> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/NVIDIA/OpenShell/llms.txt
> Use this file to discover all available pages before exploring further.

# Supported agents

> All agents that run in OpenShell sandboxes, how credentials are discovered and injected, and how to launch each agent type.

The table below summarizes the agents that run in OpenShell sandboxes. Agents listed under the `base` sandbox are pre-installed and auto-configured when you pass them as the trailing command to `openshell sandbox create`.

## Agent table

| Agent                                                                              | Source sandbox         | Required credential                      | Notes                                                                                                 |
| ---------------------------------------------------------------------------------- | ---------------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| [Claude Code](https://docs.anthropic.com/en/docs/claude-code)                      | `base`                 | `ANTHROPIC_API_KEY`                      | Full policy coverage. Works out of the box.                                                           |
| [OpenCode](https://opencode.ai/)                                                   | `base`                 | `OPENAI_API_KEY` or `OPENROUTER_API_KEY` | Partial policy coverage. Add `opencode.ai` endpoint and OpenCode binary paths for full functionality. |
| [Codex](https://developers.openai.com/codex)                                       | `base`                 | `OPENAI_API_KEY`                         | No default policy coverage. Requires a custom policy with OpenAI endpoints and Codex binary paths.    |
| [GitHub Copilot CLI](https://docs.github.com/en/copilot/github-copilot-in-the-cli) | `base`                 | `GITHUB_TOKEN` or `COPILOT_GITHUB_TOKEN` | Full policy coverage. Works out of the box.                                                           |
| [OpenClaw](https://openclaw.ai/)                                                   | `openclaw` (community) | Bundled with sandbox                     | Agent orchestration layer. Launch with `--from openclaw`.                                             |
| [Ollama](https://ollama.com/)                                                      | `ollama` (community)   | Bundled with sandbox                     | Includes Claude Code, Codex, and OpenCode. Launch with `--from ollama`.                               |

All sandbox images are maintained in the [OpenShell Community](https://github.com/NVIDIA/OpenShell-Community) repository.

## Credential auto-discovery

OpenShell automatically discovers credentials for recognized agents from your shell environment. When you run `openshell sandbox create`, the CLI reads the relevant environment variables (such as `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, and `GITHUB_TOKEN`) and creates credential providers from them.

Credentials are never written to the sandbox filesystem. They are injected as environment variables at runtime so the agent process can use them without exposing them to the filesystem or other processes.

<Tip>
  You do not need to run `openshell provider create` for recognized agents. If the required environment variable is set in your shell, OpenShell handles the rest automatically.
</Tip>

## How providers work

OpenShell manages credentials as **providers** — named credential bundles that are injected into sandboxes at creation time. Each provider maps to a set of environment variables that the agent inside the sandbox will receive.

You can create providers explicitly when auto-discovery is not sufficient:

```bash theme={null}
# Create a provider from existing environment variables
openshell provider create --type anthropic --from-existing

# Create a provider interactively
openshell provider create --type openai
```

## Launching agents

To launch an agent, pass it as the trailing command to `openshell sandbox create`.

```bash theme={null}
# Claude Code
openshell sandbox create -- claude

# OpenCode
openshell sandbox create -- opencode

# Codex
openshell sandbox create -- codex

# GitHub Copilot CLI
openshell sandbox create -- copilot
```

You can combine the sandbox name, a custom policy, and a provider in a single command:

```bash theme={null}
openshell sandbox create --name my-sandbox --policy ./policy.yaml -- claude
```

<Note>
  The `--` separator is required. Everything after `--` is the command run inside the sandbox.
</Note>

## Community sandboxes

Agents that need a specialized runtime — like OpenClaw and Ollama — are available as community sandbox images. Use `--from` to pull them from the [OpenShell Community](https://github.com/NVIDIA/OpenShell-Community) catalog.

```bash theme={null}
# Launch OpenClaw (agent orchestration layer)
openshell sandbox create --from openclaw

# Launch Ollama (local and cloud model runner)
openshell sandbox create --from ollama
```

You can also point `--from` at a local directory or a container image:

```bash theme={null}
# Local Dockerfile
openshell sandbox create --from ./my-sandbox-dir

# Container image
openshell sandbox create --from registry.io/img:v1
```

<Warning>
  Community sandbox images bundle their own policies. Review the policy file in the community repository before using a sandbox image in a production or sensitive environment.
</Warning>

## Next steps

<CardGroup cols={2}>
  <Card title="Providers" icon="key" href="/sandboxes/providers">
    Create and manage credential providers for your agents.
  </Card>

  <Card title="Community sandboxes" icon="grid-2" href="/sandboxes/community-sandboxes">
    Browse the full catalog of community sandbox images.
  </Card>
</CardGroup>