Is NVIDIA OpenShell free?
Yes. NVIDIA documents OpenShell as Apache 2.0. NVIDIA Sentry on BlueField-4 is a separate, optional hardware layer without a public software price in the September 28, 2026 announcement.
Beam vs NVIDIA
Beam vs Open Agent Safety Platform
NVIDIA Open Agent Safety Platform is a containment stack: Apache-2.0 OpenShell sandboxes agents with kernel-level policy, and NVIDIA Sentry can enforce that policy in BlueField-4 silicon on the path to the model. Beam is a local-first control layer for coding agents already on a laptop: workspace observe/advisory/enforce, Claude Code and Codex hook denies, Sentinel pause/block on browser AI chats, and heuristic skill/MCP scanning. They sit on different layers and are not substitutes.
Beam vs Open Agent Safety Platform, side by side
Details below are drawn from a September 2026 review of the AI agent security market. Some figures are vendor-sourced or analyst estimates, and this is a fast-moving space — check with each vendor before you buy.
| Beam | Open Agent Safety Platform (NVIDIA) | |
|---|---|---|
| What it is | Local-first activity monitor, policy enforcement, and pre-run scanner for AI coding agents, with a Sentinel browser extension for AI chats. | Open sandbox runtime (OpenShell) with optional in-silicon monitoring and enforcement (NVIDIA Sentry on BlueField-4). |
| Monitoring | Shell commands, file changes, tool calls, network endpoints and browser actions from harnesses such as Claude Code, Codex and Cursor, plus Beam Sentinel checks on supported AI chat sites before send. Normalised into local NDJSON with risk flags and evidence attached. | OpenShell's supervisor mediates filesystem, process, network and inference access and records policy decisions (NVIDIA documents an OCSF audit trail). NVIDIA Sentry on BlueField-4 correlates agent interactions, policy decisions, and tool and data access out of band, on the node's path to the model in a Vera Rubin POD. |
| Skill / MCP scanning | Yes. SKILL.md files and MCP configurations are scanned before you run them, using 11 heuristic patterns plus an MCP version-pin check. Workspace admins can also block an MCP server for the org or one user. | Not a dedicated pre-run SKILL.md scanner. The OpenShell 0.1.0 walkthrough says the supervisor can inspect configured HTTP, GraphQL and MCP traffic at runtime. |
| Blocking / enforcement | Yes. Workspace owners and admins set observe, advisory, or enforce policy. Enforce denies matching tool calls on Claude Code and Codex PreToolUse hooks. The Sentinel Chrome extension pauses or blocks high-risk browser sends and can hold a send after redacting live secrets. | Yes. OpenShell enforces declared policy outside the agent process. NVIDIA Sentry extends enforcement into BlueField-4 silicon. This is containment, not an observe-only hook. |
| Individual use | Free for one person on one machine. Team workspaces add owner/admin roles, org baselines, stricter member overrides, MDM, and a control plane. | OpenShell is free for anyone who can run the runtime (Docker, Podman, Kubernetes or VM backends per NVIDIA's docs). Sentry requires BlueField hardware. |
| Deployment | Local collector plus a workspace dashboard. Apple and Windows MDM. Sentinel Chrome extension for browser AI chats. Licensed self-hosted control plane for teams that need it on their own infrastructure. | OpenShell: a gateway plus per-sandbox supervisor, documented on Docker, Podman, Kubernetes and VMs, and compatible with hardware beyond Vera. Sentry: NVIDIA BlueField-4 via DOCA; NVIDIA says enabling it on an existing Vera + BlueField-4 system is a software update. |
| Source / licence | AGPL-3.0 for the local CLI and collector; the multi-user control plane is proprietary. | OpenShell is Apache 2.0. NVIDIA Sentry and BlueField-4 are NVIDIA hardware and software, not the same open runtime. |
| Pricing | Free for individual, single-machine use. Team plans from $10/seat/month. | OpenShell is free under Apache 2.0. NVIDIA Sentry on BlueField-4 is an optional hardware layer; no public software price is listed for Sentry. |
Open Agent Safety Platform in numbers
As reported in our source research. Some figures are estimates.
- Announced
- September 28, 2026, NVIDIA Technical Blog
- OpenShell licence
- Apache 2.0
- OpenShell version in the walkthrough
- 0.1.0
- Isolation
- Kernel-level sandbox; NVIDIA documents Landlock for files and seccomp-mediated network opens on Linux
- Optional silicon layer
- NVIDIA Sentry on BlueField-4, on the node's only path to the model in a Vera Rubin POD
- Policy
- Files, networks, tools, processes and credentials, with a formal policy prover before changes apply
- Perplexity SPACE third-party test (Sep 2026)
- No demonstrated HTTP/HTTPS hostname-to-IP switch bypass in Perplexity's named sample; eight of ten other sandboxes failed at least one
Where Open Agent Safety Platform does more
- It enforces policy out of band — a supervisor and optional DPU the agent cannot rewrite. Beam's deny is hook-based (Claude Code and Codex PreToolUse) plus Sentinel in the browser; it is not a kernel sandbox.
- OpenShell is free and Apache 2.0, with a documented policy prover and credential injection only for approved endpoints.
- On Vera Rubin POD hardware, BlueField-4 sits on the only path to the model, which is a kill switch Beam cannot offer.
Where Beam differs
- Beam watches coding agents already running on a developer laptop — Claude Code, Cursor, Codex — without requiring you to move those sessions into a new sandbox runtime.
- Beam scans a SKILL.md or mcp.json as its own pre-run step, which NVIDIA's platform does not replace with a dedicated file scanner.
- Beam stores a redacted local timeline and needs no NVIDIA CPU, DPU or cluster. OpenShell and Sentry are a different install and a different job.
Beam’s current gaps
- Enforce is hook-based: a native deny is wired for Claude Code and Codex PreToolUse. Cursor, Copilot CLI and Gemini currently get a deny note, not a verified block.
- Missing, unreadable or expired cached policy allows the action. Beam is not a fail-closed kernel sandbox or an in-silicon watchdog.
- Scanning is heuristic pattern matching. It produces false positives, misses novel phrasing, and is not a guarantee of safety.
- There is no SOC 2 report and no default SIEM forwarder. Kernel isolation like OpenShell remains a different layer.
Which one fits
If you can run agents inside OpenShell — and especially if you already have Vera and BlueField-4 — NVIDIA's stack is the stronger containment story and we would not argue otherwise. Beam is the tool for the other question: what did the IDE agent on this machine actually do, can owners and admins deny matching tool calls and browser sends, and does this skill or MCP config look risky before you run it. They can coexist.
FAQ
Does OpenShell block actions Beam cannot contain?
Yes, in a different way. OpenShell's supervisor mediates filesystem, process, network and inference access outside the agent. Beam can deny matching Claude Code and Codex tool calls under workspace enforce policy and pause or block high-risk browser sends via Sentinel, but missing or expired cached policy is fail-open, and it is not a kernel sandbox.
Do I need BlueField-4 to compare this with Beam?
No. OpenShell is the open runtime and NVIDIA says the platform is compatible with other hardware. BlueField-4 is required for the in-silicon Sentry layer, not for running a sandbox.
Can I run Beam and OpenShell together?
They address different layers, so yes in principle: OpenShell contains agents you put in a sandbox; Beam records coding-agent activity on a workstation and can enforce workspace policy on hooks and Sentinel. NVIDIA's announcement does not describe a Beam integration.
See how Beam works
Beam is an early, local-first prototype. Read what it actually does today before comparing it further.