# AX (Agent Executor)

Declare an agentic task. AX runs it at scale.

Source: https://wheredoirunthis.com/products/ax · JSON: https://wheredoirunthis.com/api/products/ax · Read on 2026-09-25

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Kata / gVisor
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: No
- Regions: Not disclosed
- Coverage: 8 of 55 assessed capabilities supported · 6 not assessed
- Agent readiness: read 4 of 10 signals, drive 2.5 of 9 signals

## Links

- Homepage: https://agentexecutor.io/
- Docs: https://agentexecutor.io/docs/
- Repository: https://github.com/google/ax

## Runtime

- **GPU & accelerators**: none documented — "Task resources expose cpu and memory only." [source](https://github.com/google/ax/blob/main/docs/manifests.md) (confidence: medium)
- **BYOC (Bring your own cloud)**: na
- **Secrets management**: Model API keys come from Kubernetes Secrets referenced by the Model resource. Task env is literal key/value. Credential injection at egress is a Substrate capability, no longer configurable through AX. — "kubectl create secret generic gemini-api-secret ... secretKey: name: gemini-api-secret key: GEMINI_API_KEY" [source](https://github.com/google/ax/blob/main/docs/manifests.md) (confidence: high)
- **Storage options**: Workspaces are materialized inside the sandbox at /workspace/<name> (git clones, MCP config, skills). No attachable volumes documented in AX. — "'Each entry is set up independently at its own path, in order. ... without a path it lands at /workspace/<name>'" [source](https://github.com/google/ax/blob/main/docs/manifests.md) (confidence: high)
- **Supported workloads**: interactive coding agents, long-running agent servers, Jupyter notebooks, headless browser testing, custom tool runtimes, RL trajectory collection and large-scale agent evals — "'Run anything and everything' and 'Perfect match for researchers: Spin up massive number of reproducible sandboxes to collect trajectories, run reinforcement learning loops, and evaluate agents at scale.'" [source](https://agentexecutor.io/) (confidence: high)
- **Persistence**: Per-task state (memory + filesystem) is checkpointed by Agent Substrate to object storage on suspend and restored on resume; it lasts until `ax delete`. AX control-plane state lives in Redis. — "Substrate: 'Persistent working memory (volatile RAM) and filesystem state preserved perfectly across hibernation cycles via full-state snapshots.' Homepage demo: touch notes.txt → suspend → resume → notes.txt present." [source](https://github.com/agent-substrate/substrate) (confidence: high)
- **Data jurisdiction**: na
- **Resource limits & quotas**: Per-task CPU/memory requests and limits. Workspace goal bootstrap times out after 10 minutes by default (AX_BOOTSTRAP_TIMEOUT). Token/timeout budgets are roadmap. Scale ceiling is the operator's cluster ('billions of tasks per cluster' is a design claim). — "'The agent needs GEMINI_API_KEY in the container and gets 10 minutes by default; set AX_BOOTSTRAP_TIMEOUT to a Go duration to change that.'" [source](https://github.com/google/ax/blob/main/docs/sandbox.md) (confidence: high)
- **SDK languages**: go — "Generated Go types in pkg/apis/v1alpha1 + the embeddable `runner` Go package. No other official client." [source](https://github.com/google/ax/blob/main/DESIGN.md) (confidence: high)
- **Network & egress controls**: Inherited from Agent Substrate: all actor TCP egress except DNS goes through an egress policy enforcement point (HTTP(S) only; WebSocket, CONNECT, other TCP and UDP blocked), with hostname/CIDR policies configured on Substrate. AX's own Gateway allowlist primitive was removed 2026-09-24. — "'Actor TCP egress (except DNS traffic on port 53) is redirected to atunnel, which opens a CONNECT tunnel to the egress gateway. Egress gateway applies policy.' + google/ax#395 'Remove Gateway concept to avoid bifurcation with Substrate'." [source](https://github.com/agent-substrate/substrate/blob/main/docs/egress-traffic.md) (confidence: medium)
- **Snapshots & forks**: Checkpoint/restore via `ax suspend` / `ax resume` (sub-second resume claimed). Forking a task is roadmap. — "API: SuspendTask 'Checkpoint actor state and pause the task'; roadmap: 'Stateful Task Branching'." [source](https://github.com/google/ax/blob/main/docs/roadmap.md) (confidence: high)
- **Deployment methods**: cli, api — "`ax apply -f task.yaml` (ax.io/v1alpha1 YAML manifests) and the ax.v1alpha1.AX gRPC service." [source](https://github.com/google/ax/blob/main/README.md) (confidence: high)
- **Isolation**: Kata / gVisor — "AX schedules every task as a sandboxed actor on Agent Substrate. Substrate: 'Because it manages standard OCI containers at the kernel level (via gVisor), it can host agents built on any stack' and 'supports multiple sandbox technologies including microVMs and gVisor' (cmd/ateom-microvm runs actors as cloud-hypervisor VMs). gVisor is the documented default; AX's own docs do not name the backend, and a Sandbox/SandboxConfig resource for choosing it is roadmap. Enum value covers both gVisor and microVM." [source](https://github.com/agent-substrate/substrate) (confidence: medium)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "skills: registries: - provider: google query: "skills.tags:nodejs" path: "/.agents/skills"" [source](https://github.com/google/ax/blob/main/docs/manifests.md) |
| AI app builder | Not supported | "No prompt-to-app surface; 'Generative workspaces' prepare environments, not apps." [source](https://agentexecutor.io/) |
| Autonomous QA agent | Not supported | "No QA agent." [source](https://github.com/google/ax) |
| Built-in coding agent | Partially supported | "if the binding has a goal, hands that goal to an Antigravity agent to finish environment setup. The agent needs GEMINI_API_KEY in the container" [source](https://github.com/google/ax/blob/main/docs/sandbox.md) |
| BYOK for LLMs | Supported | "For Anthropic models, store the key the same way and set provider: anthropic." [source](https://github.com/google/ax/blob/main/docs/manifests.md) |
| Credential-injection proxy | Partially supported | "Egress policies such as header injection depend on MITM interception of Actor traffic." [source](https://github.com/agent-substrate/substrate/blob/main/docs/egress-trust-bundle.md) |
| LLM gateway | Not supported | "A Model is not a model. It is a named model configuration: which provider to call, which model identifier to use" [source](https://github.com/google/ax/blob/main/docs/concepts.md) |
| MCP client | Supported | "MCP servers and registries (Model Context Protocol) that the agent can call." [source](https://github.com/google/ax/blob/main/docs/concepts.md) |
| MCP-server hosting | Partially supported | "Interactive coding agents, long-running agent servers, Jupyter notebooks, headless browser testing, and custom tool runtimes—you name it." [source](https://agentexecutor.io/) |
| MCP server | Not supported | "The control plane exposes the ax.v1alpha1.AX gRPC service." [source](https://github.com/google/ax/blob/main/DESIGN.md) |
| Model inference API (first-party) | Not supported | "A Model is not a model. It is a named model configuration" [source](https://github.com/google/ax/blob/main/docs/concepts.md) |
| Preinstalled coding agent | Not assessed |  |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not applicable | "Tasks do not get a Kubernetes Service or Ingress of their own. Every request to a task goes through Agent Substrate's atenet router" [source](https://github.com/google/ax/blob/main/docs/networking.md) |
| Custom domains | Not applicable | "Tasks do not get a Kubernetes Service or Ingress of their own." [source](https://github.com/google/ax/blob/main/docs/networking.md) |
| Direct public IPv6 | Not supported | "Actor networking is currently IPv4-only." [source](https://github.com/agent-substrate/substrate/blob/main/docs/network-egress.md) |
| Edge KV store | Not applicable | "Not an edge runtime." [source](https://github.com/google/ax) |
| Egress controls | Partially supported | "Agent Substrate enforces that all outbound traffic from an actor, except traffic sent to TCP or UDP destination port 53, MUST go through an egress policy enforcement point (PEP)." [source](https://github.com/agent-substrate/substrate/blob/main/docs/network-egress.md) |
| Email send / receive | Not supported | "No email primitive in README, docs or the gRPC API reference." [source](https://github.com/google/ax) |
| Public preview URLs | Not applicable | "Tasks do not get a Kubernetes Service or Ingress of their own." [source](https://github.com/google/ax/blob/main/docs/networking.md) |
| Private networking | Partially supported | "From inside the cluster: Use the Service DNS name and add the header." [source](https://github.com/google/ax/blob/main/docs/networking.md) |
| Built-in reverse proxy | Partially supported | "Every request to a task goes through Agent Substrate's atenet router, the atenet-router Service in the ate-system namespace." [source](https://github.com/google/ax/blob/main/docs/networking.md) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "ax talks to the control plane over gRPC." [source](https://github.com/google/ax/blob/main/README.md) |
| BYOC | Not applicable | "Deploy your agents on your own infrastructure without being tethered to a specific provider's model or compute environment." [source](https://cloud.google.com/blog/products/ai-machine-learning/agent-executor-googles-distributed-agent-runtime) |
| Deploy into customers' VPCs | Not assessed |  |
| Secrets management | Partially supported | "secretKey: name: gemini-api-secret key: GEMINI_API_KEY" [source](https://github.com/google/ax/blob/main/docs/manifests.md) |
| Self-host / OSS core | Supported | "Apache License 2.0. See LICENSE for details." [source](https://github.com/google/ax/blob/main/LICENSE) |
| Sharing | Not supported | "No share-by-link; tasks are reachable only in-cluster or via port-forward." [source](https://github.com/google/ax/blob/main/docs/networking.md) |
| SSO / SAML | Not supported | "No SSO/SAML anywhere on the surface." [source](https://github.com/google/ax) |
| Teams | Not supported | "Every AX resource lives in an atespace. The default atespace is default." [source](https://github.com/google/ax/blob/main/docs/concepts.md) |
| Workload identity | Not assessed |  |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "go install github.com/google/ax/cmd/ax@latest" [source](https://github.com/google/ax/blob/main/README.md) |
| E2B-compatible API | Not assessed |  |
| Filesystem API | Partially supported | "File system service: streaming file reads and writes inside the workspace." [source](https://github.com/google/ax/blob/main/docs/sandbox.md) |
| Git deploy | Not supported | "Git repositories cloned into subdirectories of the workspace path." [source](https://github.com/google/ax/blob/main/docs/concepts.md) |
| HTTP data API | Not applicable | "Not a data layer." [source](https://github.com/google/ax) |
| OpenAPI spec | Not supported | "Request and response types follow the <Method>Request / <Method>Response convention." [source](https://github.com/google/ax/blob/main/pkg/apis/v1alpha1/ax.proto) |
| Private container registry | Not supported | "ko (brew install ko) and a container registry your cluster can pull from" [source](https://github.com/google/ax/blob/main/README.md) |
| Public API | Supported | "The control plane exposes the ax.v1alpha1.AX gRPC service." [source](https://github.com/google/ax/blob/main/DESIGN.md) |
| SDK | Partially supported | "Generated Go types live in pkg/apis/v1alpha1." [source](https://github.com/google/ax/blob/main/DESIGN.md) |
| SSH access | Partially supported | "They are off by default because they allow arbitrary process execution and file access inside the sandbox, and ax ssh refuses to connect to a task that has not enabled them." [source](https://github.com/google/ax/blob/main/docs/sandbox.md) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not applicable | "Every task container starts with ax-task-runner as PID 1." [source](https://github.com/google/ax/blob/main/docs/sandbox.md) |
| Desktop / computer-use sandbox | Not supported | "Interactive coding agents, long-running agent servers, Jupyter notebooks, headless browser testing, and custom tool runtimes" [source](https://agentexecutor.io/) |
| GPU compute | Not supported | "resources: requests: cpu: "500m" memory: "1Gi" limits: cpu: "2" memory: "4Gi"" [source](https://github.com/google/ax/blob/main/docs/manifests.md) |
| Live-state (memory) snapshots | Not assessed |  |
| Multi-region | Partially supported | "ax follows your active Kubernetes context. Switch clusters and ax resolves and tunnels to that cluster's control plane in the background." [source](https://github.com/google/ax/blob/main/README.md) |
| Object storage | Not supported | "its data sources in place, such as repositories cloned at the right revision or buckets mounted" [source](https://github.com/google/ax/blob/main/docs/concepts.md) |
| Persistent disk | Supported | "ax suspend task task123 # checkpoint and pause / ax resume task task123 # pick up where it left off" [source](https://github.com/google/ax/blob/main/README.md) |
| Sandbox templates / custom images | Supported | "The controller provisions a dedicated Agent Substrate actor template for each distinct image and environment, so different tasks can run different runners side by side in the same atespace." [source](https://github.com/google/ax/blob/main/docs/runner.md) |
| Scale to zero | Partially supported | "The router reads a single header, ate-target-actor, resolves the actor to the worker it is running on, resumes it first if it was suspended, and proxies the request there." [source](https://github.com/google/ax/blob/main/docs/networking.md) |
| Selectable isolation runtime | Not assessed |  |
| Snapshots / forking | Partially supported | "Stateful Task Branching: Enable branching (forking) a running or suspended Task—including its checkpointed memory and workspace filesystem state—into multiple parallel tasks" [source](https://github.com/google/ax/blob/main/docs/roadmap.md) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "Not a data layer." [source](https://github.com/google/ax) |
| Ephemeral instant DB (no-signup) | Not applicable | "Not a data layer." [source](https://github.com/google/ax) |
| First-party database | Not applicable | "AX keeps its state in Redis and uses Redis Streams as the work queue" [source](https://github.com/google/ax/blob/main/DESIGN.md) |
| Vector search | Not applicable | "Not a data layer." [source](https://github.com/google/ax) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not applicable | "Not a CI runner product." [source](https://github.com/google/ax) |
| Built-in observability | Not supported | "Telemetry and Trajectory Collection: Automatically collect and export OpenTelemetry metrics, distributed traces, and structured agent trajectories" [source](https://github.com/google/ax/blob/main/docs/roadmap.md) |
| Preview environments | Not applicable | "Not a deploy platform; no per-PR environment concept." [source](https://github.com/google/ax) |
| Scheduled tasks | Not supported | "No schedule/cron field on Task and no scheduling RPC in the API reference." [source](https://github.com/google/ax/blob/main/DESIGN.md) |
| Project template marketplace | Not supported | "Two example manifests in examples/ (simple.yaml, task.yaml); no template gallery." [source](https://github.com/google/ax) |
| Durable workflows | Partially supported | "Agent Executor provides this backend resilience automatically for any actor (e.g., an agent, agent harness, skill, tool, or sandbox) through its event log and snapshotting." [source](https://cloud.google.com/blog/products/ai-machine-learning/agent-executor-googles-distributed-agent-runtime) |

## Agent readiness

### Read: 4 of 10 signals present

4/10 signals (2 full, 4 partial; 1 na): a fast server-rendered Hugo site, but no llms.txt, no JSON-LD, a relative-URL sitemap and no docs link on the homepage

- Llms txt: fail — "https://agentexecutor.io/llms.txt → 404; /docs/llms.txt → 404"
- Llms full txt: fail — "https://agentexecutor.io/llms-full.txt → 404"
- Robots AI policy: partial — "robots.txt: 'User-agent: * / Disallow: /demo/'. Silent default-allow, no AI UA mention."
- JSON LD: fail — "No <script type="application/ld+json"> in homepage HTML."
- Sitemap: partial — "sitemap.xml lists 11 URLs, but every <loc> is relative (e.g. '/docs/quickstart/'), which is invalid per the sitemap protocol. Not referenced from robots.txt."
- Meta quality: partial — "Description + og:title/og:description present and descriptive; <title> is just 'AX'."
- Markdown negotiation: fail — "Accept: text/markdown returns text/html; /docs/quickstart/index.md → 404."
- Content efficiency: pass — "~5.7 KB readable text / 20.3 KB HTML ≈ 28%, server-rendered (Hugo 0.140.0)."
- Docs discoverable: partial — "Docs exist at /docs/ (sitemap), but the homepage links only to GitHub ('Get started' → github.com/google/ax#quick-start); no /docs link in the homepage HTML."
- Pricing machine readable: na — "No pricing: free Apache-2.0 self-host tool with no commercial tier."
- Anti bot: pass — "Fastly-cached static pages; no challenge on any public path fetched."

### Drive: 2.5 of 9 signals present

2.5/9 signals (2 full, 1 partial; 2 na): a documented gRPC API and an official kubectl-style CLI, with a Go-only client and nothing agent-facing (no MCP, no agents.md)

- Public API: pass — "DESIGN.md '## API reference': ax.v1alpha1.AX gRPC service, Task/Workspace/Model CRUD + Suspend/Resume/Watch."
- Openapi spec: fail — "No OpenAPI. pkg/apis/v1alpha1/ax.proto is published (gRPC), which the rubric does not credit as OpenAPI."
- MCP server: fail — "No MCP control server. MCP appears only as something workspaces wire INTO sandboxes (mcp-client)."
- SDK packages: partial — "Go only: generated types in pkg/apis/v1alpha1 + embeddable runner package."
- Auth docs: fail — "No API auth documented; the CLI reaches the control plane through the kube context / tunnel."
- Agent self serve creds: na — "Self-hosted: there is no vendor-issued credential to obtain."
- Webhooks: fail — "No webhooks. WatchTask is a server-streaming RPC, not outbound webhooks."
- CLI tool: pass — "`go install github.com/google/ax/cmd/ax@latest`; official kubectl-shaped CLI."
- Error model: fail — "No documented error model beyond task conditions (e.g. ActorCreationFailed)."
- Rate limit docs: na — "Self-hosted API with no vendor-imposed rate limits."
- Agent config: fail — "No AGENTS.md in the repo, no /.well-known/agent, no skills listing."

## Open source

- Repository: https://github.com/google/ax
- License: Apache-2.0
- Stars: 11435
- Forks: 551
- Self-host methods: kubernetes, source-build
- Self-host dependencies: kubernetes, agent-substrate, redis, object-storage

## Company & presence

- Headquarters: Mountain View, CA, USA (Google)
- Founded: 2026
- GitHub: https://github.com/google/ax
- Google Cloud blog (launch post): https://cloud.google.com/blog/products/ai-machine-learning/agent-executor-googles-distributed-agent-runtime
- Agent Substrate GitHub: https://github.com/agent-substrate/substrate
- ate-dev Google Group (Substrate): https://groups.google.com/g/ate-dev
- agent-substrate YouTube: https://www.youtube.com/channel/UCN9PPqlTtVxlcpbQ-NWpfZQ

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.