Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteNVIDIA OpenShell is an open-source runtime control layer for running AI agents inside policy-governed sandboxes. It sits beneath an agent framework: the framework and model determine what the agent tries to do, while OpenShell is designed to control which files, processes, network destinations, API requests and provider credentials the running agent can access. That can narrow an agent’s reach and make access reviewable; it does not guarantee truthful outputs, correct decisions or risk-free operation.
What is NVIDIA OpenShell?
OpenShell is runtime infrastructure for agent execution, not an agent framework or a model. NVIDIA describes it as a layer beneath agent harnesses that coordinates sandbox creation, policy, providers and access. The agent still needs a compatible image, provider setup and policy for its intended task.
NVIDIA’s stated support examples include Claude Code, Codex, OpenCode, OpenClaw and GitHub Copilot CLI, as well as custom agents and images. Those examples are not a promise that every version or workflow will work without configuration. The chosen image, provider profile and permissions must fit together.
The key distinction is between influencing behavior and enforcing an execution boundary. A system prompt or model safeguard may discourage an agent from taking an action; a runtime policy is intended to deny actions outside its allowed scope. Neither layer makes the model inherently reliable.
#1 Best Overall
- EVOLUTION AMD RYZEN AI MAX+ 395 MINI PC - GMKtec EVO-X2 is the next evolution in AI mini PC Ryzen Strix Halo series. Thanks to AMD Simultaneous Multithreading (SMT) the core-count is effectively doubled, to 32 threads. Ryzen AI Max+ 395 has 64 MB of L3 cache and can boost up to 5.1 GHz, depending on the workload. The Ryzen AI Max+ 395 is currently rated as the "most powerful x86 APU" on the market for AI computing.
- AI NPU with XDNA 2 ARCHITECTURE - Powered by 16 “Zen 5” CPU cores, 50+ peak AI TOPS XDNA 2 NPU and a truly massive integrated GPU driven by 40 AMD RDNA 3.5 CUs, the Ryzen AI MAX+ 395 is a transformative upgrade and delivers a significant performance boost over the competition. The Ryzen AI Max+ 395 excels in consumer AI workloads like the llama.cpp-powered application: LM Studio. Shaping up to be the must-have app for client LLM workloads, LM Studio allows users to locally run the latest language model without any technical knowledge required and unleash their creativity and productivity.
- AMD RADEON 8090S iGPU GAMING PC - The AMD Radeon RX 8060S offers all 40 CUs with up to 2.9 GHz graphics clock and uses the new RDNA 3.5 architecture. The powerful iGPU is positioned between an RTX 4060 and 4070 laptop GPU and therefore enables gaming in FHD at maximum details in most demanding games. The 8060S can also utilize the full 128GB pool, which is perfect for running LLMs such as Deepseek 70B Q8, which runs comfortably on this machine.
- EIGHT CHANNEL LPDDR5X - LPDDR5X is a new ground breaking memory small form factor installed on-board. With blazing speeds up to to 8000MT/s, it runs 1.5x faster than the DDR5 SODIMMs; 90% better performance over DDR5 SODIMMs in video conferencing and photo editing; 30% better performance in productivity apps; 12% better performance in digital content workloads.
- QUAD SCREEN 8K DISPLAY SUPPORT - EVO-X2 AI Mini PC support 4-screen 4K/8K output via HDMI 2.1 (8K@60Hz), DisplayPort 1.4 (4K@60Hz), and dual USB 4 40Gbps Transfer speed (supporting PD3.0/DP1.4/DATA). Ideal for gaming, video editing, and multitasking, it provides expansive and crisp multi-display support.
How does OpenShell work?
OpenShell separates the agent workload from the components that coordinate it and mediate access. NVIDIA describes four principal parts:
| Component | Role |
|---|---|
| Gateway | Control plane for sandbox lifecycle, user authorization, settings, policy, providers and access coordination. |
| Sandbox | Contains the agent workload. It can report attempted actions, but does not decide whether they are permitted. |
| Supervisor | Sits on the trusted side of the boundary, checks requests, handles credentials and approved connections, and maintains the link to the gateway. |
| Compute runtime | Provisions the workload and supervisor, protected communication channel and isolation boundary. |
During execution, kernel controls govern file access and system calls, while a mediated connection path applies network policy. Before a policy change is approved, NVIDIA says a policy prover checks for newly introduced risky access, such as a credentialed host or API method. Findings can hold a change for human review.
What can policy control?
OpenShell policies cover filesystem, process, network, API-request and provider-credential access. NVIDIA documents default-deny outbound networking: a destination not listed in policy is denied rather than implicitly trusted. This is useful only if the allowed list reflects the task the agent actually needs to complete.
Controls have different update behavior. Filesystem and process controls are fixed when a sandbox is created; network rules and provider credentials can be updated while it runs. That difference matters when designing an approval workflow: a blocked outbound connection may be reviewable and allow a live rule update, while a changed file or process scope may require creating the sandbox again.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Built for Local AI Development: AMD Ryzen AI Halo is designed for local AI development and inference, featuring 128GB unified memory and support for up to 200B parameter models to build and run intensive AI workloads locally.
- 128GB Unified Memory: Features 128GB LPDDR5x unified memory at 8000 MT/s with 256 GB/s memory bandwidth, providing a shared memory pool across the CPU, GPU, and NPU to support larger AI models.
- AMD Ryzen AI Max+ 395 Processor: Features 16 cores, 32 threads, and Zen 5 architecture, paired with AMD Radeon 8060S integrated graphics featuring 40 RDNA 3.5 compute units and an AMD XDNA 2 NPU with up to 50 TOPS.
- Linux AI Developer Platform: Purpose-built for Linux-based AI development with full AMD ROCm software support and preloaded tools, models, and workflows optimized for local AI development.
- Compact, Connected Design: Includes a 2TB M.2 SSD, 10GbE LAN, Wi-Fi 7, Bluetooth 5.4, USB-C connectivity, and HDMI 2.1b.
Opening a route is not a harmless convenience. An allowed host or API method can create a path for workspace data, secrets or conversation history to leave the environment. Keep destinations narrow, grant only the required API methods and credential scopes, and review proposed access before applying it.
How are provider credentials handled?
NVIDIA’s architecture keeps provider credentials from being handed directly to the agent workload. Providers and the trusted supervisor handle credentials and approved connections; requests are constrained by policy to approved endpoints. This reduces the need for secrets to be exposed inside the agent process, but it does not remove the need to decide which provider, endpoint and access scope are appropriate.
Credential handling and network policy work together. A credential alone should not imply permission to reach any host, and allowing a host should not imply that every API operation is appropriate. Review both the destination and the methods or credential scope the agent can use.
Is OpenShell different from Docker?
Docker, Podman, Kubernetes and virtual machines are compute substrates in NVIDIA’s documentation. OpenShell can use such infrastructure and adds agent-oriented coordination and controls around execution. The choice is not necessarily OpenShell versus a container or VM: the practical question is whether the deployment needs OpenShell’s additional policy, credential and review mechanisms on top of its compute environment.
Recommended Free Tools
Rank #3
- EVOLUTION RYZEN AI MAX+ 395 MINI PC - GMKtec EVO-X2 is the next evolution in AI mini PC Ryzen Strix Halo series. Thanks to AMD Simultaneous Multithreading (SMT) the core-count is effectively doubled, to 32 threads. Ryzen AI Max+ 395 has 64 MB of L3 cache and can boost up to 5.1 GHz, depending on the workload. The Ryzen AI Max+ 395 is currently rated as the "most powerful x86 APU" on the market for AI computing.
- AI NPU with XDNA 2 ARCHITECTURE - Powered by 16 “Zen 5” CPU cores, 50+ peak AI TOPS XDNA 2 NPU and a truly massive integrated GPU driven by 40 AMD RDNA 3.5 CUs, the Ryzen AI MAX+ 395 is a transformative upgrade and delivers a significant performance boost over the competition. The Ryzen AI Max+ 395 excels in consumer AI workloads like the llama.cpp-powered application: LM Studio. Shaping up to be the must-have app for client LLM workloads, LM Studio allows users to locally run the latest language model without any technical knowledge required and unleash their creativity and productivity.
- AMD RADEON 8090S iGPU GAMING PC - The AMD Radeon RX 8060S offers all 40 CUs with up to 2.9 GHz graphics clock and uses the new RDNA 3.5 architecture. The powerful iGPU is positioned between an RTX 4060 and 4070 laptop GPU and therefore enables gaming in FHD at maximum details in most demanding games. The 8060S can also utilize the full 128GB pool, which is perfect for running LLMs such as Deepseek 70B Q8, which runs comfortably on this machine.
- EIGHT CHANNEL LPDDR5X - LPDDR5X is a new ground breaking memory small form factor installed on-board. With blazing speeds up to to 8000MT/s, it runs 1.5x faster than the DDR5 SODIMMs; 90% better performance over DDR5 SODIMMs in video conferencing and photo editing; 30% better performance in productivity apps; 12% better performance in digital content workloads.
- QUAD SCREEN 8K DISPLAY SUPPORT - EVO-X2 AI Mini PC support 4-screen 4K/8K output via HDMI 2.1 (8K@60Hz), DisplayPort 1.4 (4K@60Hz), and dual USB 4 40Gbps Transfer speed (supporting PD3.0/DP1.4/DATA). Ideal for gaming, video editing, and multitasking, it provides expansive and crisp multi-display support.
| Evaluation question | What to assess |
|---|---|
| Where will workloads run? | Choose a supported local, server or Kubernetes environment that fits operational requirements. |
| What can the agent reach? | Assess whether per-agent filesystem, process, network and API restrictions address the actual risk. |
| How are secrets used? | Consider whether mediated provider access and policy-bound requests meet credential-handling needs. |
| Who operates the controls? | Plan for policy design, approvals, logs and maintenance; the runtime does not make those decisions for the team. |
Does OpenShell require BlueField-4?
No. NVIDIA says OpenShell can run on supported local and server infrastructure without BlueField-4. In NVIDIA’s broader Open Agent Safety Platform, Sentry is a separate layer associated with BlueField hardware; NVIDIA describes it as adding an independent monitoring and enforcement layer on systems with that hardware. BlueField is therefore not an OpenShell prerequisite.
What does setup and day-to-day operation involve?
NVIDIA’s first-agent tutorial illustrates the workflow with OpenCode and OpenRouter. That pairing is an example, not a requirement. The general sequence is to configure a provider, choose an image containing the intended agent, create a sandbox with policy, then launch the agent process.
- Configure a provider. Set up the provider profile and credentials through the documented provider path rather than placing provider secrets directly in the workload.
- Select an agent image. Use an image that has the agent installed and matches the intended task.
- Create a sandbox with policy. Set file, process, network, API and credential access to the minimum the task needs.
- Launch the agent. Run the agent process inside the sandbox and observe denied requests as well as successful activity.
- Review blocked destinations. If an agent requests an unlisted destination, OpenShell denies it and surfaces a proposal for operator review. Approve only a suitably narrow rule; the tutorial says approved rules can be applied live.
Compatibility changes over time, so consult NVIDIA’s current support matrix before deployment. The matrix identified in the documentation reviewed lists v0.1.2 and Debian or Ubuntu Linux on x86_64 and arm64, plus macOS on Apple Silicon, as supported host platforms. Windows with WSL 2 and Docker Desktop is marked experimental. NVIDIA also documents Kubernetes deployment and several compute drivers. These labels describe that documented version and matrix; they should not be treated as a guarantee for a later release or every configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should operators assess access and logs?
Start with the agent’s task and map each permission to a concrete need. An agent that edits a repository may need access to a working directory but not unrelated files; a tool that calls a service may need a specific host and API method rather than open outbound access. Test the policy against ordinary task steps before relying on it in production, and treat proposed expansions as security changes requiring review.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →NVIDIA documents CLI and TUI log access, direct log files and OCSF JSON export. The gateway also keeps a bounded buffer, but that buffer is lost when the gateway restarts. For durable retention, use log files or send OCSF JSON records to an external aggregator. Decide who reviews those records and how access changes and denials will be investigated.
What OpenShell does not guarantee
OpenShell can limit the actions available to an agent according to policy; it does not prevent a model from making mistakes, being misleading or producing incorrect work within the permitted boundary. A policy that is too broad may leave unnecessary access available, while one that is too restrictive can block useful work. Operators remain responsible for choosing and reviewing the boundary.
The AP’s launch coverage quoted NVIDIA vice president of enterprise AI Justin Boitano saying, “Agents can drift when instructions are ambiguous,” in explaining the motivation for runtime controls. AP also reported University of Wisconsin computer science professor Somesh Jha saying, “This can only be answered using case studies,” referring to the unresolved balance between restrictive controls and useful agent behavior. Those observations point to a deployment trade-off, not a measured effectiveness result.
AP reported at launch that NVIDIA said more than 100 organizations were using the platform. That was a company-reported figure in coverage of the wider platform launch, not an independently audited OpenShell adoption count. The sources available here establish no independent benchmark or controlled security test of OpenShell’s effectiveness, so a success rate or attack-prevention percentage would be unsupported.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
