Cowboy

Cowboy is an AI agent harness built on Zellij and WebAssembly. The agent runtime is a Zellij plugin compiled to wasm32-wasip1; around it sit a credential proxy, a seccomp sandbox, and a set of NixOS modules that wire everything together. It runs in two modes:

• Lite — a portable pip install, no NixOS required. The agent runs in your terminal with the core file, shell, search, and web tools.
• Full (NixOS) — agents run as managed services with network-namespace isolation, credential injection, seccomp confinement, and message bridges (Discord, email).

What it does

An agent reads your request, calls tools to act on the system, and reports back. Cowboy provides the runtime, the tools, and the boundaries those tools run inside:

• Tools that run in your real environment — read/write files, run shell commands, search, and search the web. No simulated sandbox; commands execute on the actual system.
• Persistent memory — agents save and retrieve notes across sessions via a Zettelkasten backend. See Memory System.
• Sub-agents — the main agent can spawn read-only research, code, or review sub-agents as separate Zellij panes. See Sub-Agents.
• Hashline editing — line-addressed edits with per-line hash validation, so an edit fails loudly if the file changed underneath it. See Hashline Edit.
• Multiple providers — Anthropic, OpenAI, OpenRouter, Ollama, and Codex (ChatGPT subscriptions) behind one provider interface. Vision-capable models can receive images inline or delegate image description to a separate configured model.
• Browser automation — the optional Camoufox service gives agents a real browser for navigation, snapshots, interaction, JavaScript, and screenshots. See Browser Automation.

How it stays bounded

In full mode, the agent never holds your API keys and cannot reach the network freely:

• A mitmproxy addon injects credentials into outbound requests per-domain, so keys live outside the agent. Write methods (POST/PUT/PATCH/DELETE) are blocked to any domain not on the egress allowlist.
• The agent runs in a network namespace (cowboy-ns) whose traffic is forced through the proxy.
• Shell commands are wrapped by sheepdog, a seccomp sandbox that mediates syscalls (Linux x86_64).
• Outbound messages from bridges can require human approval before they are sent.

See Security Model for the full picture.

Getting started

Lite mode:

pip install get-cowboy
cowboy --model anthropic:claude-sonnet-4-20250514

NixOS, as a managed agent service:

{
  imports = [ inputs.cowboy.nixosModules.default ];

  services.cowboy.agents.dev = {
    enable = true;
    user = "alice";
    model = "claude-sonnet-4-20250514";
  };
}

Next steps

• Installation — install lite or full mode
• Quickstart — your first session
• Configuration — config files, flags, and module options
• Design Overview — how the pieces fit together
• Security Model — the isolation boundaries

Source: github.com/dmadisetti/cowboy. Docs: cowboy.rs.