box0

agent
Security Audit
Warn
Health Pass
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 74 GitHub stars
Code Warn
  • network request — Outbound network request in frontend/src/legacy-dashboard.js
Permissions Pass
  • Permissions — No dangerous permissions requested
Purpose
This tool is an open-source platform for running persistent, collaborative AI subagent teams. It allows you to schedule automated tasks, trigger agents manually or via webhooks, and coordinate workspaces across a team using runtimes like Claude Code or Codex.

Security Assessment
Overall risk: Medium. The tool is designed to route tasks, execute instructions via AI agents, and expose webhooks for external triggers. The automated scan flagged a warning for an outbound network request inside `frontend/src/legacy-dashboard.js`. While this is expected behavior for an application that features Slack notifications and webhook delivery, developers should verify where these network calls are sending data. The tool does not request dangerous permissions and no hardcoded secrets were detected. However, because it acts as a background server coordinating tasks and routing data, you should ensure it is deployed in a controlled environment.

Quality Assessment
The project is actively maintained, with its most recent push happening today. It is licensed under the permissive MIT license, which is excellent for open-source adoption and modification. Community trust is currently low-to-moderate with 74 GitHub stars, indicating it is an early-stage or niche project rather than a widely battle-tested platform. Documentation is clear and includes an onboarding guide for AI agents.

Verdict
Use with caution: it is a well-maintained and properly licensed early-stage tool, but its active network requests and background server architecture mean you should deploy and inspect it in a secure environment.
SUMMARY

Open-Source Platform for Subagents and Agent Teams. Long-running, collaborative, proactive.

README.md

Open-Source Platform for Subagents and Agent Teams.

Slack
npm
license
docs
SKILL.md

Box0 runs multiple AI agents in parallel. You create agents with different roles, trigger them on demand or on a schedule, and collect results. It works with Claude Code and Codex. Single Rust binary, no dependencies.

  • Long-running: agents that persist across sessions and never disappear
  • Collaborative: shared across team members
  • Proactive: cron schedules, webhooks, Slack notifications

Box0 Architecture

Box0 vs Subagents

Box0 Subagents
Setup npm install, one binary Built-in, zero config
Persistence Agents and conversations persist Session only
Scheduling Cron jobs :x:
Notifications Webhooks, Slack, and more :x:
Team sharing Workspaces, multi-user :x:
Dashboard Web UI :x:
Runtime Any agent runtime Claude Code only

How it works

A server coordinates everything. It stores agent definitions, routes tasks, runs the scheduler, and serves a web dashboard. Start one with b0 server (runs in background).

Workspaces organize agents by team. Each user gets a personal workspace.

Agents do the actual work. Each agent has a name, a set of instructions, and a set of triggers. Three trigger types:

  • Manual - trigger on demand with b0 run <name> "<task>".
  • Cron - run on a schedule. Set with b0 add --every 1h --task "...".
  • Webhook - triggered by HTTP POST. Enable with b0 add --webhook.

Your AI (Claude Code or Codex) creates agents with b0 add, runs tasks with b0 run, and can run multiple agents in parallel. You type one prompt. Your agent handles the rest.

Agent onboarding

npx skills add risingwavelabs/skills --skill b0

Or read SKILL.md directly.

Your agent creates workers with b0 add and sends tasks via b0 run. The server stores tasks in an inbox. A daemon polls the inbox, spawns a separate Claude Code (or Codex) process for each worker, and writes the results back. b0 run blocks until the result is ready.

Each worker runs in its own isolated directory.

Agent runs use a 30 minute default execution timeout. This prevents longer workflow steps from failing at the old 5 minute default on first run.

Getting started

Install:

npm install -g @box0/cli@latest

Start the server:

b0 server

On first start, Box0 creates an admin account and prints your API key.

If you want a fixed admin credential for other services, configure it before first start:

# server.toml
admin_name = "service-admin"
admin_key = "b0_service_admin_key"
b0 server --config server.toml

You can also use B0_ADMIN_NAME and B0_ADMIN_KEY. These settings are applied when Box0 bootstraps the initial admin for a new database.

If the server has already been started before, create or update a dedicated admin user explicitly:

b0 admin ensure --db ~/.b0/b0.db --name service-admin --key b0_service_admin_key

This command runs locally against the Box0 database. It can create a separate admin user for integrations without replacing your existing admin account.

Frontend development

The server now prefers frontend/dist when it exists, and falls back to the legacy web/ dashboard otherwise.

For day-to-day frontend development, run Vite separately:

cd frontend
pnpm install
pnpm dev

Vite proxies /workspaces, /machines, and /users to http://127.0.0.1:8080 by default. To point it at a different backend, set B0_FRONTEND_BACKEND_URL.

To let the Rust server serve the Vue app directly, build the frontend first:

cd frontend
pnpm build

3. Teach your agent to use Box0

Teach your agent to use Box0 (how skills work):

npx skills add risingwavelabs/skills --skill b0

Then open Claude Code or Codex and say:

Create three agents: an optimist, a pessimist, and a realist. Ask them to debate whether AI will replace software engineers in 5 years. Give me your own conclusion.

Features

Parallel execution. Run multiple agents at once.

b0 run reviewer "Review this PR for correctness." &
b0 run security "Review this PR for vulnerabilities." &
wait

Cron schedules. Schedule recurring tasks.

b0 add monitor --instructions "Check production logs for errors." --every 6h --task "scan logs"

Webhook triggers. Trigger agents via HTTP POST.

b0 add notifier --instructions "Process alerts." --webhook
b0 info notifier

Slack notifications. Get notified when agents finish.

b0 add alerter --instructions "Triage alerts." --slack "#ops"

See Slack setup for configuration.

Pipe content. Pass files and diffs directly.

git diff | b0 run reviewer "Review this diff."

Web dashboard. Manage agents and view tasks at http://localhost:8080.

CLI reference

b0 server                                              Start server (background)
b0 server stop                                         Stop server
b0 server status                                       Show server status
b0 admin ensure --name <name> --key <key>              Create/update a local admin user
b0 add <name> --instructions "..."                     Create agent
b0 add <name> --instructions "..." --every 1h --task "..." Create scheduled agent
b0 add <name> --instructions "..." --webhook           Create agent with trigger URL
b0 add <name> --instructions "..." --webhook-secret s  Create agent with HMAC secret
b0 ls                                                  List agents
b0 info <name>                                         View agent details and trigger URL
b0 logs <name>                                         View recent task history
b0 update <name> --instructions "..."                  Update agent instructions
b0 rm <name>                                           Delete agent
b0 run <agent> "<task>"                                Trigger agent and wait for result
b0 run <agent> "<task>" --timeout 600                  Trigger with custom timeout (seconds)

Learn more

Web dashboard

Open your browser to the server URL (default http://localhost:8080) and log in with your API key. Manage workers, view tasks, monitor nodes, and manage your team from the UI.

License

MIT License. Copyright (c) 2026 RisingWave Labs.

Reviews (0)

No results found