Omnara, a 3,200-Star Apache-2.0 Rival to Claude Managed Agents, Ships With Defaults Its README Calls Insecure
A.I. / news
Omnara, a 3,200-Star Apache-2.0 Rival to Claude Managed Agents, Ships With Defaults Its README Calls Insecure
The omnara-ai project runs agents on any model through a Postgres-backed event log and a daemon that dials out. Its README does not name the team behind it.
Omnara, an Apache-2.0 project that pitches itself as "the open-source managed agent platform," reached 3.2k stars and 244 forks on GitHub this week after a Show HN post that drew 104 points on Hacker News. Its README says the local defaults are "intentionally insecure."
The repository belongs to the omnara-ai organisation. The README names no founders or maintainers, and it does not mention any earlier version of Omnara.
How it works
An API handles launches, input and event streams. Postgres stores every agent's event log, so any worker can resume an agent after a crash. Stateless workers run the agent loop and call models and tools.
Each machine runs a daemon called omnarad that connects outward, so no inbound ports are needed. Omnara accepts any model behind an OpenAI Responses, OpenAI Chat Completions or Anthropic Messages compatible endpoint, with OpenRouter, Amazon Bedrock, LiteLLM and Ollama named as examples.
Sandboxes come from eleven providers, or from macOS and Linux machines running the daemon. The command line needs Node.js 22 or newer, and building from source needs Node.js 24 and Docker Compose. The repository showed 623 commits, 6 open issues and 24 open pull requests.
The comparison the project draws
The README sets Omnara against Claude Managed Agents and OpenAI's Agents API. Those are the project's own descriptions of its competitors.
| Omnara | Claude Managed Agents | |
|---|---|---|
| Source | Open, Apache-2.0 | Closed |
| Models | Any compatible endpoint | Claude only |
| Hosting | Omnara Cloud or self-hosted | Anthropic's cloud |
| Price | Self-hosting free | Claude token rates plus $0.08 per session-hour |
The $0.08 figure checks out. Anthropic's pricing page lists session runtime at $0.08 per session-hour, billed to the millisecond only while a session is in the running state. Time spent idle, waiting on the next message or a tool confirmation, is not charged.
The README adds that Claude Managed Agents history is "not currently eligible for Zero Data Retention or HIPAA BAA coverage," and says OpenAI's Agents API has no Zero Data Retention support and offers US data residency only. The Terminal did not verify those two claims, which come from a competitor.
Security and what is unknown
The README lists role-based access control, secrets stored once and shared with each project on request, and per-tool permissions set to run, ask or block. It points production users to a self-hosting guide, and the page links a SECURITY.md file whose contents were not visible.
Stars measure interest, not adoption. The project publishes no user count, and the README names no customer. Omnara Cloud is free with your own keys and machines, with a paid option for Omnara's models and sandboxes, but the README gives no prices for the paid tier.
For another agent tool that arrived with its own documentation gaps, see our report on OpenAI's Go-based CLI and its README. Anthropic's own take on a long-running agent is covered in our Claude Duet report.
Omnara has set no release date or versioning scheme in the README. Self-hosters can start the stack with docker compose -f compose.yaml --profile app up -d, which serves the app on port 8000.
Sources
More in A.I.
- 01WorldTUI Is a 360M-Parameter Model That Fakes a Linux Terminal, and Its Weights Are Not Out YetSimon Edwardsson of V7 trained a trimmed Qwen2.5-Coder on 2 billion tokens of recorded shell sessions. It scores 80 of 106 on his own test and still forgets files it just wrote.
- 02Meta Paused Muse Chat Sharing After 6,800 Share Hostnames Turned Up in DNS RecordsClaroc found that Muse put each shared conversation's title into its web address, and passive DNS databases kept the addresses. Meta suspended sharing on October 20 and has not said what happens to existing links.
- 03Laminar's flow-1 Costs $0.0011 a Trace, but Claude Opus 5 Scores Higher on Its Own BenchmarkThe Y Combinator S24 company says its reinforcement-learned error finder matches GPT-6-sol at one-twentieth of the cost. Its launch post and its benchmark table put the multiple at 20 and 23, and show a higher score for Opus 5.
- 04OpenAI Says AI Found the PHP Flaws Before Attackers. Cloudflare Says They Leaked and Drew Attack TrafficThe two Oct. 21 accounts of the php2shell disclosure measure different things. Trail of Bits' Patch the Planet dashboard shows 466 of 1,995 reported issues patched.