending '(Open WebUI)'; 4,669-line Svelte monolith. | Default Docker workspace mounts /var/run/docker.sock with root privileges allowing host takeover (README.md:197, 241); zero multi-tenancy or user management in self-hosted mode (D2: 2.0, dependencies.py:25-38); Daytona removed in V1; 1,012 hardcoded brand strings in i18n; Telegram integration explicitly rejected (#13113 NOT_PLANNED). | Completely single-user flat SQLite database without user/org keys (D1: 2.0, D2: 1.5, crates/goose/src/session/session_manager.rs:1027-1061); default shell commands execute directly on host machine; closing WebSocket deliberately aborts active turn (ActiveRunDropGuard, crates/goose/src/acp/server.rs:257-278); global OS keyring OAuth token sharing trap (oauth/persist.rs:100-103); zero vector RAG. | Ranked dead last (#16) due to total lack of multi-user collaboration primitives (D1: 1.5, D2: 1.5, D5: 4.0, D6: 3.0); agent tool subprocesses run as the same OS UID as the host daemon, giving tools read access to .credentials.yaml (packages/credentials/credentials-local/README.md:113-116); no built-in Telegram listener (requires community Cordis plugin); fire-and-forget unindexed webhooks. | Total absence of multi-user collaboration (D1: 2.0, D2: 3.0, D6: 2.0); multimodal RAG is virtually non-existent (D4: 2.0); schema.prisma Thread.botId unique constraint locks 1:1 bot-to-thread invariance (VISION.md:59); frontend Shell.tsx is 6,157 lines of monolithic debt; cloud IMDS (169.254.169.254) SSRF egress leak. | Cohort-worst streaming durability (7.6): browser reload permanently wipes acp_terminal_output terminal logs (stream_relay.rs:718-720) and drops in-flight turns; zero multi-tenancy (hardcoded system_default_user); remote Telegram requires insecure host YOLO mode; unblocked cloud IMDS (169.254.169.254) SSRF; leaks 'HTTP-Referer: https://aionui.com' (ClientFactory.ts:79-81). |
Primary Code Citation | apps/api/src/projects/routes/session-stream.ts:151-373 | packages/api/src/agents/discovery.ts:432-453 | packages/server/src/routes/active-chat-run.ts:357-388 | packages/workshop-backend/src/overseer.ts:8583-8604 | backend/cubeplex/models/artifact.py:17-70 | api/oss/src/models/db_models.py:18-166 | backend/onyx/server/query_and_chat/chat_backend.py:775 | apps/desktop/electron/brand-app-name.mjs:18-30 | backend/app/services/execution/request_builder.py:1111-1154 | control-plane/src/routes/branding.ts:25-45 | backend/open_webui/models/shared_chats.py:18-62 | openhands/server/session/session_socket.py:174-235 | crates/goose/src/gateway/handler.rs:52-85 | packages/host/webserver/src/index.ts:38-41 | packages/adapters/src/daytona-sandbox.ts:45-110 | packages/desktop/src/process/services/database/migrations.ts:158-214 |
