OpenHands

There is no documented export of the whole agent and no matching import. First-party exports cover only single automations (JSON, with import) and single conversations (Markdown/HTML transcript or trajectory zip, with no import). Moving the agent means copying ~/.openhands, whose layout and backup procedure are not documented, plus browser localStorage.

• Conversation menu exports
• Automation export/import
• State dir layout in launcher
• Backend registry in localStorage
• Troubleshooting (state kept on uninstall)

All agent state lives on the owner's machine (JSON event files, base_state.json, encrypted settings/secrets, automations SQLite, skills and memory files), so nothing stays with the provider. However, built-in GitHub, Bitbucket DC and Jira DC automation triggers are designed around events forwarded and signed by the OpenHands server, and OAuth-based MCP marketplace entries need the hosted integration-auth flow. Those integrations cannot be re-linked without the provider.

• Persistence layout
• Built-in webhook sources signed by OpenHands server
• Unconfigured without shared secret
• MCP marketplace hides hosted-OAuth entries locally

The whole self-hosted stack (Canvas, agent-server, SDK, tools, automation) is MIT-licensed and runs locally from versions pinned in config/defaults.json. No licence check, account or provider service is needed to start or act. The default provider-bound calls (PostHog telemetry, npm update check) are non-essential. Hands-on blocked-domain testing was not performed.

• MIT licence
• SDK MIT licence
• Automation MIT licence
• Pinned versions
• Update check (npm registry)

Models are accessed through LiteLLM with owner-supplied keys. Local open-weight models (Ollama, LM Studio, vLLM) are documented with a minimum context window. A prompt-based tool-calling fallback exists for models without native function calling, and tools run in the runtime rather than as hosted model features. Not verified hands-on.

• LiteLLM-based LLM
• Non-native function calling fallback
• Minimum context window
• Local LLMs docs

In the self-hosted offering all state stays on the owner's machine under ~/.openhands, so provider termination, a ban or a shutdown cannot remove it. Uninstalling does not delete it.

• State directory
• Troubleshooting (state kept on uninstall)

State is stored in open formats: per-event JSON files, base_state.json, a SQLite automations DB and Markdown skills and memory. Secrets are Fernet-encrypted with a key stored locally (owner-held). No published schema or state-layout document exists; the format is defined only by source code, and the conversation path differs between npm (dev_conversations) and Docker installs.

• Event file layout
• Secret encryption
• Owner-held secret key file
• Docker conversation path

The UI shows the system message and available tools per conversation. Condensation summaries are persisted as events and included in the trajectory download. There is no view of the fully assembled context for a given LLM call, and the public evidence does not show whether injected user-message suffixes and skill triggers are visible, so one context-content shortfall is counted (G12). Model, tools, confirmation and analyzer settings are visible in Settings.

• System message / tools modal
• Condensation event
• Message suffixes

The agent's state stays local. On the default path, however, the provider receives PostHog telemetry about the owner's activity: an install event before consent, plus usage events after the pre-checked consent box. The privacy policy gives no bounded retention ('as long as reasonably necessary'), and the owner cannot view these records.

• Install event before consent
• Tracked events
• Privacy Policy

No paid placement was found in the inspected source. First-party defaults are visible and replaceable: the Add Backend dialog preselects OpenHands Cloud, the OpenHands LLM provider appears in the model list, and the default prompt asks for an 'openhands' co-author trailer. There is no binding no-steering commitment, and the ranking inside the bundled @openhands/extensions catalogue was not inspected.

• Add Backend preselects cloud
• Co-author trailer in prompt
• Bundled extensions catalogue

Every action and observation, including terminal, file edit, browser, MCP and ACP tool calls with their arguments and results, is persisted as a JSON event before subscribers are notified. Subagents are persisted as child conversations, and automation runs are recorded with trigger source and linked conversation. A failed persist raises rather than failing silently, and events are not pruned by default. Graded from source; not verified hands-on.

• Persist-before-notify callback
• Append-only EventLog
• Subagent persistence
• Automation run records

The event log has no hashing, signing or chaining, so edits or deletions cannot be detected.

• EventLog implementation

In the default local runtime the agent's terminal and file tools run as the same OS user and are not confined to the workspace, so they can modify or delete the persisted event files. The per-conversation Docker mode also mounts the conversation's persisted state into the sandbox.

• Default runtime local
• File editor path check
• README Option 3 mounts persisted state

Source for every required component is MIT-licensed. The Canvas npm package is published with npm provenance, but the agent-server and SDK PyPI packages that the launcher installs are published with a token and no attestation. So the default build of a required component cannot be tied to source independently.

• Architecture: npm provenance
• SDK PyPI release workflow
• Launcher installs agent-server from PyPI

The agent has no identity of its own: no keypair, DID or signed actions. Outbound actions use the owner's tokens, and the default prompt suggests an 'openhands <openhands@all-hands.dev>' co-author trailer.

• Co-author trailer in prompt

The product offers change history for some state only. Automations can be synced two-way to a git repository (Git Sync), and conversations have fork/branch history. Settings, LLM profiles, skills, memory, secrets and model or runtime changes have no change log, attribution or restore.

• Git Sync (automations only)
• Conversation branch tree

The owner can add instruction layers (AGENTS.md, skills, SOUL.md identity line) and disable bundled skills in the UI. Replacing the base system prompt (system_prompt, system_prompt_filename) is exposed only as SDK agent fields, not in the Canvas settings or in documented config (G3).

• Prompt override fields
• SOUL.md
• Skill enablement

Persistent memory is plain Markdown the owner can itemise, edit and delete with any editor: AGENTS.md, ~/.openhands/memory/MEMORY.md, the workspace .openhands/memory and skills. No hidden profile store was found.

• Memory files
• Skills docs

Owners can add any MCP server (stdio, SSE or HTTP) and custom skills without review. Built-in tools can be removed only through SDK agent fields (include_default_tools, filter_tools_regex); the Canvas UI toggles only a few (sub-agents, switch-LLM).

• Tool selection fields
• Canvas tool toggles
• MCP settings docs

No locked provider protection was found. Sandboxing mode, confirmation mode, the security analyzer and telemetry are all owner-configurable, and the default protections are already off. The prompt's security policy can be removed via security_policy_filename.

• Security settings defaults
• security_policy_filename

The self-hosted stack pins the agent-server, automation and extensions versions, updates are manual (npm/docker commands shown in the UI), and no remote feature flags were found. Note: conversations launched via agent profiles re-fetch public skills from the OpenHands/extensions main branch (60 s cache) unless EXTENSIONS_REF is set; the default launch path uses bundled, pinned skills.

• Pinned versions
• Manual update card
• Local feature flags
• Default path disables public skill fetch
• Public skills ref main

There are no per-recipient or per-domain contact limits and no egress policy; the contact dimension is missing. In the default local runtime the agent can edit its own settings and hook files under ~/.openhands and the workspace, a bypass path. Spend was treated as met because the product has no payment capability (G11).

• Default runtime local
• Hooks config
• Backends warning

Confirmation mode (off by default) gates either every action or only those the LLM analyzer rates risky, which is the model's own risk label. The UI has no per-tool or per-class gate, and PreToolUse hooks can block but not request approval.

• Confirmation defaults
• LLM analyzer uses model label
• Hook types

Each conversation can be paused or stopped and each automation turned off, but there is no single global stop for all conversations and scheduled automations.

• Pause/interrupt API
• Automation state
• Conversation stop

Usage telemetry is effectively opt-out: the consent checkbox is pre-checked, and the agent-server and automation service are launched with PostHog keys. A canvas_install event with user agent, referrer and origin URL is sent before any consent, and it is disclosed only in a code comment. The privacy policy does not address staff access, and changes take effect on posting.

• Pre-checked consent
• Pre-consent install event
• Backend telemetry env
• Privacy Policy

Secrets are listed by name and deletable in Settings, LLM keys live in deletable profiles, and git tokens are ordinary secrets. The provider holds no credentials on this path. Public evidence does not settle whether MCP OAuth tokens stored in the settings store are visible or revocable individually, so the pass is withheld (G12).

• Secrets API
• Secrets UI
• MCP settings docs

There is no single owner action that deletes the whole agent. Conversations ('Delete all'), automations and secrets are deleted separately, ~/.openhands survives uninstall, and deleting provider-held telemetry requires emailing the provider.

• Delete all conversations
• Troubleshooting (state kept on uninstall)
• Privacy Policy