The category every agent roundup skipped
The 2026 open-source agent roundups are out, and they're genuinely useful lists: coding agents, browser agents, research agents. Several of them we run in production ourselves. But read the lists closely and there's a category missing, the one that becomes the whole problem the day any of these agents graduates from a demo to a job. Every list ranks what agents can do. None of them rank what agents are allowed to do.
Update · July 16, 2026: the stack has been renamed: warden is now redstamp, canon is now truecopy, keeper is now strongroom, and picket is now fieldpass. The text below uses the new names.
"Open source" tells you about the code, not the behavior
An open-source agent means you can read its source. It does not mean you know:
- which shell command it ran at 3 a.m. while you slept,
- which of the two thousand community skills it just installed was written by someone you'd trust near prod,
- or where your API keys ended up after you pasted them into its environment.
We hit all three questions the honest way: we run an autonomous software studio, agents that ship code, cut releases, audit repos, and file the PRs behind most of what's on this blog. At that volume, "trust the agent" isn't a security posture. So we built the layer the roundups don't cover, and opened it up.
The governance trilogy
redstamp: the firewall. A policy gate between an agent and its tools: every call checked, allowed, or blocked, with a tamper-evident audit trail. It's framework-agnostic, and that's not a slide-deck claim, there are working, governed examples in the repo for CrewAI, LangGraph, the OpenAI Agents SDK, and Microsoft AutoGen, each with its own write-up here: one gate, four frameworks.
truecopy: the supply chain. Agents install "skills" the way laptops install apps, and almost nobody scans them. truecopy does. To prove the point we audited 2,019 skills across the official marketplace and nine community ones: zero poisoned, a dozen risky-but-benign patterns, full methodology in auditing the skills supply chain.
strongroom: the secrets. Agents don't get API keys; they get leases, single-use, expiring, revocable, audited. When an agent goes sideways you revoke a lease, not rotate your whole keychain. The pattern applied to MCP servers: leases, not keys.
And the tools around them
- fieldpass: a governed browser for agents, redstamp's idea, applied to the web.
- deepdive: a research agent that scores its sources before it cites them.
- dario: the Claude Code–compatible proxy that runs our whole fleet, 17,000+ downloads, with a self-healing release pipeline.
All of it public on GitHub under askalf, all of it indexed at ownyourstack.sprayberrylabs.com.
What we don't open-source, on purpose
The orchestration platform that runs our studio, the thing that decides what those agents work on every hour, stays closed. That's the business. The governance layer is open because security tooling shouldn't be a moat: if you run anything from those roundup lists, you need this layer whether or not you ever pay us a dollar.
That's our pitch to the list-makers, too: keep ranking the agents. Then tell your readers what to wrap them in.
House rule: every claim above traces to a public repo, a merged PR, or a published study. If a link 404s, tell me, that's a bug.
redstamp, truecopy, and strongroom are the open-source governance trilogy this studio runs on: a tool firewall, a skills supply-chain scanner, and secrets as leases. Every example, audit, and release in this post is public.
Running agents somewhere that matters? I do fixed-price code audits with the same stance: govern the tools, keep the receipts.