Put your agents to work on infrastructure you own.
fleet is an open platform for running AI agents. Scheduled or interactive — any model. Sandboxed, on a budget, connected to your data, and never holding your keys. You stay at the helm.
Everyone's piloting agents. Almost no one trusts them with real work.
The blocker was never whether an agent can draft a report or pull a number, it's whether you'd turn one loose on your systems, your data, and your budget unsupervised. Let an agent work on its own and one thing decides everything: whether you can trust it.
Three questions stand between trying agents and trusting them. fleet answers all three.
Can it do the job — every time?
An agent that works once but can't be repeated isn't something you can lean on. fleet makes a working setup repeatable and lets you watch it work.
- Saves the setup that worked: prompt, tools, guardrails
- Re-runs it identically — for anyone, on any schedule
- You watch each step live, not a black-box result
Should I trust it with this?
Trust isn't a leap of faith. It's known limits going in and a full record coming out, so a run can't surprise you on cost or hide what it did.
- Hard cost and time ceilings that actually fire
- A runaway agent costs one capped task, not an open invoice
- Every action logged: what it did, what it cost
Am I comfortable giving up control?
You're not handing over control — you're defining it. You draw the lines on what an agent can reach and how far any mistake can spread.
- You set what each agent can touch, create, and reach
- A contained blast radius if something goes wrong
- Keyless by design and pauses for a human on anything sensitive
What you get with fleet.
Your infrastructure, your data, your rules — not someone else's cloud.
Pick the best for each task and swap anytime.
Hard cost and token limits per task, enforced as the agent works.
Connects to the tools and data you already use without ever holding your credentials.
Turn your team's best agent recipes into reusable, shareable workflows with a built-in eval harness so changes can't quietly break them.
MIT-licensed, with a full trace of every action and its cost. Proof, not promises.
Run Victoria, the agent we built ourselves, or we'll help you stand up your own. The choice is yours.
We play nice with others.
fleet doesn't lock you into anyone — including us. Run models from every major lab, and switch the moment a better one ships. Connect the tools and agents you already use through MCP and agent connectors — from open-source servers to the Palantir Ontology. Your prompts, your guardrails, your data: standardized once, portable everywhere.
Victoria, the flagship agent we run our own business on, is proof of the idea — not the limit of it. Build your fleet from whatever agents you need.
We didn't set out to build a platform.
We built Victoria, an AI agent for the hard part of programmatic ad ops: diagnosing what's working, spotting what isn't, and recommending the trades to make. She worked so well that the platform we'd built to run her safely turned out to be a valuable thing. Sandboxed, cost-capped, and wired into live data.
So we're sharing it. It's not a demo, it's how we operate. Victoria is the flagship of a fleet you can build to fit.
Proven in production, not in a pitch.
Sandboxed, brokered, gated, logged.
Isolated execution, brokered secrets, human approval gates, and a full audit trail — built in. Open source, on your own infrastructure.
Every tool call runs in an ephemeral rootless-Podman container under host-enforced CPU/memory/PID caps. No fast path skips it. Need a harder wall? One config line upgrades every tool call to a dedicated KVM microVM (Kata or libkrun) — escape then takes a hypervisor CVE, not a container break-out, and the runtime is verified fail-closed at boot.
Secrets inject only for the call that needs them — never in the sandbox, the model's context, or the logs. The agent never holds your keys.
Cost, token, iteration, and timeout limits, enforced. A runaway loop is a capped turn, not an open invoice.
Sensitive actions block on an allow/deny gate (default-deny, no "approve all"); scheduled runs are network-sealed and verified before they finish.
Every tool call, result, token, and cost streamed live over SSE and persisted per turn. Judge the work from the trace.
Backends bind loopback-only behind your TLS, with optional IP allow/deny lists. Your data stays in your own Postgres.
Everything above is yours. The head start is us.
fleet is MIT-licensed and complete on its own. Your prompts, playbooks, and connectors live in a plain git repo you own, portable over open protocols. An Elcano engagement adds the parts that are yours alone: custom connectors, production workflows, and engineers who deploy forward.
See what your team could hand off.
Tell us what's on your plate and we'll show you where fleet fits.
- Runs on infrastructure you own.
- Hard cost caps on every task.
- Never holds your keys.
- Full trace of every action and cost.