Hullwork builds open, self-hosted infrastructure for AI agents that need to execute code and ship software—not just generate an answer.
An agent is dependable only when its execution boundary and delivery evidence are explicit.
Our public projects cover the path from an agent request to a result you can trust:
agent request → secure execution → verified deployment → observable result
Sandbox — Secure execution for AI agents
Run an agent's shell and file operations inside a dedicated Kubernetes gVisor Pod. The self-hosted control plane manages durable workspaces, tenant-scoped credentials, quotas, checkpoints, and runtime lifecycle—without ever falling back to host execution.
Interfaces: Python SDK · CLI · MCP | Proof: architecture · benchmarks · live project site
Site — Verified website delivery for AI agents
Turn an agent's deployment request into a real Kubernetes workload through HTTP, CLI, or MCP. The control plane handles tenancy, quotas, builds, ingress, observability, and scale-to-zero—then makes a real HTTP request and records the status code and body digest.
Interfaces: HTTP API · CLI · MCP | Proof: architecture · one-command demo · live project site
| Principle | Engineering consequence |
|---|---|
| Boundaries over promises | Untrusted code runs with explicit identity, resource, network, and runtime isolation. |
| Evidence over status labels | A deployment is successful only when the running address has been measured. |
| Fail closed | Missing control-plane or runtime dependencies never become permission to execute on the host. |
| Composable interfaces | HTTP APIs, CLIs, SDKs, and MCP tools keep products useful without hidden coupling. |
| Operator ownership | Workspaces, credentials, state, and deployment infrastructure stay in your environment. |
- Need to execute agent-generated code safely? Start with Sandbox.
- Need to turn a generated site into a verified deployment? Start with Site.
- Evaluating the architecture? Read each repository's explicit known limitations before adopting it.