DEPLOYMENT EVIDENCE REPOSITORY

Open-Source Agent Deployment Evidence Index

We document architectural observations and concrete control boundaries for open-source agent frameworks: permission models, tool execution blast radius, prompt injection resilience, state idempotency, and operational observability.

⚠️ Point-in-Time Architectural Scope Notice

The evaluations below are point-in-time architectural observations conducted strictly on specific pinned repository versions. They reflect framework-level architectural defaults and do not constitute universal security warranties or production approvals for current upstream releases. Operational safety always depends on your specific tool sandbox, permission boundaries, and state constraints.

Evidence Status:

Aider

(v0.75.1 (commit a73836c))

Constrained Evaluation

Command-line AI pair programming agent integrating directly with local Git repositories for iterative code editing.

Profile Scope: Git auto-commits can provide an auditable file-edit recovery point when enabled, but direct workspace and shell access require external isolation and change limits.

Pair Programming Git Native Software Engineering CLI Agent Controlled Writes

Reviewed Oct 1, 2026 Revalidate by Dec 30, 2026 GitHub ↗

View Evidence Profile →

AutoGPT

(autogpt-v0.5.1 (commit 26324f2))

Constrained Evaluation

Classic autonomous agent for iterative goal pursuit with human-controlled execution modes.

Profile Scope: Default one-command authorization, workspace restriction, and disabled host shell execution provide useful boundaries; continuous mode, browser content, plugins, credentials, and external side effects still require deployment controls.

Autonomous Agent Human Authorization Workspace Boundary Research Tool

Reviewed Oct 1, 2026 Revalidate by Dec 30, 2026 GitHub ↗

View Evidence Profile →

CrewAI

(0.80.0 (commit 4ca785e))

Constrained Evaluation

Framework for orchestrating role-based AI agents in collaborative workflows.

Profile Scope: Agent iteration limits and optional Docker-backed code execution provide bounded mechanisms, but custom tools, delegated context, telemetry ownership, and side-effect recovery remain deployment responsibilities.

Workflow Orchestration Multi-Agent Python Runtime Role-Based Agents

Reviewed Oct 1, 2026 Revalidate by Dec 30, 2026 GitHub ↗

View Evidence Profile →

Dify

(0.12.0 (commit 625aace))

Constrained Evaluation

Platform combining visual LLM orchestration, RAG pipelines, and agent tools.

Profile Scope: A separate code sandbox and workflow execution ceilings provide bounded controls, while tool permissions, prompt trust, credentials, and recovery of external writes remain deployment responsibilities.

Visual Workflow Code Sandbox RAG & Agents Self-Hosted

Reviewed Oct 1, 2026 Revalidate by Dec 30, 2026 GitHub ↗

View Evidence Profile →

LangGraph

(0.2.28 (commit f05b546))

Constrained Evaluation

Library for building stateful, multi-actor applications with LLMs using cyclical graph runtimes.

Profile Scope: The graph runtime offers configurable checkpointers and recursion limits; tool isolation, validation, and compensation for external effects remain deployment responsibilities.

Graph State Machine Durable Checkpointing Human-in-the-Loop State Management

Reviewed Oct 1, 2026 Revalidate by Dec 30, 2026 GitHub ↗

View Evidence Profile →

OpenHands

(0.9.0 (commit fc5f026))

Constrained Evaluation

Autonomous software engineering agent capable of shell execution and pull request authoring.

Profile Scope: The default Docker runtime and iteration ceiling bound part of execution, but writable workspace, command, network, and credential controls remain deployment responsibilities.

Software Engineering Docker Sandboxed Bash Execution GitHub Integration

Reviewed Oct 1, 2026 Revalidate by Dec 30, 2026 GitHub ↗

View Evidence Profile →

SWE-agent

(v1.0.1 (commit 6aff215))

Constrained Evaluation

Software engineering agent utilizing an Agent-Computer Interface (ACI) to resolve GitHub issues in sandboxed execution environments.

Profile Scope: Structured ACI commands improve model interaction, but default Bash and writable task checkouts still require egress, credential, diff, and human-review controls.

GitHub Issue Resolver Docker Sandboxed ACI Interface Software Engineering Controlled Writes

Reviewed Oct 1, 2026 Revalidate by Dec 30, 2026 GitHub ↗

View Evidence Profile →

Auditing a proprietary or customized agent?

If your engineering team is deploying internal agents with database write authority or customer data access, get an independent Launch Gate architectural review and failure-mode analysis before production.

Request Launch Gate Review