# Agent Substrate

A secure-by-default agent execution runtime engineered to run millions of sandboxes with 10x higher density than standard container runtimes.

Source: https://wheredoirunthis.com/products/agent-substrate · JSON: https://wheredoirunthis.com/api/products/agent-substrate · Read on 2026-09-25

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Kata / gVisor
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: No
- Regions: Not disclosed
- Coverage: 10 of 55 assessed capabilities supported · 6 not assessed
- Agent readiness: read 4.5 of 7 signals, drive 5 of 9 signals

## Links

- Homepage: https://github.com/agent-substrate/substrate
- Docs: https://github.com/agent-substrate/substrate/blob/main/README.md#documentation--guides
- Repository: https://github.com/agent-substrate/substrate

## Runtime

- **GPU & accelerators**: none (device passthrough temporarily removed) — "'Substrate does not pass devices through to actors.'" [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) (confidence: high)
- **BYOC (Bring your own cloud)**: na
- **Secrets management**: Credential injection at the egress gateway (MITM with a projected trust bundle) resolving ate-secret:// references from Kubernetes Secrets, with a default-deny atespace→namespace policy; per-actor SPIFFE certs and JWTs via the ActorIdentity service. — "'An egress credential injector (#1360), plus an example credential provider that reads Kubernetes Secrets' + manifests/egress-credential-injection/namespace-policy.yaml." [source](https://github.com/agent-substrate/substrate/releases/tag/v0.2.0) (confidence: high)
- **Storage options**: Snapshots in GCS (S3-compatible via rustfs in the kind install); per-actor CSI external volumes provisioned from the ActorTemplate (no PV/PVC objects). Filestore agent volumes (NFS, RWX) optional on GKE. — "'External volumes are declaratively defined in the ActorTemplate via externalVolumeTemplate and provisioned dynamically for each actor instance.'" [source](https://github.com/agent-substrate/substrate/blob/main/docs/csi-volumes.md) (confidence: high)
- **Supported workloads**: stateful AI agents (ADK, LangChain), coding agents (Claude Code, Codex, Antigravity), ephemeral sandboxes for untrusted LLM-generated code, sandboxed MCP servers, RL rollouts and agent benchmarks, stateful services — "README 'Framework Agnostic & Compatibility' + GKE docs 'Use cases' + GKE blog 'reinforcement learning rollouts'." [source](https://github.com/agent-substrate/substrate/blob/main/README.md) (confidence: high)
- **Persistence**: Actor RAM + root filesystem are snapshotted to object storage on suspend and restored on resume (possibly on another worker); CSI external volumes persist separately and are not part of snapshots. An evicted actor gets 30 minutes to suspend, otherwise work since the last snapshot is lost. — "'External volumes are not reverted. Their contents are never part of a snapshot' and 'an actor that runs for more than 30 minutes without a suspend can lose data.'" [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) (confidence: high)
- **Data jurisdiction**: na
- **Resource limits & quotas**: Per-actor CPU/memory right-sizing in the ActorTemplate; worker pools sized by the operator (HPA supported). Design claims: millions of sandboxes per cluster, sub-500ms resume, 500+ suspend/resume per second, 30x oversubscription. 30-minute eviction grace period. IPv4-only actor networking. — "Vendor performance claims from the README and GKE blog; not independently verified." [source](https://github.com/agent-substrate/substrate/blob/main/README.md) (confidence: medium)
- **SDK languages**: go — "Go protobuf/gRPC types in-repo; gRPC means any language can generate a client, but no other official SDK is published." [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) (confidence: medium)
- **Network & egress controls**: All actor TCP egress except DNS is tunnelled (mTLS CONNECT) to an egress policy enforcement point; only HTTP(S) 1.1/2 is allowed, WebSocket/CONNECT/other TCP and non-DNS UDP are blocked. Since v0.2.0 a per-actor EgressPolicy (hostname and CIDR rules) is enforced default-deny. Not supported on GKE's build yet. — "'Actor TCP egress (except DNS traffic on port 53) is redirected to atunnel, which opens a CONNECT tunnel to the egress gateway. Egress gateway applies policy.' + v0.2.0: 'An actor without a policy has no egress'." [source](https://github.com/agent-substrate/substrate/blob/main/docs/egress-traffic.md) (confidence: high)
- **Snapshots & forks**: Suspend/resume full-state snapshots (sub-500ms resume claimed), RevertActor to the last snapshot, tags (atespace-scoped or PUBLISHED) and new actors seeded from a tag; golden snapshots per ActorTemplate. — "`kubectl ate create tag ... --actor`, `kubectl ate create actor ... --tag <tag-name>`, `kubectl ate revert actor`." [source](https://github.com/agent-substrate/substrate/blob/main/cmd/kubectl-ate/README.md) (confidence: high)
- **Deployment methods**: cli, api — "`kubectl ate create actor-template -f template.yaml` and the ateapi.Control gRPC service; WorkerPools are Kubernetes CRDs." [source](https://github.com/agent-substrate/substrate/blob/main/cmd/kubectl-ate/README.md) (confidence: high)
- **Isolation**: Kata / gVisor — "GKE docs: 'Agent Substrate uses gVisor or Cloud Hypervisor to run each workload in a sandbox that isolates the application code from the host kernel.' api-guide: a `microvm` SandboxConfig supplies Kata Containers + Cloud Hypervisor; `gvisor-default` is the shipped SandboxConfig. v0.2.0 allows more than one actor per worker, each in its own sandbox and network namespace." [source](https://docs.cloud.google.com/kubernetes-engine/ai-ml/about-agent-substrate) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Not supported | "Repo .agents/skills/ holds contributor dev skills (triage-issues, review-crds); no user-facing skills for operating Substrate." [source](https://github.com/agent-substrate/substrate) |
| AI app builder | Not supported | "No prompt-to-app surface." [source](https://github.com/agent-substrate/substrate) |
| Autonomous QA agent | Not supported | "No QA agent." [source](https://github.com/agent-substrate/substrate) |
| Built-in coding agent | Not supported | "It is not an SDK for building agents, but rather a system for running them at scale." [source](https://github.com/agent-substrate/substrate/blob/main/README.md) |
| BYOK for LLMs | Not applicable | "It is not an SDK for building agents, but rather a system for running them at scale." [source](https://github.com/agent-substrate/substrate/blob/main/README.md) |
| Credential-injection proxy | Supported | "An egress credential injector (#1360), plus an example credential provider that reads Kubernetes Secrets (#1335, #1811)." [source](https://github.com/agent-substrate/substrate/releases/tag/v0.2.0) |
| LLM gateway | Not supported | "No model routing or LLM gateway; agents bring their own model access (the Claude Code demo takes ANTHROPIC_API_KEY)." [source](https://github.com/agent-substrate/substrate) |
| MCP client | Not applicable | "It is not an SDK for building agents, but rather a system for running them at scale." [source](https://github.com/agent-substrate/substrate/blob/main/README.md) |
| MCP-server hosting | Partially supported | "Model Context Protocol (MCP): Support for deploying secure, sandboxed MCP servers as Substrate Actors to provide durable tools for any model." [source](https://github.com/agent-substrate/substrate/blob/main/README.md) |
| MCP server | Partially supported | "The API exposes a streamable MCP endpoint at `POST /v1alpha/envs/{id}/mcp` serving built-in tools." [source](https://github.com/agent-substrate/env) |
| Model inference API (first-party) | Not supported | "No inference API." [source](https://github.com/agent-substrate/substrate) |
| Preinstalled coding agent | Not assessed |  |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not applicable | "A higher-order system reaches an actor through the **Substrate Router** by setting `ate-target-actor` to `<atespace>/<actor>`." [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) |
| Custom domains | Not applicable | "Browser-based and other fixed clients must therefore connect through a user-controlled reverse proxy or policy enforcement point that overwrites the routing header" [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) |
| Direct public IPv6 | Not supported | "Actor networking is currently IPv4-only." [source](https://github.com/agent-substrate/substrate/blob/main/docs/network-egress.md) |
| Edge KV store | Not applicable | "Not an edge runtime." [source](https://github.com/agent-substrate/substrate) |
| Egress controls | Supported | "The egress gateway now enforces `EgressPolicy`. An actor without a policy has no egress, and traffic that no rule allows is denied. (#1545)" [source](https://github.com/agent-substrate/substrate/releases/tag/v0.2.0) |
| Email send / receive | Not supported | "No email primitive in the README, docs or gRPC API." [source](https://github.com/agent-substrate/substrate) |
| Public preview URLs | Not applicable | "This value selects the Actor; `Host` and HTTP/2 `:authority` remain application metadata." [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) |
| Private networking | Partially supported | "Each actor sandbox gets its own network namespace. (#1689)" [source](https://github.com/agent-substrate/substrate/releases/tag/v0.2.0) |
| Built-in reverse proxy | Supported | "When a request arrives for a suspended actor, the router resumes it before routing" [source](https://github.com/agent-substrate/substrate/blob/main/docs/request-parking.md) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "Authorization and RBAC are not implemented yet, so only configure providers whose users should have full control of the entire control plane" [source](https://github.com/agent-substrate/substrate/blob/main/docs/authentication.md) |
| BYOC | Not applicable | "Agent Substrate is an open source system that you deploy directly onto your own GKE Standard clusters." [source](https://docs.cloud.google.com/kubernetes-engine/ai-ml/about-agent-substrate) |
| Deploy into customers' VPCs | Not assessed |  |
| Secrets management | Partially supported | "An egress credential injector (#1360), plus an example credential provider that reads Kubernetes Secrets (#1335, #1811)." [source](https://github.com/agent-substrate/substrate/releases/tag/v0.2.0) |
| Self-host / OSS core | Supported | "Apache License 2.0" [source](https://github.com/agent-substrate/substrate/blob/main/LICENSE) |
| Sharing | Not supported | "No share-by-link; actors are reached through the router with a header." [source](https://github.com/agent-substrate/substrate) |
| SSO / SAML | Not supported | "`ate-api` accepts mTLS client certificates and bearer JWTs." [source](https://github.com/agent-substrate/substrate/blob/main/docs/authentication.md) |
| Teams | Not supported | "Groundwork for authorization: an OpenFGA model for atespaces, served from the API server. Checks are not enforced yet." [source](https://github.com/agent-substrate/substrate/releases/tag/v0.2.0) |
| Workload identity | Not assessed |  |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "Install as a native `kubectl` Plugin" [source](https://github.com/agent-substrate/substrate/blob/main/cmd/kubectl-ate/README.md) |
| E2B-compatible API | Not assessed |  |
| Filesystem API | Partially supported | "The daemon server running inside each actor serving command executions, file read/write, and built-in MCP tools." [source](https://github.com/agent-substrate/env) |
| Git deploy | Not supported | "No git-push deploy; ActorTemplates reference OCI images." [source](https://github.com/agent-substrate/substrate) |
| HTTP data API | Not applicable | "Not a data layer." [source](https://github.com/agent-substrate/substrate) |
| OpenAPI spec | Not supported | "The Substrate Control Plane (`ate-api-server`) exposes a gRPC interface" [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) |
| Private container registry | Not supported | "Image-pull credentials" [source](https://github.com/agent-substrate/substrate/blob/main/docs/roadmap.md) |
| Public API | Supported | "### Service: `ateapi.Control` ... CreateActor ... ResumeActor ... SuspendActor ... RevertActor ... DeleteActor" [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) |
| SDK | Partially supported | "`clients/go` — The Go client library ... `clients/python` — The async Python client library" [source](https://github.com/agent-substrate/env) |
| SSH access | Partially supported | "CLI for managing environments, executing remote commands, and performing file I/O." [source](https://github.com/agent-substrate/env) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not applicable | "ActorTemplate: The Workload Blueprint" [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) |
| Desktop / computer-use sandbox | Not supported | "No desktop/GUI sandbox." [source](https://github.com/agent-substrate/substrate) |
| GPU compute | Not supported | "Devices (GPUs) — temporarily unsupported. Substrate does not pass devices through to actors." [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) |
| Live-state (memory) snapshots | Not assessed |  |
| Multi-region | Not supported | "Ability to run multiple substrates in a single cluster" [source](https://github.com/agent-substrate/substrate/blob/main/docs/roadmap.md) |
| Object storage | Not supported | "The `atelet` streams snapshots to and from GCS/S3" [source](https://github.com/agent-substrate/substrate/blob/main/docs/architecture.md) |
| Persistent disk | Supported | "Persistent working memory (volatile RAM) and filesystem state preserved perfectly across hibernation cycles via full-state snapshots." [source](https://github.com/agent-substrate/substrate/blob/main/README.md) |
| Sandbox templates / custom images | Supported | "When an `ActorTemplate` is created: 1. Substrate creates and resumes a temporary golden actor ... 3. It creates a published tag named after the template UID" [source](https://github.com/agent-substrate/substrate/blob/main/docs/api-guide.md) |
| Scale to zero | Partially supported | "Eventually, the user (or the higher-level system) is done with the actor, or it has been idle for a while. It can request the Agent Substrate to suspend the actor, taking a snapshot and freeing up the worker. The next time a request comes in for that actor, it will be resumed again" [source](https://github.com/agent-substrate/substrate/blob/main/docs/architecture.md) |
| Selectable isolation runtime | Not assessed |  |
| Snapshots / forking | Supported | "kubectl ate create tag <tag-name> -a <atespace> --actor <actor-name> [--scope published] ... kubectl ate create actor <actor-name> -a <atespace> --template <template-name> --tag <tag-name>" [source](https://github.com/agent-substrate/substrate/blob/main/cmd/kubectl-ate/README.md) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "Not a data layer." [source](https://github.com/agent-substrate/substrate) |
| Ephemeral instant DB (no-signup) | Not applicable | "Not a data layer." [source](https://github.com/agent-substrate/substrate) |
| First-party database | Not applicable | "they live in the Substrate control plane's PostgreSQL database" [source](https://github.com/agent-substrate/substrate/blob/main/cmd/kubectl-ate/README.md) |
| Vector search | Not applicable | "Not a data layer." [source](https://github.com/agent-substrate/substrate) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not applicable | "Not a CI runner product." [source](https://github.com/agent-substrate/substrate) |
| Built-in observability | Supported | "Actor Observability in Agent Substrate ... Logging ... Metrics ... Joining Logs to Traces" [source](https://github.com/agent-substrate/substrate/blob/main/docs/observability.md) |
| Preview environments | Not applicable | "Not a deploy platform; no per-PR environment concept." [source](https://github.com/agent-substrate/substrate) |
| Scheduled tasks | Not supported | "No schedule/cron primitive in the API." [source](https://github.com/agent-substrate/substrate) |
| Project template marketplace | Not supported | "We provide several sample applications demonstrating Agent Substrate's capabilities" [source](https://github.com/agent-substrate/substrate/blob/main/README.md) |
| Durable workflows | Not supported | "ateapi gRPC + workflows" [source](https://github.com/agent-substrate/substrate/blob/main/docs/architecture.md) |

## Agent readiness

### Read: 4.5 of 7 signals present

4.5/7 signals (4 full, 1 partial; 4 na): no own site, so the surface is GitHub markdown docs — clean and linked, but no llms.txt

- Llms txt: fail — "No llms.txt: no own site; learn.agentsubstrate.dev/llms.txt → 404"
- Llms full txt: fail — "No llms-full.txt anywhere (learn.agentsubstrate.dev/llms-full.txt → 404)"
- Robots AI policy: na — "No own marketing apex (ate.dev redirects to GitHub)"
- JSON LD: na — "No own site"
- Sitemap: na — "No own marketing apex"
- Meta quality: partial — "GitHub repo description 'Agent Substrate: the core system' (thin); no topics set; GKE docs page carries full metadata"
- Markdown negotiation: pass — "README + docs/*.md are native markdown, raw-fetchable from raw.githubusercontent.com (HTTP 200)"
- Content efficiency: pass — "Markdown repo docs; no JS shell"
- Docs discoverable: pass — "README 'Documentation & Guides' links architecture, API guide, CLI, glossary, observability, auth, egress, threat model, roadmap"
- Pricing machine readable: na — "No pricing (oss-tool, self-host)"
- Anti bot: pass — "GitHub + Google docs fetched with no challenge"

### Drive: 5 of 9 signals present

5/9 signals (3 full, 4 partial; 2 na): documented gRPC API, auth docs and an official kubectl plugin; Go-only client, no OpenAPI; MCP and shell only via the env add-on

- Public API: pass — "docs/api-guide.md §6: ateapi.Control gRPC (Create/Update/Resume/Suspend/Revert/Delete/Get/List) + §7 ActorIdentity"
- Openapi spec: fail — "gRPC/protobuf only; no OpenAPI"
- MCP server: partial — "No MCP server for the core control plane; the first-party agent-substrate/env add-on (alpha) documents a per-environment MCP endpoint (POST /v1alpha/envs/{id}/mcp) with exec/file tools"
- SDK packages: partial — "Core: Go types in-repo only; the separate env add-on adds Go + Python clients (not for the core API)"
- Auth docs: pass — "docs/authentication.md: mTLS client certs + bearer JWT providers config; ActorIdentity MintJWT/MintCert caller rules"
- Agent self serve creds: na — "Self-hosted: there is no vendor-issued credential to obtain"
- Webhooks: fail — "No webhooks; lifecycle events are emitted over OTLP"
- CLI tool: pass — "Official kubectl-ate plugin"
- Error model: partial — "gRPC status codes documented per RPC (INVALID_ARGUMENT, ABORTED, FAILED_PRECONDITION, PERMISSION_DENIED), no general error-model doc"
- Rate limit docs: na — "Self-hosted API with no vendor-imposed rate limits"
- Agent config: partial — "AGENTS.md (+ CLAUDE.md) at the repo root and .agents/skills/, but aimed at contributors to Substrate, not at agents operating it; no /.well-known/agent"

## Coding harnesses

- Claude Code (Anthropic) — "A demo of three Claude-Code-driven agents sharing two Agent Substrate pods." [source](https://github.com/agent-substrate/substrate/blob/main/demos/claude-code-multiplex/README.md)
- Codex CLI (OpenAI) — "Claude Code, CodeX, and Antigravity: Support for high-density, stateful coding environments that preserve system state and filesystem state across sessions." [source](https://github.com/agent-substrate/substrate/blob/main/README.md)
- Hermes Agent (Nous Research) — "Nous Research, the team behind the Hermes Agent, is actively building on top of Agent Substrate." [source](https://cloud.google.com/blog/products/containers-kubernetes/agent-substrate-available-on-gke)

## Open source

- Repository: https://github.com/agent-substrate/substrate
- License: Apache-2.0
- Stars: 3802
- Forks: 443
- Self-host methods: kubernetes, source-build
- Self-host dependencies: kubernetes, postgres, object-storage

## Company & presence

- Headquarters: Mountain View, CA, USA (Google)
- Founded: 2026
- GitHub: https://github.com/agent-substrate/substrate
- ate-dev Google Group: https://groups.google.com/g/ate-dev
- CNCF Slack (#substrate-users, #substrate-dev): https://cloud-native.slack.com/archives/C0B6RCAJULW
- YouTube (agent-substrate): https://www.youtube.com/channel/UCN9PPqlTtVxlcpbQ-NWpfZQ
- Weekly community meeting: https://docs.google.com/document/d/1obSIvfcafLNniLYTQCcT2eCgxHqa2AQ3Ga7YTsju49s
- Learn Agent Substrate atlas: https://learn.agentsubstrate.dev/
- Google Cloud (GKE) docs: https://docs.cloud.google.com/kubernetes-engine/ai-ml/about-agent-substrate

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)
- [AWS Lambda MicroVMs](/products/lambda-microvms.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.