Harness agents

AgentOS can run coding agents that can automatically improve the platform. Claude and Codex can investigate failures, read traces, update code, and submit changes for review.

Enable the coding agents

Your template comes with Claude and Codex agents but they are disabled by default. To enable them:

1. In app/main.py, uncomment the from agents.engineers import ... line.
2. Uncomment the matching create_claude_engineer() or create_codex_engineer() call in the agents list.
3. In Render's Environment settings, add ANTHROPIC_API_KEY for Claude.
4. Commit and push to the branch connected to Render. If auto-deploy is disabled, deploy manually.

Once the deployment is live, chat with the coding agent in the AgentOS UI or ask OS Manager to use it.

The dangers of direct execution

By default, coding agents run in the project directory on the API host (see app/sandbox.py). They can edit the files serving your application, run commands, and access the API process's environment and credentials. A coding mistake can affect the running platform.

Use direct execution only for initial testing. Configure sandboxes before opening access to your team.

Sandboxes and checkpoints

Sandboxes give each coding session its own environment and repository checkout. Checkpoints save the workspace and native coding session so it can resume from the last successful checkpoint after the sandbox is replaced.

We recommend using Docker for local development and AWS AgentCore for the production platform.

Local Docker sandbox

If you followed the setup guide, you would have a locally running platform on your computer.

Enable the coding agents in app/main.py and in app/sandbox.py, enable sandboxes and set the repository and branch they should work on:

SANDBOX_ENABLED = True
REPOSITORY = Repository("https://github.com/YOUR-ORG/YOUR-REPO", branch="main")

Next, build the sandbox image and start the platform:

docker build --target sandbox --load -t agno-sandbox:local .
docker compose up -d --build
./scripts/mcp_check.sh

Open the AgentOS UI and start a new conversation with a coding agent. Check sandbox containers being started in your Docker Desktop. Rebuild the sandbox image when its dependencies or Dockerfile change.

AWS AgentCore sandbox

AgentCore runs coding sessions and S3 stores their checkpoints. Your AgentOS API stays on Render. Your template comes with a handy scripts/aws.py script to provision the resources required and the docs/harnesses.md file contains thorough details on setting up your sandboxes.

Prepare your AWS account

From the template repository, create and activate the python virtual environment.

./scripts/venv_setup.sh
source .venv/bin/activate

Add these settings to your existing .env. Copy example.env to .env first if you haven't created it:

AWS_PROFILE=your-profile
AWS_REGION=us-east-1

aws sso login --profile your-profile

Preview the account, region, and resource names being provisioned:

scripts/aws.py plan

The script reads .env, verifies your AWS identity, and shows the tracing configuration. Check that the account and region are correct before continuing.

Create the AWS resources

scripts/aws.py apply

This creates two CloudFormation stacks, builds and uploads the ARM64 sandbox image to ECR, and prepares an AgentCore runtime, a private S3 checkpoint bucket, and the required IAM permissions. It also configures runtime trace delivery and enables CloudWatch Transaction Search if needed.

Wait for Sandbox resources are ready, then keep the printed settings for the next steps. You can retrieve them again with:

scripts/aws.py status

Create credentials for your API

Your local AWS profile provisions the resources. The script creates a separate ApplicationUser with access to the runtime and checkpoint storage for your AgentOS API. Create an access key for that user in the AWS console:

1. Open IAM → Users and select the printed ApplicationUser.
2. Open Security credentials → Create access key.
3. Select the use case for an application running outside AWS and save the key securely.

Use this application's key on Render. Keep your provisioning credentials on your computer. The script creates the user and its permissions; it does not create access keys.

Connect your platform to the sandbox

In Render, open your API service's Environment settings and add:

Keep your model keys, database settings, and RUNTIME_ENV=prd. Agno forwards model credentials to the coding agents. When using these IAM user keys, remove any stale AWS_PROFILE or AWS_SESSION_TOKEN settings from Render. For a private repository, configure GitHub access before the first run.

In app/sandbox.py, enable sandboxes and set the repository and branch you want the coding agents to work on:

SANDBOX_ENABLED = True
REPOSITORY = Repository("https://github.com/YOUR-ORG/YOUR-REPO", branch="main")

Commit and push to the branch connected to Render. Save the environment changes and redeploy; wait for the API to become healthy.

Try a coding agent

Select your deployed platform in AgentOS and start a new conversation with an enabled coding agent:

Show the current repository and branch.
Create sandbox-check.txt containing "AgentCore is working", then read it back.
Do not commit or push anything.

Confirm the run completes in the expected repository and reads back the file. Repeat for each enabled agent. If it fails, inspect the run error and API logs; AgentCore runtime startup errors are in CloudWatch.

View runtime traces

After running a coding session, open AgentCore → Observability in the same AWS region and select your sandbox runtime. After enabling Transaction Search, allow about 10 minutes for traces to be available.

Verify checkpoint recovery

After the test turn finishes and its checkpoint is saved, continue the same conversation as the same user:

Read sandbox-check.txt and report its contents. Do not recreate or change it.

Give the coding agent GitHub access

Git and the GitHub CLI are included in both the API and sandbox images. Create a fine-grained personal access token to give your coding agents access:

1. Give it a name such as AgentOS and choose an expiration date.
2. Set Resource owner to the user or organization that owns the repository.
3. Under Repository access, choose Only select repositories and select the repositories your coding agents should work on.
4. Under Repository permissions, set Contents and Pull requests to Read and write. Leave other permissions at their defaults.
5. Generate the token. If your organization requires approval, have an owner approve it before using it for private access or publishing.
6. Add it as GH_TOKEN in Render's Environment settings. Keep it out of source code and agent prompts.

The template forwards GH_TOKEN to coding sandboxes and configures Git to authenticate through gh. The same token supports private repository checkout. Set GITHUB_READ_TOKEN only if you want a separate checkout credential.

Commits default to AgentOS <agentos@localhost>. To use your own identity, set GIT_AUTHOR_NAME, GIT_AUTHOR_EMAIL, GIT_COMMITTER_NAME, and GIT_COMMITTER_EMAIL in Render. The template forwards these settings to sandboxes too.

Redeploy the API after changing environment settings and start a new coding conversation. If you are upgrading an older AgentCore image, run scripts/aws.py apply once to include GitHub support. Later token changes do not require an image rebuild.

Next

Use simulations, evaluations, and recurring reviews to improve your agents and platform.

When you need multiple API instances, follow Scale your platform to configure Redis to coordinate across replicas.