> ## Documentation Index
> Fetch the complete documentation index at: https://beige.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> A secure way to give agents the full power of bash

<Frame>
  <img src="https://mintcdn.com/beige/ESEm6LpcyotkSsfm/assets/beige_landscape.png?fit=max&auto=format&n=ESEm6LpcyotkSsfm&q=85&s=d55c46533b9cd0276319e5578fae8dda" alt="Beige Landscape" title="Beige Landscape" className="mx-auto" width="1100" height="549" data-path="assets/beige_landscape.png" />
</Frame>

Beige is a secure, open-source, sandboxed agent system where AI agents write and execute code inside Docker containers. The gateway orchestrates LLM calls, enforces policies, audit-logs every tool invocation, and routes tool execution.

## Key Features

### What's common to tools like [OpenClaw](https://openclaw.ai/)

* **Plugins** — Extensible plugin system for tools, channels, hooks, and skills
* **Channels** — Interact via TUI (built-in), Telegram (plugin), HTTP API, or custom channels
* **Skills** — Read-only knowledge packages for agent context
* **Policy Enforcement** — Fine-grained control over what agents can do
* **Audit Logging** — Every tool invocation is logged for accountability

### What's *different*

* **[Tools become CLI executables](/why-beige#-true-autonomy)** — Agents write scripts that call tools directly, eliminating round-trips through the LLM
* **Docker Sandboxing — always** — All code execution happens in isolated containers with no escape hatch. Communication to the gateway via sockets.
* **Nothing out-of-the-box** — You configure agents the way YOU want

## Why?

Why build a new agent system if [Openclaw](https://openclaw.ai/), [Picoclaw](https://github.com/sipeed/picoclaw) and others already exist?

What's so different with Beige?

Find out on [Why Beige](/why-beige).

## How It Works

Beige uses a **two-host model**:

```mermaid theme={null}
graph TB
    subgraph "Gateway (AlwaysRunning)"
        CH[Channel Processes]
        AM[Agent Manager]
        PE[Policy Engine]
        AL[Audit Logger]
        SM[Sandbox Manager]
        SS[Socket Server]
    end

    subgraph "External Channels"
        TUI[TUI — built-in]
        PLUG[Plugin Channels]
        TUI -->|HTTP API| CH
        PLUG --> CH
    end

    subgraph "Docker Sandboxes"
        SB1[Agent 1 Sandbox]
    end
    SB1 -->|Unix socket| SS
```

**The Gateway** is the orchestrator. It loads plugins, manages Docker containers, routes tool calls, enforces policies (deny by default), logs every action, and serves channels.

**The Sandbox** is where each agent runs — an isolated Docker container with a writable `/workspace`, plugin tools on `$PATH`, read-only skill mounts, and no access to host secrets or environment variables.

## Next Steps

<CardGroup cols={2}>
  <Card icon="download" href="/installation" title="Installation">
    Install Beige, configure your first agent, and run it
  </Card>

  <Card icon="shield" href="/why-beige" title="Why Beige">
    The motivation, inspiration, and use cases behind Beige
  </Card>

  <Card icon="sitemap" href="/gateway" title="The Gateway">
    Deep dive into architecture and the security model
  </Card>

  <Card icon="sliders" href="/agents/configuration" title="Config Reference">
    Complete config.json5 reference — all fields and validation rules
  </Card>
</CardGroup>