agentd

Spin up an AI agent that works on its own.

Give it a task, a goal, or a whole workflow — agentd runs as a daemon (or a one-shot), calls tools, and self-corrects until the job is done. Every step is governed, observable, and audited.

agentd — serve

$ agentd --config webhook.toml --bind 127.0.0.1:8080

agentd: workflow `webhook_receiver` listening on http://127.0.0.1:8080/ (1 routes; drain_timeout=30s)

POST /hooks/github → on_hook

GET /healthz is always live

audit event=workflow.completed last_node=done elapsed_ms=3

$ man agentd $ git clone agentd-dev/source-code

## THE LOOP — SINGULAR, AND YOU WROTE IT

execution model

your workflow.toml ──► validate (build-time + load-time)
                              │
   trigger ───────────────────▼────────────────────────────┐
   (HTTP / cron / fs-watch /  │  ENGINE: walk the DAG      │
    manual --input)           │  one node at a time        │
        ┌─────────────────────┼─────────────────────┐      │
        │ read_file · parse_json · template_render  │      │
        │ llm_infer ◄── bounded reasoning step      │      │
        │ write_file · http_request · call_mcp_tool │      │
        │ switch / condition / fail / terminate     │      │
        └─────────────────────┬─────────────────────┘      │
                              │ policy + budgets + deadline│
                              ▼                            │
                    outcome JSON + execution trace ◄───────┘

## WHY BOUNDED

▸ bounded by construction

The LLM is one node type with a prompt template and a JSON contract. It cannot add nodes, pick edges, or invent tool calls — routing on its output is a switch node you declared.

▸ capabilities are compile-time

Tool families are Cargo features. A build without tools-http cannot make an outbound request — the code is not in the binary. CI proves every canonical feature set.

▸ fail-closed policy

Allowlists per family: fs paths, env keys, URLs, shell commands, MCP tools. Empty sections deny. Optional Rego layers on as a logical AND.

▸ triggers, not prompts

HTTP webhooks (bearer / HMAC / mTLS / OIDC, rate-limited), cron + interval schedules, debounced filesystem watches, or one-shot CLI runs.

▸ signed + traced

ed25519 signatures verified over raw TOML bytes before anything parses trust. Every run yields the exact node path it walked; audit events stream to a redacting JSONL sink.

▸ one small binary

Hand-rolled HTTP/1.1 both directions, no async runtime in the core, ~25 MB distroless image, systemd-hardened unit, deb/rpm packages.

## INSTALL

# one-liner (linux x86_64 / macOS arm64)

$ curl -fsSL https://agentd.dev/install.sh | sh

# or build from source

$ cargo build --release -p agentd

# or a sealed appliance: no outbound http, no shell — the code isn't in the binary

$ cargo build --release -p agentd --no-default-features \

--features "tools-fs,tools-data,trigger-http,auth,server-tls"