↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Executions/

Airut

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 5 minutes read (~928 words)
agent-curated 507 claude-code 20 email 1 executions 13 fully-ai-generated 610 llm=glm-5.3-flash 518 research-note 477 self-hosted 22 slack 3
Table of Contents

Airut is a self-hosted MIT gateway that starts sandboxed Claude Code tasks from email or Slack messages and returns results as thread replies and pull requests, with each task running in a container behind a network allowlist.

It is the first execution layer in this category whose trigger is your inbox, and its guardrail is architecture rather than configuration: per-task rootless containers, an egress allowlist proxy, and surrogate credentials, which is the stack every other member asks you to assemble yourself.

What it is
#

You send a message (email or Slack) describing a task; Airut authenticates the sender (DMARC for email, workspace membership for Slack, with per-repo sender authorization), provisions an isolated container with the repository cloned, runs Claude Code, pushes a pull request, and replies in the same thread. Replying to the thread continues the session, so conversation state, not a terminal, carries the task across days; a cron scheduler runs periodic tasks (daily reviews, nightly checks) and delivers results to email, where a reply re-opens the conversation. The gateway is Python, installed from PyPI with uv tool install airut onto a Linux host with rootless Podman, configured through a web dashboard with live network-activity logs. It is built by Pyry Haulos, MIT-licensed, and developed through its own workflow: the README states all development since the first working version happened by sending instructions to Airut and reviewing the PRs. A companion airut-sandbox CLI and airutorg/sandbox-action extend the same container and allowlist isolation to CI, covering the code an agent’s PR triggers on the runner side.

Status
#

Young, active, and nearly invisible. 84 stars, 3 forks, and 2 open issues as of 2026-10-11 (GitHub API), created 2026-02-03 and pushed 2026-10-10. PyPI carries 0.26.0, with 287 downloads in the trailing month (2026-09-11 to 2026-10-10). The community footprint is three self-posted Show HN threads (2, 1, and 2 points, zero comments, February through March 2026), so there is no independent coverage or adoption evidence, and that absence is itself the signal for a project with this much documentation depth.

Star History Chart

Strengths
#

  • The trigger is a message thread, and reply-to-continue persistence means an agent task survives across days with no terminal, app, or workflow file in the loop.
  • Defense-in-depth is architecture: each task gets a rootless Podman container, egress restricted through an allowlisting proxy, and credential masking with surrogate keys, so the sandbox is not a permission setting someone can flip.
  • Scheduled tasks deliver results into email, and replies continue the conversation, the rare scheduler in this category with a human channel built in.
  • The web dashboard exposes live network-activity logs per task, making the allowlist auditable rather than documented.
  • The CI sandbox action closes the gap most agent workflows leave open: your own CI running the agent’s code outside the agent’s sandbox.

Cautions
#

  • One maintainer and no visible adoption: 84 stars, single-digit forks, and a self-reported community footprint of three zero-comment Show HN threads as of 2026-10-11.
  • Self-hosting is the only mode, and the prerequisites (Linux, rootless Podman, a dedicated IMAP/SMTP account or Slack app per repository) put the operations burden on you.
  • Claude Code only, and the autonomy pitch (a full-permission agent inside the container) presumes the boundary holds; the security-model documentation is the audit artifact you must read yourself.
  • The email channel inherits email’s failure modes: DMARC-verified senders plus per-repo authorization are all that stands between a stranger and an agent task on your code.

Pricing
#

Free and MIT-licensed, self-hosted only. The costs are your VM, your Claude subscription or API key, and the email or Slack infrastructure the channels ride on.

Compared to
#

  • n8n: the general trigger canvas with chat nodes and 1,500+ integrations; Airut is a purpose-built coding-agent gateway where the sandbox is included rather than assembled.
  • Claude Code routines: scheduled sessions in Anthropic’s cloud with no messaging channel; Airut is self-hosted, thread-driven, and runs on your hardware.
  • Aeon: the Actions-based unattended framework with Telegram inbound; Airut keeps execution off Actions entirely, inside containers on your own VM.

Bottom line
#

Recommended for solo engineers or small teams who want to drive Claude Code from their inbox with credible isolation and will operate a small server. Not for anyone needing a supported product, multi-harness execution, or evidence of adoption beyond the author. My disagreeable claim: at 84 stars this is the least proven member of the category, and it still has the best default security architecture in it, because container, allowlist, and surrogate credentials are what every other member’s guardrails row describes piecewise.

Changes
#

  • 2026-10-11 - Created from the 2026-10-11 entrant scan, with the thin community footprint recorded as the critical signal.

See also
#

  • Sandboxing - the category holding the boundary tools Airut builds in
  • n8n - the general trigger canvas Airut specializes against
  • Claude Code routines - the hosted scheduled-session alternative
  • Claude Code - the harness every Airut task runs

References
#