AX (Agent Executor)

// Overview

AX, short for Agent Executor, is Google's open-source orchestration platform for running autonomous agent workloads at scale. Its README frames agents as their own kind of workload — neither stateless services nor batch jobs — and gives them isolation, state management and cost controls to match. You describe an agentic task in a manifest, and AX sandboxes it, wires up its workspace, fences its network, and keeps it running. The CLI deliberately mirrors kubectl: `ax apply`, `ax get`, `ax describe` and `ax delete` all behave the way a Kubernetes user expects.

Four declarative primitives carry the whole model. A Task runs untrusted agent code in an isolated sandbox with CPU and memory limits, and can be suspended and resumed to checkpoint its state. A Workspace declares the environment once — Git repositories, MCP servers and skill packages — so tasks start warm instead of each agent rebuilding the same setup. A Gateway defines which listeners a task exposes and restricts outbound traffic to an explicit allowlist of hosts and ports. A Model is a named LLM configuration: provider, model identifier, generation parameters, and credentials held in a Kubernetes secret, so keys can be rotated in one place rather than per agent.

Version 0.3.0, released on 2026-09-20, reorganized the project around three binaries. `ax-server` exposes a gRPC API that accepts Task manifests, `ax-controller` runs as a horizontally scaled reconciler that consumes work from Redis Streams, and `ax-task-runner` executes tasks inside sandboxed workers. Task state moved out of Kubernetes custom resources and into Redis so the system can handle millions of short-lived tasks without straining etcd. That release also removed the legacy Python harness, the ATE client, the SQL event log and the bundled skill examples, and added design, concepts, manifest, networking, runner and sandbox docs plus Kubernetes deploy manifests. Running AX needs a Kubernetes cluster, the `ko` build tool, a container registry and access to the Agent Substrate Control API; the `ax` CLI itself is a single `go install`.

// What it does

• Declarative Task manifests that run untrusted agent code in isolated sandboxes with CPU and memory limits
• Workspace resources that pre-wire Git repos, MCP servers and skill packages so tasks start warm
• Gateway resources that fence outbound traffic to an explicit allowlist of hosts and ports
• Model resources that centralize provider, model id, generation parameters and Kubernetes-secret credentials
• Suspend and resume on a running task to checkpoint its state
• Interactive shell access into a live task with ax ssh, plus ax watch for streaming status
• kubectl-style CLI (apply, get, describe, delete) with multi-cluster support through kubectx
• Three-binary control plane — ax-server (gRPC), ax-controller (Redis Streams reconciler), ax-task-runner (sandboxed workers)

// Getting started

Install the ax CLI with Go, deploy the control plane to a Kubernetes cluster with ko, then apply a task manifest. The repository's examples directory holds ready-to-run manifests.

go install github.com/google/ax/cmd/ax@latest

make deploy AX_IMAGE_REPO=<your-registry>

ax apply -f examples/task.yaml
ax get tasks

ax watch task task123
ax ssh task123 -- ls -la /workspace
ax suspend task task123
ax resume task task123

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Run large fleets of short-lived coding-agent jobs on a cluster without overloading etcd with per-task custom resources
• Give an untrusted agent a sandbox whose outbound network is limited to a named allowlist of hosts and ports
• Define a repository checkout, its MCP servers and its skill packages once as a Workspace, then reuse it across many tasks
• Keep LLM provider credentials in one Kubernetes secret behind a Model resource instead of copying keys into every agent
• Suspend a long-running agent task, inspect its sandbox over ax ssh, and resume it from the checkpoint

// How AX (Agent Executor) compares

AX (Agent Executor) alongside other open-source code sandboxes & isolation tools AI/TLDR tracks, ranked by GitHub stars.