Comprehensive documentation for SILO — the Secure AI Agent Sandbox Orchestrator.
SILO is a self-hosted security platform that sits between your operating system and AI agents. It lets you run powerful, autonomous agents — like CrewAI, LangGraph, Aider, OpenClaw, or your own custom framework — inside hardened Docker containers where they have full coding capabilities but zero access to your API keys, no unrestricted internet, and every action audited.
The core idea: Your agent doesn't know it's sandboxed. Standard http_proxy environment variables and a transparent inference proxy mean any HTTP-based agent works inside SILO with zero code modifications.
- Run any agent framework securely — CrewAI, LangGraph, Aider, SWE-Agent, OpenClaw, or your own
- API keys never enter the container — the proxy injects credentials at request time
- Deny-all networking by default — agents can only reach hosts you explicitly allow
- Interactive interception — approve or deny live outbound requests from the agent in real-time
- Unified audit trail — every LLM call, tool invocation, framework trace, and egress request logged
- Framework trace collection — agent lifecycle events (start/end, tool calls, delegation) in one timeline
- Multi-agent support — run multiple isolated agents sharing a single proxy
- Built-in agent runner — quick
silo run "task"for simple use cases - Snapshots — save and restore container state
- One-command setup —
silo quickstartgets you from zero to sandbox
| Document | Description |
|---|---|
| Getting Started | Prerequisites, installation, and your first sandbox run |
| Running External Agents | Run CrewAI, LangGraph, Aider, and custom agents in SILO |
| Capability Profiles | Design note on --desktop, --mount, and sandboxed browser mode |
| Document | Description |
|---|---|
| Integration Patterns | Framework-specific integration: Python, Node.js, LangChain, Anthropic, Ollama |
| Integrations (APIs) | Connect agents to Slack, GitHub, HubSpot, etc. — credential-managed API gateways |
| Agent Runner | The built-in silo run LLM tool-calling loop for quick tasks |
| Multi-Agent | Running multiple isolated agents simultaneously |
| Document | Description |
|---|---|
| Security Model | Defence-in-depth layers, threat model, and hardening details |
| Policy Engine | YAML policy format, evaluation semantics, presets, and hot-reload |
| Proxy & Networking | Inference proxy internals, credential injection, CONNECT tunnels |
| Document | Description |
|---|---|
| CLI Reference | Complete reference for every command, flag, and option |
| Architecture | System design, layer model, data flow, and component relationships |
| Audit & Logging | Unified JSONL audit trail, traces, tool calls, log rotation, and forensics |
| Configuration | Config schema, storage locations, and environment variables |
| Development | Setting up the dev environment, testing, and building |
| Troubleshooting | Common issues and their solutions |
- First time? → Getting Started
- Running your own agent? → Running External Agents
- Need browser/local-file capability details? → Capability Profiles
- Need a framework example? → Integration Patterns
- Need a command? → CLI Reference
- Security questions? → Security Model
- Writing custom policies? → Policy Engine
- Contributing? → Development
- Connecting to APIs? → Integrations
SILO v0.2.0