What is AgentFS?
AgentFS keeps everything an agent touches in a single SQLite database built on Turso, the company's SQLite-compatible engine. Inside that one file sit three things: a POSIX-style filesystem stored as inode and directory-entry tables, a key-value store for state, and an append-only log of tool calls. Because it is one file, a snapshot is a plain copy of the database, and the agent's history is something you query with SQL rather than reconstruct from logs.
The project ships SDKs for TypeScript, Python, Rust and Go, and a CLI that mounts the database as a real filesystem (FUSE on Linux, NFS on macOS), runs a program in a copy-on-write sandbox with `agentfs run`, prints the tool-call history with `agentfs timeline`, and serves the files and key-value store over MCP or NFS. Optional sync pushes the database to Turso Cloud; local encryption at rest is the alternative, and the two cannot be combined.
Is AgentFS worth it?
The useful part of AgentFS is the single file. An agent's working files, its key-value state and a record of every tool it called land in one SQLite database, so rolling back a bad run means copying an earlier snapshot back, and finding out what went wrong means a SQL query rather than a trawl through logs. Turso's Pekka Enberg and Glauber Costa announced it on 13 November 2025, and the repository has about 3,500 GitHub stars.
The CLI does more than the SDK alone suggests. `agentfs run` starts a shell or a coding agent over a copy-on-write overlay of your project: writes go into the database and the original files stay untouched, using user namespaces on Linux and Apple's sandbox on macOS. `agentfs mount` exposes the database as an ordinary directory so tools such as git and grep work unchanged. The README is candid that git worktrees only separate agents by convention, while the overlay is enforced below the agent. The npm package recorded 23,397 downloads in the week to 12 November 2026.
It keeps data locally by default, in .agentfs/<id>.db under the project. `agentfs serve nfs` listens on 127.0.0.1 port 11111 unless you bind it elsewhere, and anyone who can reach that port can mount the files. Local encryption supports AES-256-GCM and AEGIS ciphers with a hex key you manage; turning on Turso Cloud sync rules encryption out.
The catch: maturity. Version 0.6.0 on 5 February 2026 was the first beta, the README still warns against trusting it with production data without backups, and the latest release, v0.6.4, came out on 25 March. The last commit on the main branch, on 3 June, was a lint fix, and the tracker shows 59 open issues and 18 open pull requests. Schema changes need `agentfs migrate`, and the stricter ptrace-based sandbox is marked experimental and Linux-only.
Our take: for people building agent infrastructure who want undo and an audit trail without writing their own, AgentFS is the neatest design around; for a single coding agent on your laptop, git and a container already cover most of it.
Where it earns its place
An engineer at a company running coding agents on customer repositories
Let an agent change files freely and throw the changes away if the run goes wrong
Start the agent with `agentfs run` so its writes land in an overlay database; keep or discard that file afterwards. The software is free; the cost is the beta risk and the time to wire it into your runner.
A platform team that must show auditors what an agent did
Answer which files an agent wrote and which tools it called, in what order
Record tool calls through the SDK and query the append-only log and file tables with SQL, or read `agentfs timeline`. Archiving the database file per run keeps the evidence in one place.
A developer building an agent on serverless or in the browser
Give the agent a working filesystem where no disk can be mounted
Open an AgentFS database through the TypeScript SDK, which the project also demonstrates on Cloudflare Durable Objects and in WebAssembly. Optional sync to Turso Cloud carries the state between machines.
Before you commit
- Setup
- Install the CLI with the curl installer from the releases page, then `agentfs init my-agent` creates .agentfs/my-agent.db; SDKs install with `npm install agentfs-sdk`, pip or cargo.
- Integrations
- Examples for Mastra, Claude Agent SDK, OpenAI Agents SDK, Vercel AI SDK with just-bash, Cloudflare Workers and Firecracker; MCP and NFS servers built into the CLI.
- Data and privacy
- Everything stays in a local SQLite file unless you configure Turso Cloud sync. Local encryption at rest uses a key you supply; the NFS server binds to 127.0.0.1 by default and exposes the files to anyone who can reach the port if rebound.
- Cost at scale
- The software is free. Turso Cloud sync is a separate Turso bill; storage grows with every file version and tool call kept in the database.
- Limits
- Beta; schema upgrades need `agentfs migrate`; FUSE on Linux and NFS on macOS only; the ptrace sandbox is experimental and Linux-only; encryption and sync are mutually exclusive.
What’s good
- Files, key-value state and tool calls live in one SQLite file you can query with SQL
- Snapshots and rollback are a file copy
- Copy-on-write sandbox leaves the real project untouched on Linux and macOS
- SDKs for TypeScript, Python, Rust and Go, plus MCP and NFS servers
What’s not
- Beta software; the README warns against production data without backups
- No release since v0.6.4 on 25 March 2026
- Encryption at rest and Turso Cloud sync cannot be used together
- No licence file at the repository root, only a licence declared in the README and package metadata
Best for
Teams building agent platforms or sandboxes who want every agent run stored as one inspectable, copyable database.
AgentFS alternatives
AgentFS: common questions
- Is AgentFS worth it?
- AgentFS turns an agent's files, state and tool history into one SQLite file you can query and copy, a clean idea that is still labelled beta and has gone quiet since the spring. We rate it 3.7 out of 5.
- How much does AgentFS cost?
- Free and open source (MIT, per the README and package metadata). Optional sync goes to Turso Cloud, which is billed by Turso separately.
- What are the downsides of AgentFS?
- Beta software; the README warns against production data without backups; no release since v0.6.4 on 25 March 2026; encryption at rest and Turso Cloud sync cannot be used together; no licence file at the repository root, only a licence declared in the README and package metadata.
- Who is AgentFS best for?
- Teams building agent platforms or sandboxes who want every agent run stored as one inspectable, copyable database.
- How much does AgentFS cost for a team or in production?
- The software is free. Turso Cloud sync is a separate Turso bill; storage grows with every file version and tool call kept in the database.
- Is AgentFS safe for company data?
- Everything stays in a local SQLite file unless you configure Turso Cloud sync. Local encryption at rest uses a key you supply; the NFS server binds to 127.0.0.1 by default and exposes the files to anyone who can reach the port if rebound.
- What are the best AgentFS alternatives?
- The closest alternatives we have reviewed are OpenSandbox, Anthropic Sandbox Runtime (srt) and Beads.
Answers checked Nov 13, 2026.