A place to work
Cells hold the workspace and tools. Agent Cells edit code; Service Cells run approved applications with separate permissions and lifecycles.
OPEN SOURCE / AGENT RUNTIME
A space for AI agents.
With boundaries
you define.
Run agents in isolated environments. Control their tools, credential use, and external actions through one policy layer.
In development · Try the CLI today
You define the policy
CellaYour controlled environment
CELL WORKSPACEAgent + tools + codeWall contains execution
edittestbuildRequest scoped access
PolicyAllow / deny
Gateway External actionsRelay Service connections
Repositories · APIs · Services
A sandbox contains the work.
Cella also governs what crosses its boundary.
HOW CELLA FITS TOGETHER
Execution inside.
Authority under control.
Give agents the access they need, with explicit boundaries around everything else.
Access you define
Policy scopes tools, resources, and credential use. Gateway mediates external Effects. Channels through Relay connect permitted service endpoints.
A record you can inspect
Follow an action from its request to the policy decision and result, with evidence tied to the work.
Reuse a project Cell or create one with tighter permissions. Run locally or on a remote machine. Follow the workflow.
A REQUEST, END TO ENDInteractive example
Agent CellPrivate workspace
Request an external action
cellad → GatewayPolicy-bound operation
Provider credentialsOutside both Cells
Effect policy
repo + branchALLOWGitHub
acme/backendPermitted push. Credential stays outside.
- Request
- Policy
- Result
- Evidence
Gateway performs the permitted push and records the result. The credential stays outside the Cells.
git.push · ALLOW · result recorded
Select an action or replay all five
Illustrative Git push is permitted by repository and branch policy. Gateway performs the action without exposing the credential to the agent, and records the result.
EVIDENCE
See what happened.
Understand the decision.
Select an action to inspect its policy, authority, and result.
Read about evidence
Event detailDENY
- Workstream
- backend-health
- Agent
- codex
- Session
- example_run_01
- Action
- fs.read
- Arguments
- ~/.ssh/id_ed25519
- Policy matched
- deny.filesystem: ~/.ssh/**
- Result
- Refused. No host key read.
- Timestamp
- 2026-10-08T14:32:21Z
Illustrative records. Select an event to inspect its decision.
OPEN SOURCE · APACHE 2.0
Built in the open.
Run on your terms.
Inspect the code, try the CLI, and help shape Cella. The complete protected agent workflow is still in development.
Start with the CLI
git clone https://github.com/ryuux05/Cella.git
cd Cella
cargo build --locked -p cella-cli
./target/debug/cella infoRequires the repository’s pinned Rust toolchain. These commands build and inspect the CLI; they do not install a protected runtime.
Full setup instructionsCommon questions.
Explore the docsIs Cella a coding agent?
You bring the agent. Cella provides its working environment and the boundaries around access, communication, and external actions. The same model supports local development, remote work, and reusable project Cells.
How is Cella different from a sandbox?
The sandbox contains execution. Cella also defines where authority lives and how it may be used: tool and resource permissions, credential-backed operations, service connections, approvals, and evidence. These boundaries share the same identity and policy model. Explore the architecture.
Can I keep using the same Cell?
That is the intended workflow: explicitly select a project Cell again, with retained work where policy permits. Its identity continues across Runs. Changed permissions or other admitted inputs require a new generation, and continuation revalidates access. The complete reuse and checkpoint workflow is still in development. How Cell reuse works.
Can Cells work together?
Through declared interfaces. An Agent Cell can request access to a named service endpoint through a bounded Channel carried by Relay. That does not combine their permissions. General agent-to-agent messaging would need an additional contract. Understand Channels and Relay.
Why separate Agent and Service Cells?
The agent needs editable source and coding tools. An application needs an approved runtime, storage, and sometimes secrets. Separate Cells give each its own authority and lifecycle. A bounded Channel lets the agent interact with the application. Read about services and secrets.
Does the agent get my credentials?
Cella is designed to keep protected credentials outside the agent’s sandbox. The agent requests a scoped operation, such as pushing to an approved repository and branch, while Cella mediates access and records the result. Explore permissions and approvals.
What can I try today?
You can build the open-source CLI or use the Debian CLI-only bootstrap, inspect its commands, and run read-only runtime checks. The complete protected coding-agent workflow is still in development. Get started with the CLI.