THERAID PROJECT
Ephemeral AI agents with real infrastructure isolation.
Mission-specific. Zero lingering access.
Most agents are permanent residents.
Broad access. Always running. One mistake and the blast radius is everything. RAID agents are missions. They show up, finish, and leave.
A raid is a mission, not an occupation.
Most agent platforms run persistent processes with broad access. One mistake and everything is exposed.
RAID is the opposite. You define a mission in one YAML file, launch an isolated agent, get the result, and it disappears.
Go in. Do the job. Come home. No permanent footprint.
See the military definition: raid (military).
1. Write the recipe
2. Send it out
3. Do the job
4. Come home
Security is the foundation, not an afterthought.
Trust on first use + strict ownership
Telegram user allowlist or first-caller claim. You can only control agents you created. Rate limits and audit-friendly ownership built in.
Authoritative at the SDK hook
Smart defaults + recipe overrides enforced via Claude Agent SDK PreToolUse. Read and workspace write allowed. Shell, publish, and network tools gated explicitly. Container is the boundary.
Control plane never sees keys
Secrets are resolved by name only at compute time. Each agent container receives only its own recipe secrets. Control plane is deliberately dumb.
The agent comes home
Short TTLs. Complete infrastructure isolation during the mission. Clean state snapshots so the next raid starts exactly where the last one left off.
RAID vs the alternatives
How RAID PROJECT stands apart from the other major open-source agent platforms.
| Dimension | OpenClaw | NanoClaw | Hermes Agent | RAID PROJECT |
|---|---|---|---|---|
| Lifecycle | Always-on | Long-running | Continuous | Ephemeral. Execute then stand down. |
| Isolation | App permissions | Container | Multiple backends | Infrastructure level + adapters |
| Definition | Skills & plugins | On-demand skills | Self-generated | Single YAML mission contract |
| Resume | Always present | Per-agent memory | Long-term memory | Snapshot on return. Next raid resumes. |
| Risk | High | Medium-low | Medium | Lowest. Short TTL + full isolation. |
| Best for | Explorers | Personal use | Personal companions | Teams that send agents and bring them home. |
Built to production standards, not released as an experiment.
- → MIT license. Use and extend freely.
- → Strategy interfaces are the only extension surface you need
- → Real tests and smoke scripts that exercise policy and the real Claude SDK
- → Local-first runnable with zero cloud (npm run serve)
- → Recipes are the product surface. Contribute new ones with zero code.
- → Small core, explicit seams, lazy but finished
Why the raccoon 🦝? Raccoons are legendary raiders — clever, stealthy, and masters of the quick in-and-out job. RAID agents do exactly that.
Built by Eliran Suisa.
Frequently asked questions
Answers for teams evaluating secure agent platforms.
What is the RAID Project?⌄
RAID is an open source platform for running ephemeral AI agents with real infrastructure isolation. A mission is defined in one YAML file (the 'recipe'). The agent boots in full isolation, performs only what the policy allows, returns results, and then stands down completely. No lingering processes or access remain.
How is RAID different from tools like OpenClaw, AutoGen, or CrewAI?⌄
Most frameworks create long-running or always-on agents. RAID agents are short-lived by design. They receive a complete contract (persona, tools, policy, TTL, secrets) and execute inside isolated containers. When the mission ends the container is gone. This dramatically reduces blast radius.
What does 'infrastructure isolation' actually mean?⌄
Each agent runs in its own dedicated container (or compute unit). The control plane never sees your keys or long-term credentials. Secrets are injected only for that mission. Network, filesystem, and process boundaries are enforced by the infrastructure, not just code permissions.
Do agents keep running after they finish?⌄
No. By default agents are ephemeral. They have a TTL. Once the mission completes or the time limit is reached, the agent stands down. State can be snapshotted so a future mission can resume exactly where it left off.
Can I run RAID agents without any cloud?⌄
Yes. The system is local-first. You can run missions completely offline using your local Docker or container runtime. Cloudflare and other strategies are optional adapters.
How do I control what tools and data an agent can access?⌄
Everything is declared in the recipe YAML: allowed tools, secrets by name, policy rules, and TTL. Enforcement happens at the SDK level before any tool is invoked. You can audit exactly what was permitted for every mission.
What users say
“Finally an agent system designed by security people first.”
“One YAML file is now one governed capability. Huge shift.”
“Resume works. Picks up hours later exactly where it stopped.”
“The isolation and portability are what we actually needed.”
We help teams ship agents that know when to leave.
The core is free and open. We also build recipes, set up isolation, and run production missions.