ANOLISA: An Agentic OS Layer for Runtime, Security, and Token Efficiency
ANOLISA (Agentic Nexus Operating Layer & Interface System Architecture) is a server-side operating layer designed to address three core challenges in AI agent execution: terminal integration, token cost management, and secure execution environments. Released under the Apache 2.0 license and developed in Rust, ANOLISA provides modular components that can be enabled independently, ensuring compatibility with existing shell, agent frameworks, and sandboxing tools. Its architecture prioritizes efficiency, security, and observability without requiring modifications to existing agent frameworks or workflows.
The project originated in 2026 as an open-source initiative under the agentic-os-org, with a focus on reducing operational overhead for AI-driven systems. By decoupling capabilities into distinct modules, ANOLISA allows users to adopt only the features they need, whether for terminal-based agent interaction, token optimization, or runtime security.
ANOLISA aligns with industry standards such as the Agentic Application Risk Model (AARM) and maps fully to the OWASP Agentic Top 10 (2026), ensuring adherence to emerging security frameworks for agentic systems. Its modular design also supports compliance with broader system security requirements, making it suitable for production environments.
The project’s repository structure reflects its modular philosophy. Components like cosh-ng (AI-native terminal), Token-less (response compression), and Agent Sec Core (sandboxing) are independently buildable and testable. The src/ directory houses runtime capabilities, while distribution/ manages installation tooling, and benchmark/ contains evaluation frameworks like ClawEval and Terminal Bench. Legacy code is retained in deprecated/, ensuring backward compatibility during transitions.
Contributions follow a structured workflow outlined in CONTRIBUTING.md and AGENTS.md, with component-specific documentation and CI/CD pipelines managed via .github/components.json. Security vulnerabilities are reported through a dedicated Security Policy, and community engagement is facilitated through issue tracking and DingTalk scans for collaboration.
How It Works
ANOLISA operates as an intermediary layer between agents, tools, and the underlying system, addressing inefficiencies in three primary areas: agent interface, context efficiency, and execution runtime. Each capability is designed to integrate seamlessly with existing workflows while introducing optimizations at the system level.
Agent Interface: Terminal-Driven Collaboration
Unlike chat-based interfaces, cosh-ng allows users to issue commands in natural language while retaining full shell functionality. Agents can execute tools, request approval for risky operations, and maintain context within the same terminal session. This integration eliminates the need for separate chat applications, streamlining workflows for developers and operators.
Cosh-ng’s design preserves existing shell behaviors while adding agentic capabilities. For example, a user can describe a task in plain language (e.g., ‘Find all Rust files modified in the last week’), and the agent will translate this into executable commands, display results, and allow manual intervention if needed. The component is installed system-wide via the ANOLISA CLI, ensuring consistency across environments.
Context Efficiency: Reducing Token Waste
Token costs are a critical bottleneck in agent-driven workflows, particularly when processing tool responses, schemas, and logs. ANOLISA’s Token-less module mitigates this by compressing redundant data before it reaches the model, without altering agent framework code. Compression targets three areas: tool responses, tool schemas, and full pipeline context.
Compression is reversible; dropped array items are retrievable via a marker, and metadata is preserved for debugging. The module operates between the agent and model, ensuring compatibility with any framework.
Token-less integrates with popular models like Claude Code through adapter commands, such as anolisa adapter enable tokenless claude-code.
Observability: AgentSight and Token Visibility
The AgentSight component provides kernel-level observability for agent operations on Linux, using eBPF to trace tool calls, model interactions, and token usage without modifying agent code. Users can visualize agent trajectories, including sub-agent branches and context flow, directly from the terminal. This visibility extends to token allocation, helping identify inefficiencies in tool responses or schema overhead.
AgentSight’s traces include user input, model outputs, and tool invocations, with annotations for token consumption. For example, a search tool’s response might show compressed JSON alongside metadata like latency and cache status.
Execution Runtime: Security and Recovery
ANOLISA’s runtime environment enforces isolation and recovery for agent operations through Agent Sec Core and ws-ckpt. Agent Sec Core classifies commands by risk and applies sandbox policies, while ws-ckpt creates checkpoints for workspace state, allowing rollbacks if a skill or tool modifies files unexpectedly.
For example, if a signed skill is updated, the agent detects the drift before execution and blocks the change if configured to do so. This prevents unauthorized or corrupted skill deployment.
Additional runtime features include SkillFS, which exposes selected skills as a mounted filesystem, and ktuner, which optimizes kernel parameters for agent workloads. These components work independently or in combination, depending on the security and performance requirements of the task.
Key Features and Capabilities
ANOLISA’s modular architecture allows users to enable features based on specific needs.
- cosh-ng: An AI-native terminal that integrates agents into Bash/Zsh without requiring separate interfaces. Supports natural language commands, tool execution, and approval workflows for risky operations. Installed via anolisa --install-mode system install cosh-ng.
- Token-less: Compresses tool responses, schemas, and logs to reduce token usage by up to 68% in observed workloads. Operates transparently between agents and models, with reversible compression and debug retrieval. Enabled via anolisa install tokenless and configured per adapter (e.g., Claude Code).
- AgentSight: Provides eBPF-based observability for agent operations, tracing token usage, tool calls, and sub-agent branches.
- Agent Sec Core: Implements sandboxing and verification for agent operations, classifying commands by risk and applying isolation policies. Integrates with ws-ckpt for workspace recovery and Skill Ledger for drift detection in signed skills.
- ws-ckpt: Creates fast checkpoints for file changes, enabling rollback if an agent modifies the workspace unexpectedly. Used in conjunction with Agent Sec Core for secure execution environments.
- SkillFS: Exposes skills as a mounted filesystem, allowing focused access to specific tools or libraries. Reduces context switching by keeping relevant skills in scope during execution.
- Agent Memory: Reuses context across agent sessions, reducing redundant token usage for repeated operations. Complements Token-less by maintaining state without increasing model load.
Installation and Integration
ANOLISA is installed via a single CLI entry point, with components added independently. The ANOLISA CLI (anolisa) manages system-wide installation of cosh-ng and modular additions like Token-less.
curl -fsSL https://get.agentic-os.sh | bash
anolisa adapter enable tokenless claude-code
This sequence installs the AI-native terminal, enables token compression, and configures it for Claude Code. Token-less can also optimize existing agents without framework modifications, as it operates at the system layer.
Benchmarks and Performance
ANOLISA’s components are evaluated using dedicated benchmarks, including ClawEval for agentic workflows and Terminal Bench for shell integration. The benchmark/ directory contains evaluation runners for cross-component testing, while individual components maintain their own test suites.
In a coding task, it achieved 40.5% token savings for tool responses, demonstrating its effectiveness in high-context workloads. Benchmark results are documented in the User Guide and Changelog for transparency.
Standards Compliance
ANOLISA adheres to emerging standards for agentic security and interoperability.
- Agentic Application Risk Model (AARM): ANOLISA’s AgentSecCore is registered as a compliant security control, ensuring alignment with agent-specific risk frameworks.
- OWASP Agentic Top 10 (2026): All 10 risk categories are mapped to ANOLISA’s security controls, providing a comprehensive defense against agentic threats like injection, privilege escalation, and data leakage.
These mappings are documented in the Standards & Compliance section of the repository, with references to control implementations and mitigation strategies.
Use Cases
ANOLISA’s modular design makes it adaptable to diverse agentic workflows, from development environments to production systems.
- Developer Productivity: Teams using cosh-ng can issue natural language commands directly in their terminal, reducing context switching between chat interfaces and shells. For example, a developer might ask ‘Debug the memory leak in this Rust module’ and receive a step-by-step analysis with tool outputs displayed inline. Token-less further reduces costs for IDE integrations or CI/CD tooling by compressing build logs and test results.
- Enterprise AI Operations: Organizations running multiple agents can deploy Agent Sec Core to enforce sandboxing policies, preventing unauthorized tool access or data exfiltration. ws-ckpt ensures recovery from failed deployments or corrupted skill updates, while AgentSight provides audit trails for compliance reporting.
- The module’s reversible compression ensures no data loss, making it suitable for financial or legal workflows where precision is critical.
- Security-Critical Workflows: ANOLISA’s alignment with OWASP Agentic Top 10 makes it ideal for environments handling sensitive data. Skill Ledger detects drifted skills before execution, while Agent Memory prevents context leakage across sessions.
- Research and Benchmarking: Researchers can use AgentSight to profile agent behavior at the kernel level, identifying inefficiencies in tool calls or model interactions. The benchmark/ suite supports reproducible evaluations, such as comparing token usage across different compression strategies.
In each case, ANOLISA’s modularity allows organizations to adopt only the components they need, scaling from terminal integration to full runtime security as requirements evolve.
Technical Implementation
ANOLISA’s architecture is built on Rust for performance and safety, with components designed for independence and composability. Below are key technical details:
- The distribution/ directory handles packaging and installation, while scripts/ manages build and validation workflows.
- Repository Structure: Components are organized by function, with src/ containing runtime modules (e.g., AW, cosh-ng, observability), and deprecated/ retaining legacy code like copilot-shell until retirement. The docs/ directory provides user and developer guides, while specs/ defines contribution standards.
- The .github/components.json file routes builds and releases, ensuring consistency across modules. Vulnerability reporting follows a dedicated Security Policy.
- Interoperability: ANOLISA integrates with existing tools via adapters (e.g., claude-code for Token-less) and hooks for custom workflows.
The project’s emphasis on modularity ensures that new components can be added without disrupting existing functionality.