Celln documentation

Give agents a lease, not a machine.

Celln runs agents in isolated cells. Instead of letting them assemble a Linux environment, the host lends verified tools as read-only memory—and can revoke them.

$ celln agent --tool python "decode this base64 and name the file type: R0lGODlhAQABAAAAACw="
  ✔ /usr/bin/python permitted in the agent lane
GIF image

Two digest-pinned tool images are lent into a hardware-isolated cell, each sealed read-only at its own mount. A model writes a program, an attested python is asked to run it and that call is demoted to the agent lane, it runs and returns its answer, and the lend is finally taken back as the cell dissolves.

One sentence: most agent runtimes give an agent a machine; Celln gives it only the tools it needs, for only as long as it needs them.

Start here →

Install Celln, connect the agent CLI you already use, and run two small examples.

Tutorial →

Three worked cells: an agent using python, reaching a named host from a cell with no network, and two independent toolchains at once.

Concepts →

Mote and cell, tool lane and agent lane, and the security boundary they're enforced by — four short pages, in order.