# Shiba

> Shiba is an open-source, self-hosted, approval-gated coding coworker and Devin Cloud alternative. It runs coding tasks in isolated Cloudflare Sandbox containers in your Cloudflare account. Review a diff, and optionally request a pull request when GitHub access is configured.

- Website: https://tryshiba.dev/
- Why I am building Shiba: https://tryshiba.dev/why-shiba/
- Journal (guides and engineering notes): https://tryshiba.dev/blog/
- Join waitlist & contribute: https://tryshiba.dev/waitlist/
- GitHub Source (AGPL-3.0-only): https://github.com/princepal9120/shiba

## Core Architecture & Security

- Edge Orchestrator: Cloudflare Workers + Agents SDK (TypeScript) routing requests at the edge.
- Sandbox containers: Cloudflare Sandbox SDK + Containers provide isolated Linux containers per task.
- Credentials: Provider credentials are added by Worker-side egress handling and are not passed into the sandbox process.
- State & Memory: Cloudflare Durable Objects + SQLite for human approval queues, live logs, and Vectorize for long-term memory.
- Access: Designed to sit behind operator-configured Cloudflare Access for dashboard and runner endpoints.

## Documentation

- [Claude Code](https://tryshiba.dev/docs/agents/claude-code/): Run Anthropic's Claude Code agent CLI in isolated Cloudflare Sandboxes with human approval gates.
- [Codex](https://tryshiba.dev/docs/agents/codex/): Run OpenAI's Codex CLI autonomously within approval-gated Cloudflare Sandboxes.
- [Devin CLI](https://tryshiba.dev/docs/agents/devin/): Deploy Cognition's Devin CLI agent inside isolated micro-containers with least-privilege credential gating.
- [OpenCode](https://tryshiba.dev/docs/agents/opencode/): The default open-source coding agent harness in Shiba, supporting multi-provider AI Gateway routing.
- [API reference](https://tryshiba.dev/docs/api/): Current routes, responses, and SDK approval transport.
- [Approval Gates](https://tryshiba.dev/docs/approval-gates/): Human-in-the-loop safety controls and authorization boundaries in AI Coworker.
- [Architecture](https://tryshiba.dev/docs/architecture/): Components, data flow, and unfinished integration boundaries.
- [Automations](https://tryshiba.dev/docs/automations/): Configure approval-gated scheduled, webhook, Slack, GitHub, and manual automation triggers.
- [Coding Harnesses](https://tryshiba.dev/docs/claude-code/): Coding harnesses, Grok model access, and current implementation and verification status.
- [Configuration](https://tryshiba.dev/docs/configuration/): Current runtime defaults, optional secrets, and what harness verification means.
- [Contributing](https://tryshiba.dev/docs/contributing/): Local verification, documentation contracts, and contribution boundaries.
- [Costs and limits](https://tryshiba.dev/docs/costs/): Account-owned usage without invented prices.
- [Dashboard](https://tryshiba.dev/docs/dashboard/): Compose, approve, observe, and interpret the current interface.
- [Deployment preparation](https://tryshiba.dev/docs/deployment/): Prepare an account-owned installation without confusing local validation with live acceptance.
- [Discord Interactions](https://tryshiba.dev/docs/discord/): Queue and approve coding runs from Discord — same approval gate, no bot hosting.
- [Getting started](https://tryshiba.dev/docs/getting-started/): Install and validate the local project, then review account deployment requirements.
- [GitHub integration](https://tryshiba.dev/docs/github/): Public cloning, optional publishing, and acknowledgment-only webhooks.
- [Local development](https://tryshiba.dev/docs/local-development/): Run the dashboard, Worker, docs, and tests without overstating local or cloud evidence.
- [Use from Claude Code](https://tryshiba.dev/docs/mcp/): Connect Claude Code (or any MCP client) to the Worker's /mcp gateway with a scoped bearer token and queue approval-gated coding runs.
- [Onboarding and setup](https://tryshiba.dev/docs/onboarding/): Prepare a local checkout and understand what has—and has not—been verified for live use.
- [Overview](https://tryshiba.dev/docs/overview/): What AI Coworker runs today, what it returns, and which limits matter.
- [Readiness and acceptance checklist](https://tryshiba.dev/docs/readiness/): Known gaps and evidence required before production use.
- [Security](https://tryshiba.dev/docs/security/): Authentication, credential boundaries, and known limitations.
- [Slack Integration](https://tryshiba.dev/docs/slack/): Connect AI Coworker to Slack for chatops, task delegation, and interactive approval gates.
- [Telegram Integration](https://tryshiba.dev/docs/telegram/): Queue and approve coding runs from Telegram — free, self-hosted, no vendor.
- [HTTP Triggers (iPhone Shortcuts)](https://tryshiba.dev/docs/triggers/): Queue approval-gated coding tasks from an iPhone Apple Shortcut or any HTTP client via POST /api/trigger.
- [Troubleshooting](https://tryshiba.dev/docs/troubleshooting/): Diagnose local builds and distinguish tested behavior from live integration.
- [Waitlist and contributor signups](https://tryshiba.dev/docs/waitlist/): How the public Shiba signup form stores entries and how the operator exports or removes them.

## Journal

Long-form guides and engineering notes. Opinionated prose, same product claims as the docs.

- [An open-source coding agent alternative: a guide to Shiba](https://tryshiba.dev/blog/open-source-coding-agent-alternative/) (Guide): A grounded look at Shiba as an open-source alternative to hosted coding agents, covering what is inspectable, what is gated, and what is not yet proven.
- [Why self-host a coding agent at all](https://tryshiba.dev/blog/why-self-host-a-coding-agent/) (Note): Self-hosting a coding agent only matters if the harness, the model, and the account are all yours, because that combination is what the seat fee never buys.
- [Approvals in Slack, not another dashboard](https://tryshiba.dev/blog/approvals-in-slack-not-another-dashboard/) (Guide): A mention in a Slack thread becomes a pending approval card, and a click from a named approver on that card is what allows a run to start.
- [What a failed run looks like](https://tryshiba.dev/blog/what-a-failed-run-looks-like/) (Journal): Shiba reports failures with a real exit code, a bounded stderr tail, and an error envelope, and never dresses a failure up as a success.
- [Harness and model choices, and what they do not tell you](https://tryshiba.dev/blog/harness-and-model-choices/) (Guide): Shiba lets each run pick a coding harness and model, refuses bad pairings before execution, and publishes no cost or latency numbers.
- [Credentials that never enter the container](https://tryshiba.dev/blog/credentials-that-never-enter-the-container/) (Guide): A walk through what Shiba hands to the sandbox, what it holds back, and where each key is actually attached.
- [Why the approval gate comes before the container](https://tryshiba.dev/blog/approval-gate/) (Guide): Shiba stops a planned coding run at a human decision point, and that gate is the safety invariant the rest of the system is built around.