Run LLM agents on your own hardware, each one in its own box.

How a run works

1. 1POST /v1/runs queues the task, with any PDFs or images attached, and answers 202 right away.
2. 2When a slot frees up, cedar spins up a fresh sandbox container for the run. If you asked for a plan, the model breaks the task into steps first, and an interactive run waits for you to agree to them.
3. 3The model gets the conversation and the tools you chose. Tool calls run in the sandbox and results go back, errors included so it can recover. Risky calls (sending mail, installs, deletes) can wait for your approval.
4. 4Loop until the model is done, asks you a question, hits max_turns, or runs out of time.
5. 5The sandbox is destroyed. The run ends completed, failed, or cancelled, with everything logged to SQLite, and a webhook tells you it's over. Its workspace stays for a follow-up.

Quick start

# 0. any OpenAI-compatible model server
vllm serve deepseek-ai/DeepSeek-V4-Flash \
  --trust-remote-code --tokenizer-mode deepseek_v4 \
  --enable-auto-tool-choice --tool-call-parser deepseek_v4

# 1. the sandbox image, then the server
docker build -t cedar-sandbox sandbox/
export CEDAR_API_KEYS=$(openssl rand -hex 24) \
  CEDAR_ADMIN_KEYS=$CEDAR_API_KEYS
cargo run --release

# 2. register the model, start a run, follow it live
curl -s -X PUT -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"base_url": "http://localhost:8000/v1",
       "model": "deepseek-ai/DeepSeek-V4-Flash"}' \
  localhost:8080/v1/admin/models/deepseek
curl -s -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"prompt": "write hello.py, run it"}' \
  localhost:8080/v1/runs
curl -N -H "Authorization: Bearer $KEY" \
  localhost:8080/v1/runs/<id>/events

Write a tool in Python, share it on GitHub

A tool is a folder: a tool.json that tells the model what it does, and a Python script that reads JSON on stdin and prints its answer. No Rust, no rebuild.

The manifest also says what the tool needs: the hosts it reaches, the secrets it reads, the packages it installs, and whether it handles health data. cedar holds it to that. Every call runs in a container of its own that sees only that tool, gets the network only if it declared hosts, and gets only its own secrets, saved encrypted in the settings, never in a file.

Community tools are not officially supported, so each call waits for your OK until you allow that version. Health tools come with built-in rules: informational only, safety first, and never a dose or a device setting. The first one in the registry reads a Tandem insulin pump and CGM and compares your last day with the week before.

# tools/air_quality/tool.json
{
  "description": "Current air quality for a city.",
  "version": "1.0.0",
  "author": "You",
  "license": "Apache-2.0",
  "input_schema": {
    "type": "object",
    "properties": { "city": { "type": "string" } },
    "required": ["city"]
  },
  "network": ["api.openaq.org"],
  "secrets": ["OPENAQ_API_KEY"],
  "pip": ["requests>=2.31"]
}

# tools/air_quality/tool.py
import json, os, sys
import requests

args = json.load(sys.stdin)
r = requests.get(
    "https://api.openaq.org/v3/locations",
    params={"city": args["city"], "limit": 1},
    headers={"X-API-Key": os.environ["OPENAQ_API_KEY"]},
    timeout=20,
)
if not r.ok:
    sys.exit(f"OpenAQ said {r.status_code}")  # the model sees it
print(json.dumps(r.json()["results"][:1]))

# share it
python3 registry/build_index.py --check