Open-Inspect

tom@tomrochette.com (Tom Rochette) — Sat, 07 Nov 2026 00:00:00 +0000

Open-Inspect is an MIT-licensed, self-hosted background coding agent inspired by Ramp’s Inspect: sessions take work from a web UI, Slack, GitHub pull requests, Linear issues, or webhooks, and return pull requests with commit attribution to the person who prompted them.

What it is
#

The Ramp-Inspect pattern published as an open system: Modal-style sandboxed sessions, multiplayer editing, per-prompt attribution, and your existing model subscriptions. A deployment is single-tenant by design (a Terraform guide for full infrastructure, a separate guide for local development), with each session running in a sandboxed environment carrying Node.js, Python, git, browser automation, and VS Code. Sessions support live multiplayer collaboration, parallel sub-tasks in separate sandboxes, cron automations, and event-driven automations for GitHub events, Sentry alerts, and webhooks. Model access rides subscriptions as well as keys: Claude by API key or a connected Claude subscription, Codex through a ChatGPT subscription, Grok through SuperGrok, or OpenCode Zen. The project has 55 contributors and bilingual English and Chinese documentation.

Status
#

Young but growing: 3,467 stars since creation on 2026-01-25, pushed 2026-11-06, MIT, per the GitHub API as of 2026-11-07.

There is no release train and no independent coverage: the repository publishes no GitHub release tags, so deployments track main, and a Hacker News search returns no story about it (2026-11-07). The missing community footprint is itself the signal this note states, and the documentation is the counterweight: the security model, getting-started, and setup guides read as production runbooks, down to credential scoping, enforcement modes, and break-glass read paths.

Strengths
#

Sandbox credentials are scoped per session, covering the session’s granted repositories and failing closed when grants cannot be resolved, a tighter default than the installation-wide credentials most platform factories hand out.
Per-prompt commit attribution means the pull request names the human who asked, so review authority stays with people, not the app.
Candid single-tenant trust documentation: the guides state plainly that all users share the deployment’s GitHub App installation and that teams add internal access controls, not tenant isolation.
Automations cover the operational edges: cron jobs, GitHub events, Sentry alerts, and webhooks, which most members of this category leave to external schedulers.

Cautions
#

No release tags exist: a deployment tracks main, so there is no pinned, upgradeable version line.
Single-tenant only by design, and GitLab deployments fall back to one deployment-wide PAT, a weaker credential boundary the docs admit.
Zero independent coverage as of 2026-11-07; the evidence base is the repository and its documentation.
The infrastructure burden is heavy: full deployments go through Terraform, GitHub Apps, and sandbox images, closer to platform engineering than to installing a CLI.
Acceptance is human review of the attributed pull request; no built-in acceptance gate exists.

Pricing
#

MIT, free, and self-hosted on your own cloud, with your model subscriptions or API keys as the running cost. There is no hosted tier and no published prices as of 2026-11-07.

Compared to
#

Open SWE is the closest peer: LangChain’s Robin needs LangSmith’s Managed Deep Agents to run as-is, while Open-Inspect runs its own harness and routes your existing Claude, Codex, and Grok subscriptions.
SuperPlane owns the intake-to-PR line as a platform with confidence-gated backlog intake and durable run records; Open-Inspect is session-first and leaves confidence scoring out.
Fusion is board-first and local-node-first with per-step gates; Open-Inspect is chat-and-tracker-first and sandbox-first, with no local mode.

Bottom line
#

Recommended for a team that wants the Ramp-Inspect loop, background sessions to attributed pull requests, on its own infrastructure with per-session scoped credentials, and accepts tracking main with no release train. Not for multi-tenant use, which the design excludes, and not for anyone who needs third-party validation or pinned releases first. My disagreeable claim: per-session credential scoping makes Open-Inspect the safest default in this category’s platform tier, and it deserves coverage proportional to its stars.

Changes
#

2026-11-07 - Created from the awesome-software-factories 2026-11-05 weekly sweep, clearing the bar on the Open SWE intake-to-PR line with the zero-coverage footprint recorded.

References
#

https://github.com/open-inspect/background-agents - the README: the loop, intake surfaces, model routing, and the single-tenant security model
https://github.com/open-inspect/background-agents/blob/main/docs/GETTING_STARTED.md - the deployment runbook: Terraform, scoped sandbox credentials, fail-closed resolution, and the GitLab PAT caveat
https://api.github.com/repos/open-inspect/background-agents/releases - the empty release list grounding the no-release-train caution
https://news.ycombinator.com/api/v1/search?query=open-inspect&tags=story - the footprint scan finding no story (2026-11-07)
https://builders.ramp.com/post/why-we-built-our-background-agent - Ramp’s Inspect post, the pattern this project replicates, with its sandbox, attribution, and multiplayer design

background-agents on tomrochette.com

Open-Inspect

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

background-agents on tomrochette.com

Open-Inspect

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#