Codex
Run your existing Codex account inside the host and use your subscription with OAuth.
Open source agent infrastructure
KernNot yet another harness. An agent host.
Kern gives your favorite agents a durable home: connected accounts, rich UX, and around-the-clock autonomy on infrastructure you own. Real access is finally safe to grant.
- Prompt injectioncontainedA tricked agent still cannot act outside your policy.
- Data exfiltrationno path outEvery request crosses a fail-closed proxy, on the record. Account-aware checks ensure traffic reaches only your approved accounts, even on trusted domains.
- API key theftnothing to stealYour API keys never reach the agent: they stay with the host, out of its reach.
Deploy your own$git clone infiloop2/kern
network policyfail closed
09:41:07POSTapi.openai.com/backend-api/responsesallowedpinned to your account
09:41:10POSTapi.anthropic.com/v1/messagesallowedcredentials verified
09:41:13GETapi.github.com/repos/you/productallowedreads are open
09:41:16POSTexfil.attacker.dev/collectdeniedno matching rule
09:41:19GETpypi.org/simple/httpx/allowedpackage guard, read only
09:41:22DNSevil-c2.iolookupdenieddenied before resolution
Live view of the boundary: every request your agent makes, allowed, held, or denied, with the reason on the record.
The point of a host
Rigor at the boundary. Freedom inside.
Bring your favourite agents. Keep them running overnight inside the host. Chat with them, use purpose-built interfaces, or let them build their own.
Claude Code
Run Claude Code inside the host and use your Claude subscription with OAuth.
Hermes
Run a variety of open-source models under the same host contract. No lock-in to a single model provider.
Controlled integrations
Your accounts, on your terms
Every tool ships with a data policy per action: what it reads, what it can send, and which actions are sensitive. Reads flow so the agent can work; writes with consequences hold in an approval queue that discloses exactly what will execute, ready to clear from your phone.
GmailGoogle CalendarBrave SearchXLinkedInInstagramPolymarketIBKRSeedance
tool policy
gmail.read_inboxauto approval
gmail.send_emailheld for approval
x.create_postheld for approval
instagram.publish_reelheld for approval
polymarket.read_marketsauto approval
ibkr.read_portfolioauto approval
The host
Engineered like infrastructure, not a wrapper
Harnesses ask the model to behave. A host does not have to ask: the boundary is built into the machine your agent lives on, so autonomy does not depend on the model having a good day.
A durable home
Close the laptop; the agent keeps working. It lives on an EC2 instance in your AWS account: always on, state preserved across restarts, no session that dies with your terminal.
Autonomous by default
Full autonomy without the dangerously-skip-permissions gamble. No prompts inside the boundary; only actions with real-world consequences wait, in a queue, for you.
Isolated by construction
Agent, tools, proxy, and admin run as separate system users with separate storage and secrets. The admin console is reachable only by you.
Everything on the record
Tasks, session logs, tool calls, and every network request, allowed or denied, with the reason attached. Supervision is reading a ledger.
Three layers between your agent and the internet
Defense in depth, fail closed at each layer, so even a prompt-injected agent has nowhere to send your data. This is the architecture, simplified; the full version is in the docs, in the open.
Kernel firewall
Outbound traffic is dropped for the agent at the kernel. The only road out of the box is the local policy proxy.
- The agent runs as its own Linux user with zero egress in nftables.
- Even DNS is blocked for the agent: lookups are an exfiltration channel.
- If the proxy is down, the agent simply has no connectivity.
nft: meta skuid "agent" dropChoose your trust boundary
Three ways to run Kern
Kern is live today: deploy it yourself from source, run it in your own account managed by Kern Cloud, or have it fully hosted on Kern Cloud. Either way, the boundary is yours.
Full self hosting
Deploy from source to your own AWS account and access via your own Cloudflare domain. Your data and keys never live on someone else's platform.
- Runs in your AWS account, and access through your own configured domain
- You run deploys, upgrades and manage all configuration
- Completely free, pay your own infra and AI bills
- Community support
Managed self hosting
Runs in your AWS account, but Kern Cloud handles the setup: one-click deploy and upgrades. Your data, keys and billing stay yours.
- Connect your AWS account and deploy in one click, with scoped access you can revoke
- Access through a personal domain configured for you
- Completely free, pay your own infra and AI bills
- Support included
Hosted on Kern Cloud
We provide all the infrastructure and run Kern for you on Kern Cloud, with integrated billing.
- One click, nothing to install or manage, runs on Kern Cloud
- Access through a personal domain configured for you
- Integrated billing for infra, pay your own AI provider
- Support included
Questions
Frequently asked questions
Real work with real accounts: read and send email, manage your calendar, search the web, write code against your repositories, and post to social accounts as tools land. Apps turn that into outcomes: builders, social media managers, shorts studios, and research desks, with more on the way. Sensitive actions always wait for your approval.
Codex, Claude Code, and Hermes today. Bring the accounts you already have, or run open-source models under the same host contract. Kern is a host, not a harness: it does not replace your agent, it runs it.
On an EC2 instance in AWS. Self-host it in your own account, fully self-serve; have Kern Cloud operate it in your account with config and billing still yours; or run it one-click on Kern Cloud.
Yes. The complete host is developed in the open at github.com/infiloop2/kern under the Business Source License 1.1. You can read every line that enforces the boundary, audit it, and self-host it.
Three fail-closed layers. The kernel firewall gives the agent no direct network path. The policy proxy checks every request against your rules before DNS resolution. Provider guards pin traffic to accounts you approved, so even a stolen key is not a way out.
They hold in an approval queue with the exact payload disclosed: the recipient, the subject, the repository, the event. The agent keeps working on everything else while decisions wait for you. Approval is a queue, not a modal.
Self-hosting is free forever: you pay only your own AWS, AI subscription, and tool API bills. One-click Kern Cloud folds infrastructure, AI, and tools into a single integrated bill.