OpenHands Agent Canvas: Run Coding Agents Yourself (GitHub, Scanned)

OpenHands, formerly OpenDevin, is the reference open-source coding agent: give it a task and a repository and it plans, edits files, runs commands, reads the output and tries again, inside a sandbox rather than on your machine. This repository is where the project now lives for users. It has become Agent Canvas, a self-hosted control centre: a web and desktop app that starts conversations with the OpenHands agent, and with Claude Code, Codex, Gemini or any agent that speaks the Agent Client Protocol, across backends on your laptop, in Docker, on a VM or in the cloud.

The canvas adds what a terminal agent lacks: automations that run on a schedule or on a webhook (decompose a GitHub issue into tasks, post a report to Slack), a way to switch between backends without losing your place, and a model picker that takes any LLM. The agent itself, the sandbox and the Python SDK live in the separate software-agent-sdk repository; this one is the TypeScript application that drives them. Both are MIT-licensed and backed by the same company.

• Repository: github.com/OpenHands/OpenHands
• Licence: MIT (MIT License)
• Language: TypeScript. Stars: 88.1K. Forks: 11.6K. Last push: Sep 16, 2026.
• Scan: clean, read the notes, Sep 15, 2026, commit 82203bb

Who it is for

Developers who want an always-on agent working in their repositories with a model of their choosing, teams that want one place to run several coding agents against local or private infrastructure, and anyone who wants to read how a production agent stack is put together.

Getting started

1. Install with npm (Node 22.12 or newer and uv required); this runs the agent on your machine with full access to your files

npm install -g @openhands/agent-canvas && agent-canvas

2. Or run it in Docker, confined to a folder of projects

export PROJECTS_PATH="$HOME/projects" && mkdir -p "$PROJECTS_PATH" "$HOME/.openhands" && docker run -it --rm -p 8000:8000 -v "$HOME/.openhands:/home/openhands/.openhands" -v "$PROJECTS_PATH:/projects" ghcr.io/openhands/agent-canvas:1.18.0

3. Open the canvas, add a model under Settings, and start a conversation

open http://localhost:8000

The README carries the same warning twice: the npm and from-source installs run the agent server directly on the host, where it can reach everything you can. Use the Docker option on a machine you share, and give it a branch rather than production keys.

Safety scan

We cloned OpenHands/OpenHands at commit 82203bb on Sep 15, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets: the eight candidates are fake GitHub and Slack tokens in the tests for a secret-redaction feature. No self-decoding code, no bare-IP URLs, no committed binaries.
• The pattern hits are setup scripts installing uv from astral.sh, in development and end-to-end test helpers.
• Two npm lifecycle scripts: a postinstall that prints a welcome message when installed globally, and prepare, which installs husky git hooks. Neither fetches anything.
• Known advisories: 30 in the single lockfile, none critical, and every high one in @xmldom/xmldom, a transitive frontend dependency. The Python side, and so its dependencies, live in the software-agent-sdk repository.
• 19 workflows. Four use pull_request_target: the PR checks are written to avoid checking out the pull request, and the artifacts job runs only after an approved review and skips forks. 3 of 14 third-party actions pinned to a commit; Dependabot on.
• No security policy file in the repository or in the organisation's .github repository at the time of the scan.
• The npm quickstart runs the agent server directly on your machine with full filesystem access, and the README says so in a warning. The Docker option confines the agent to the project folders you mount.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 306.5K, JSON 42.5K, JavaScript 13.4K, Markdown 4,394, YAML 4,011, Python 2,721.

Questions

Is OpenHands free?

The software is MIT-licensed and free. What costs money is the model: a long agent session can use millions of tokens, so a hosted model bill adds up quickly, and a local model needs serious hardware to be useful. OpenHands Cloud is the paid hosted version with credits included.

How does OpenHands differ from Claude Code or Codex?

Claude Code and Codex are agents from model vendors, tuned to their own models. OpenHands is model-agnostic and self-hosted: you choose the model, the sandbox runs where you say, and the whole agent loop is open to read and change. Agent Canvas can also run Claude Code and Codex as backends, so it is less a rival than a place to run all of them.

Is it safe to let OpenHands run commands?

It depends on how you install it. The Docker option runs the agent in a container that sees only the project folders you mount. The npm install runs the agent server on your host with your permissions, which the README warns about twice. Either way the agent can do unwise things with what it can reach, so give it a branch, review its diffs, and do not hand it production keys.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.