// the find
omnigent-ai/omnigent
Omnigent is an open-source AI agent framework and meta-harness: orchestrate Claude Code, Codex, Cursor, Pi, and custom agents — swap harnesses without rewriting, enforce policies and sandboxing, and collaborate in real time from any device.
Omnigent is a Python orchestration layer that sits above existing AI coding agents — Claude Code, Codex, Cursor, Pi, and others — giving them a shared session model, policy enforcement, sandboxing, and multi-device access. The core idea is that you define agents in YAML and swap the underlying harness without rewriting your setup. It is explicitly alpha.
The three-level policy system (server/agent/session, checked in order, with spend caps and shell-approval as builtins) is the most practically useful thing here — most teams building on top of coding agents are rolling this themselves from scratch. The YAML agent spec is clean: local Python functions, MCP servers, and sub-agents are all first-class tool types, and the schema auto-generates from function signatures. The deployment documentation is unusually complete for alpha — real configs for Docker, Fly, Railway, Modal, Kubernetes, and Databricks, not just a 'coming soon' section. The internal security scanning in CI (exfil scan, secret scan, workflow misuse linting) shows they are thinking seriously about what goes wrong when agents have shell access.
The native terminal wrappers rely on tmux and PTY wrapping of CLIs that were not designed to be automated; screen-scraping Claude Code's output is inherently fragile and will break on any harness update. Windows support is degraded in ways that matter — no filesystem or network sandboxing, no PTY wrappers — so the security guarantees are asymmetric across platforms. The prerequisite list (Python 3.12, uv, git, Node 22, tmux, bubblewrap on Linux) is long for a tool positioning itself as a simplification layer. The co-drive collaboration model — where a teammate's messages execute on your machine — is a meaningful trust boundary that the policy system only partially addresses; if the server auth is misconfigured or an account is compromised, the blast radius is your local filesystem.