Aeon

Why it's ranked here

Most "autonomous agent" repositories stop at scheduling a prompt. Aeon backs its read-only mode with an operating-system sandbox instead of trusting a coding agent's own tool permissions, since every skill runs unattended and unreviewed, and a skill that writes its own replacement code must pass a dry run against synthetic credentials before its pull request can even open. That is meaningfully more engineering than a cron job wrapping a model call, MIT licensed and built to run inside a repository you fork and own rather than a hosted platform.

What's good

The security writing is unusually honest for this category. It states plainly that a tool allowlist is not a real boundary, since a shell redirection can route around it, and that the actual guarantee is the operating-system sandbox underneath. A circuit breaker trips a skill after three straight failures and probes it again every six hours rather than either burning Actions minutes forever or dying silently. A separate integrity scanner fingerprints each skill's network destinations so one that quietly starts calling a new host after being approved gets caught, without flagging every wording edit as a false alarm.

Tradeoffs

Setup is heavier than it looks: this is a monorepo of separately versioned apps with deliberately mismatched toolchains that must be installed in a fixed order, not one workspace. The blast-radius tags an operator sees before installing a skill pack are documentation only; nothing enforces them. One of the nine supported agent CLIs cannot be restricted by a tool allowlist at all and aborts its whole run on a denied action, leaning entirely on the sandbox layer underneath. Two harnesses report only an estimated token count, and the newest one has not run live against a real credential yet.

How to use it well

This fits an operator who wants a fleet of small background jobs (research digests, dependency and PR triage, on-chain monitoring) running on a schedule they do not babysit, and who is comfortable owning a forked repository and its GitHub Actions minutes rather than a hosted product. Start with the three packs shown by default and the strictest write tier before turning on anything that moves money or opens external accounts; the financial and on-chain skills are real capabilities, not demos, and deserve the same caution as production credentials. It is the wrong tool for someone who wants a single reviewed assistant inside their existing editor.

Observed

License

MIT

Language & packaging

TypeScript across a multi-app repository (dashboard, CLI, MCP server, webhook), each app pinned to its own dependency lockfile rather than a shared workspace; requires Node.js 20 or newer

Interfaces

Command-line tool, an MCP server exposing each skill as a callable tool, a web dashboard, and scheduled GitHub Actions workflows

Read-only sandbox platform support

OS-level write-lock sandbox on Linux and macOS; falls back to advisory (unenforced) elsewhere

Repository structure

No README.md at the repository root; the canonical README is linked from documentation pages in a subdirectory instead

Skill taxonomy

Every skill declares exactly one of six fixed categories, and one of two write-access modes (read-only or write)

Supported agent CLI backends

Nine, unified behind one internal execution contract