Lever

Lever Autonomous AI agents in a sealed jail.

Lever seals your agents inside a jail with no path to your host, your secrets, or your network. A host-side broker then grants and gates every capability they get: which tools, which operations, which credentials.

Get started
Why Lever
Lever

Containment, not trust

Scion, the container runtime, and every agent run inside one isolated machine with rootless podman and an egress allowlist. Host secrets and the LAN simply aren’t reachable; the broker stays host-side, outside the jail.

The key never lands in the container

By default the broker holds the real model key and injects it host-side; agents carry only a scoped, identity-bound, revocable capability token. A compromised agent leaks nothing reusable.

Per-agent capability gating

Each agent reaches MCP tools through a broker that enforces, per verified identity, which tools and operations it may use, with request constraints pinned at mint time.

Lever runs fleets of coding agents under containment. It wraps Scion, Google’s container-based agent orchestrator, in a containment-and-credential boundary: Scion and every agent it runs (via rootless podman) live inside one isolated VM with no host filesystem access, no ambient authority, and an egress allowlist. A capability broker stays on the host, outside the jail, and mediates everything that crosses it (the agents’ credentials, their tool calls, and Scion’s hub calls), so the real model key never lands in a container; egress: closed seals the jail to the broker alone.

A fleet is a manager agent with the whole project tree as its workspace and broker-granted authority to orchestrate the others, plus worker agents each confined to a subtree with narrower tool grants.

Platforms: macOS on Apple Silicon with OrbStack, or Lima (macOS vz, Linux QEMU/KVM; Lima >= 2.0.0, checked at bring-up). The Linux/Lima path is validated end-to-end. On Lima, lever stop -> up starts a fresh manager conversation, and remote: requires the orbstack backend (rejected at config load otherwise).

Prebuilt lever binaries ship per release (darwin/linux, amd64/arm64). A Go 1.26+ toolchain is required at runtime with scion.version/scion.source (Scion is compiled at lever apply); scion.binary needs none. The agent image is built locally with Docker. See install.