AKIOS
Status: AKIOS 1.x is no longer maintained and is not intended for production use. A redesigned AKIOS is in development.
The Open-Source Security Cage
for AI Agents
Cage your AI agents before they leak data, burn budgets, or run unchecked.
Linux sandbox (seccomp-bpf, cgroups v2) · Real-time PII redaction · Hashed audit log · Cost & loop kill-switches
pip install akios
Why AKIOS
Sandboxed by Default
On native Linux as root, AKIOS applies seccomp-bpf and cgroups v2 limits. The built-in agents only reach allowlisted paths, commands and domains.
Cost & Loop Kills
Hard kill-switches for API costs and infinite loops. Enforce budgets per workflow.
PII Redaction
Real-time PII detection and redaction built-in. 44 regex patterns catch emails, SSNs, credit cards, API keys, and more — before data reaches any provider.
Auditable Logs
Every action is logged with a SHA-256 hash and a Merkle root. The log detects simple edits.
Explicit Policies
Connect tools with explicit policies, not magic. You define exactly what an agent can access.
Minimal & Native
A Python package or a Docker image. Native Unix design for clean CI/CD integration.
Quickstart (3 minutes)
Install AKIOS and run your first sandboxed AI workflow. You'll see kernel-level isolation, PII redaction, and audit logging — working out of the box.
# Install
pip install akios
# Initialize a project
akios init my-project
cd my-project
# Run the sample workflow
akios run templates/hello-workflow.ymlExpected output:
[akios] environment: native linux (kernel-level)
[akios] sandbox: seccomp-bpf, cgroups v2
[akios] pii: redaction enabled (53 patterns)
[akios] audit: Merkle trail initialized
[akios] workflow: completed successfully in 1.2sArchitecture
Runtime layers: policy engine, kernel sandbox (seccomp + cgroups, native Linux as root), PII redaction, budget/loop controls, hashed audit log — then agents access tools/APIs under your explicit policies.
Security controls (every run)
The cage applies these controls to every workflow step. Read the security model for their limits.
- Process IsolationOn native Linux as root: cgroups v2 resource limits and a seccomp-bpf denylist of administrative syscalls on the AKIOS process.
- AllowlistsThe built-in agents only reach allowlisted paths, commands and domains. These are checks in AKIOS, not kernel enforcement.
- PII Redaction44 regex patterns detect and redact sensitive data in real time — on inputs and outputs.
- Hashed Audit LogEvery action is written with a SHA-256 hash, and a Merkle root is kept. It detects simple edits, not a tamperer who knows the format.
- Cost & Loop Kill-SwitchesHard budget limits per workflow. Runaway agents are terminated, not throttled.
- Sandbox-First ExecutionPolicy checks run before every tool call.
Core agents
Four built-in agents cover typical workflows, all running inside the security cage:
Filesystem
Allowlisted reads, optional writes; path and mode constrained.
HTTP
Rate-limited requests with PII-redacted payloads and headers.
LLM
Token and cost tracking with budget kills; prompts/responses redacted.
Tool Executor
Whitelisted commands in a sandboxed subprocess with syscall filtering.
Frequently asked
What about performance?
25ms startup on t3.medium, 44+ workflows/sec throughput, ~21MB memory. <5ms policy enforcement, <50ms PII redaction. Full benchmarks in docs.
How much does it cost?
AKIOS is completely free and open source under GPL-3.0-only. No licensing fees. Download, deploy, and run on your infrastructure.
Will it work with my stack?
AKIOS works with OpenAI, Anthropic, AWS Bedrock, Grok, Mistral, and Gemini. Run natively on Linux, or with Docker on macOS and Windows. pip install or container — your choice.
How is security actually enforced?
seccomp-bpf and cgroups v2 on native Linux when AKIOS runs as root; allowlist checks in the built-in agents everywhere; container isolation with Docker on other platforms. The security model documents the limits.
Ready to Cage Your AI Agents?
Get hands-on in minutes with our Quickstart, or explore the code on GitHub. AKIOS is free, open source, and ready for your first workflow.
Need help or to report an issue? Use GitHub Discussions or Issues — no contact form to keep support open and transparent.
Have a question? Visit the Community page or use GitHub Discussions/Issues for open, transparent support.