AI agents for sensitive data and business-critical apps.
The agent never holds a key, and never decides its own permissions.
Website · Architecture · Development · MIT license
This repository is Minerva's open harness: the engine that runs each agent turn, with its sandbox, its permission checks and its connectors, on Cloudflare. It holds the engine alone. Minerva itself is a hosted product, and the product's side (accounts, organizations, connections and the app people use) is a private Laravel application that starts each turn here. Self-hosting is not supported.
Most agents are given the keys and asked to behave. They hold Gmail, Slack and Stripe tokens with broad access, and a prompt asks them to stay within bounds. One persuasive email or web page is enough to change their mind.
Minerva turns this around:
- Keys stay out of the agent's reach. The agent's commands run in a sealed microVM that holds no key and has no network. Credentials are encrypted at rest and never reach the sandbox, the model or the browser.
- Every call is checked. Each action goes through Minerva's permission check, against the permissions you set, before it reaches the app.
- Access is set per resource. You allow or deny per folder, label, channel, project, customer or amount, in each app's own structure. Not per app.
You chat with an agent that has its own instructions and connections. The chat shows every tool call it makes, with its arguments and whether it was allowed.
| The agent tries to | Permissions | Result |
|---|---|---|
| Read the Receipts label in Gmail | Receipts: read | Done |
| Post in #general in Slack | #support only | Not allowed |
| Refund 120 EUR in Stripe | Refunds up to 50 EUR | Not allowed |
| Cc an unlisted address in Gmail | Send to *@acme.example |
Not allowed |
An agent may do only what the app's account, your organization, you and the agent all allow, and a deny anywhere wins.
Each conversation has a folder. Attach files, and the agent works on them with shell commands and Python in the conversation's own microVM (Cloudflare Containers). You can download every file it leaves.
Prompt injection is contained, not prevented. An email that asks the agent to send your invoices to a stranger fails the permission check, and a page that asks for its keys finds neither keys nor a network.
20 connectors, each with resource-level permissions:
| Mail and calendars | Gmail, Outlook, Google Calendar, Outlook Calendar |
| Files and docs | Google Drive, OneDrive and SharePoint, Notion, Confluence |
| Messaging and support | Slack, Microsoft Teams, Intercom |
| Engineering | GitHub, Linear, Jira, Sentry, Todoist |
| Finance and sales | Stripe, Xero, HubSpot |
| Web | Reading and taking screenshots of the sites you allow, in Cloudflare's browser |
What each one lets agents do, and what it hides from them, is in docs/connectors.md.
The engine is TypeScript on Cloudflare (Workers, Durable Objects, Containers and Dynamic Workers) around pi's durable agent loop. ARCHITECTURE.md describes its design, its trust model and its split from Laravel, and contract/ the internal API between them.
You need Node 24 and pnpm 10. No Cloudflare account is needed:
git clone https://github.com/minervacomputing/harness.git minerva
cd minerva && pnpm install
pnpm --dir cloudflare dev:offline # the engine on http://127.0.0.1:8787, with a scripted fake modelChecks, tests and deploys are in cloudflare/README.md.
Minerva is early, and accounts come only by invitation. Asking you before a write runs is designed.
Minerva is built by Szymon Nastaly. For news on agents, subscribe to the newsletter This Week in Agents.
Released under the MIT license.