
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
@openhands/agent-canvas
Advanced tools
> [!WARNING] > This project is in sandbox phase. It may be vibecoded, untested, or out of date. OpenHands takes no responsibility for the code or its support. [Learn more](https://github.com/OpenHands/incubator-program).
[!WARNING] This project is in sandbox phase. It may be vibecoded, untested, or out of date. OpenHands takes no responsibility for the code or its support. Learn more.
Agent Canvas is a web frontend for managing agents. You can:
Agents can run anywhere:
You can work with any agent (e.g. Claude Code, Codex) or connect directly to an LLM (e.g. Anthropic, OpenAI, Gemini, Mistral, Minimax, Kimi).
If you have questions or feedback, please open a GitHub issue or join the #proj-agent-canvas channel in Slack
Prerequisites:
npmSet $PROJECT_PATH to the directory on your machine where your projects live (e.g. /path/to/your/projects). The agent server will mount this directory so the agent can read and edit your code.
By default the container is kept isolated from your host home — only ~/.openhands, ~/.claude, ~/.codex, and ~/.ssh are mounted individually (and only if they exist). If you want the Add Workspace dialog to browse your real host filesystem, set OH_MOUNT_HOST_HOME=1 before npm run dev:docker to bind-mount your entire host home onto /home/openhands in the container. The Add Workspace modal also shows this hint inline when it detects the mount is off.
export PROJECT_PATH=/path/to/your/projects
git clone https://github.com/OpenHands/agent-canvas.git
cd agent-canvas
npm install
npm run dev:docker
Access the UI at http://localhost:8000
[!WARNING] This runs the agent-server directly on the machine you're installing on--the agent will have full access to your filesystem!
Running without docker is great if you're running Agent Canvas on a VM. See SELF_HOSTING.md for details, especially with respect to security hardening. Notably, you can run the backend on multiple different VMs and switch between them from the same Agent Canvas frontend!
Prerequisites:
npmuv (for running the agent server via uvx)git clone https://github.com/OpenHands/agent-canvas.git
cd agent-canvas
npm install
npm run dev:dangerously-dockerless
Access the UI at http://localhost:8000
Agent Canvas is powered by the OpenHands Agent Server, a REST API for running multiple agents on a single machine. Each Agent Server runs on a single host/port; the Agent Canvas can connect to multiple Agent Servers and easily flip between them.
You can run an Agent Server anywhere:
The Agent Server is often paired with an Automation Server, which lets you set up agents that run on a schedule or in response to events.
Agent Canvas is also available as an npm package for embedding in your own applications:
npm install @openhands/agent-canvas
Import the full package or specific components:
// Full package
import { AgentServerUIProviders } from '@openhands/agent-canvas';
// Individual component packages
import { BrowserPanel } from '@openhands/agent-canvas/browser';
import { ChatInterface } from '@openhands/agent-canvas/conversation';
import { FileExplorer } from '@openhands/agent-canvas/files';
import { Terminal } from '@openhands/agent-canvas/terminal';
| Subpath | Description |
|---|---|
@openhands/agent-canvas | Main entry with providers and core components |
@openhands/agent-canvas/browser | Browser/preview panel components |
@openhands/agent-canvas/conversation | Chat interface and message components |
@openhands/agent-canvas/files | File explorer and editor components |
@openhands/agent-canvas/settings | Settings screens and forms |
@openhands/agent-canvas/sidebar | Sidebar navigation components |
@openhands/agent-canvas/terminal | Terminal emulator component |
@openhands/agent-canvas/i18n | Internationalization resources |
For contributor and developer workflows, including frontend-only mode, mock mode, environment variables, and build/test commands, see DEVELOPMENT.md.
FAQs
Agent Canvas UI for OpenHands - run AI coding agents with a visual interface
The npm package @openhands/agent-canvas receives a total of 2,041 weekly downloads. As such, @openhands/agent-canvas popularity was classified as popular.
We found that @openhands/agent-canvas demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.