DEV Community

Andrew
Andrew

Posted on Originally published at andrew.ooo

FrontierAgent Review: Apodex's Open Agent Team Harness 2026

#frontieragent #apodex #agentteam #multiagent

Originally published on andrew.ooo — visit the original for any updates, code snippets that aged out, or follow-up posts.

TL;DR

FrontierAgent is the open-source half of Apodex's August 2026 release: an agent runtime, a terminal TUI (frontier-agent), and a benchmark harness in one Apache-2.0 repository. It ships two workflows — a Stateful ReAct single agent and an Agent Team mode where a coordinator keeps a task board, dispatches parallel sub-agents, collects their structured reports, and synthesizes the answer. The same engine runs Apodex's published benchmarks, so you can reproduce the ReAct-vs-Agent-Team comparison on your own machine.

Key facts (verified 2026-09-12):

  • 2,664 GitHub stars, 179 forks, 13 open issues — repo created 2026-08-22, last push 2026-09-12
  • Python 3.12 + uv; works against any OpenAI-compatible endpoint, not just Apodex's models
  • Apache 2.0 framework; companion Apodex-1.1-mini (35B MoE, Apache-2.0, built on Qwen3.5-35B-A3B, 262K context) has 9.4K+ Hugging Face downloads
  • Fixed task sandbox: /inputs (read-only) → /workspace → /outputs; bubblewrap or container isolation on Linux, fail-closed authorization
  • Approval gate, JSONL trace of every action, /revert to undo a session, --resume for saved runs
  • Bundled evaluation for 14 benchmarks (BrowseComp, HLE, GDPval, APEX, OfficeQA, FrontierSearchBench, ...)
  • Free two-week Apodex-1.1 API trial at platform.apodex.ai (limited-time as of this writing)

The short version: FrontierAgent is the most complete open agent-team harness released this summer. It is also three weeks old, and the issue tracker already shows a security-relevant bug in the Bash allow-list and a process leak on shell timeouts.

Why This Matters Now

Agent frameworks are converging on the same shape: a coordinator, a pool of sub-agents, a shared task list, and a sandbox. We have covered several this year — TrueForge, PRAXIST, Prime Agent, Hermes Agent. What is different about FrontierAgent is the claim behind it.

Apodex's position, in the Apodex 1.1 blog post (24 Aug 2026), is that task decomposition should be a trained capability of the model, not a script wrapped around it: the model decides at inference time whether to split a task, how many sub-agents to run, and when to consolidate. Their numbers: Agent Team adds 4.1 to 9.3 points over plain ReAct on the same model, and the 35B Mini in Agent Team mode reaches 27.7 on APEX-Agents vs 27.9 for Kimi K2.6, a roughly 1T-parameter model.

Those are vendor benchmarks, and two of them (FrontierFinance, FrontierScience-Research) are Apodex's own. The harness is what makes the claim checkable: it includes the runner, judges, and dataset keys Apodex used, and it accepts any OpenAI-compatible endpoint. The interesting experiment is not "does Apodex-1.1 score 38.5 on APEX" but "does Agent Team mode help my model through the same harness."

The release was covered by HPCwire/AIwire and drew a team AMA on r/LocalLLaMA, where the intended use was described as "long-horizon agentic tasks: deep research, file/code analysis, and workflows that benefit from multiple agents working and verifying in parallel."

What FrontierAgent Actually Is

Four deliberately separated layers:

frontier_agent/  generic loop, scheduling, registries, AgentBus, observers
plugins/tools/   web, shell, file, sandbox, and team tool implementations
workflows/       ReAct and Agent Team pipelines, profiles, prompts, observers
apodex/          terminal CLI/TUI, approvals, sessions, traces, and Docker path
benchmarks/      public harness plus bundled FrontierSearchBench/FrontierChallenge
Enter fullscreen mode Exit fullscreen mode

The framework layer has no dependency on benchmarks; CI enforces that with a framework-only import smoke test. Practically, uv sync installs a lightweight terminal runtime without datasets or judges, and you can embed run_agent_loop in your own code without inheriting the TUI.

Mode Best for Execution model
react focused research, repository analysis, document/file work one stateful agent
agent_team broad questions that benefit from decomposition coordinator + task board + bounded parallel sub-agents + report collection + synthesis

The tool surface in plugins/tools/ is broader than most harnesses: bash, run_python_code, read_file/write_file/file_editor, glob_search/grep_search, web_search/web_fetch, download_file, view_image, readers and writers for PDF, DOCX, PPTX, XLSX, plus the team primitives create_subagent, assign_task, collect_reports, submit_report, stop_subagent, task_board, finalize_answer. The registry exposes only an explicit allowlist — dropping a module into plugins/tools/ does not make it agent-accessible.

The document toolchain is the tell for who this is for. Apodex's headline demos are a survival analysis from raw clinical tables, powder-XRD unit-cell refinement, and building a GROMACS simulation system from a protein structure. The harness is optimized for "here are 40 files in odd formats, produce a deliverable," not for editing a web app.

Architecture: Loop, Observers, AgentBus

The core is run_agent_loop, a domain-neutral ReAct kernel:

result = await run_agent_loop(
    system_prompt=system_prompt,
    user_message=question,
    llm=llm,
    tools=tools,
    config=loop_config,
    observers=observers,
    model_profile=model_profile,
)
Enter fullscreen mode Exit fullscreen mode

Planning, terminal-tool behavior, reporter routing, and recovery live outside the kernel.

Observers are the extension point. They implement only the callbacks they need (on_tool_call, on_llm_response, on_turn_end, and so on) and return an Intervention to stop, retry, or replace content. Authorization observers must fail closed. Several shipped observers encode hard-won lessons about models looping:

Observer Signal Action
DuplicateQueryRollbackObserver a web_search already ran and returned content pops the turn and re-samples without spending a max_turns slot
RepetitionGuard consecutive byte-identical tool calls hint at 3, stop at stop_after
TextRepetitionGuard near-verbatim prose across turns hint, then stop
NoProgressGuard coordinator keeps spawning/assigning with nothing coming back owns the coordinator's spin pathology

There is also a reasoning-runaway watchdog for thinking models (reasoning_only_timeout_s 120, reasoning_only_max_tokens 16384, logical_call_timeout_s 900). It only works on the streaming path, so the anthropic, responses, and bedrock protocols ignore it.

Agent Team runs on AgentBus (task submission, messaging, report collection, cancellation, shared context) with a SpawnGuard limiting nesting depth, parallelism, and wall time. Sub-agents can search, read files, use the sandbox, and submit reports; they cannot spawn their own team unless the budget explicitly allows it. The coordinator's add_task/update_task events render live in the TUI sidebar. One footnote: the subsystem was originally called swarm, and the name survives on identifiers other code binds to (response.swarm.*, logs/swarm/, load_swarm_profile). In the code, "swarm" means Agent Team.

The Sandbox and Safety Model

Most agent frameworks hand-wave this; FrontierAgent is unusually explicit.

Path Policy Purpose
/inputs read-only supplied documents and benchmark inputs
/workspace read-write source checkout, extracted data, scratch
/outputs controlled read-write final persistent deliverables

File and shell tools share this one sandbox and path policy. Backends are auto (probe bubblewrap, fail with guidance if unavailable), bwrap, and container. The docs state there is no unisolated host fallback at the framework layer; network and path policies apply before execution, and authorization or sandbox failures are fail-closed. Output publication is manifest-aware — only declared publishers may write final deliverables.

The interactive terminal adds a second layer: an approval gate on writes, deletions, package installs, and risky shell commands (with a unified diff shown first), hard denials that survive --yes, and a journal backing /revert. Every action lands in a JSONL trace under <project>/.apodex/runs/<session-id>/, alongside the checkpoint, engine log, and trajectories.

Caveat for Mac users: the macOS native path is approval-gated but explicitly "not an OS sandbox" — commands run with your user's permissions. Real isolation means bubblewrap on Linux or Docker.

Getting Started

Requirements: Git, Python 3.12, uv, and an OpenAI-compatible endpoint. Docker is optional.

git clone https://github.com/ApodexAI/FrontierAgent.git
cd FrontierAgent
uv sync --python 3.12 --extra dev
cp .env.example .env
Enter fullscreen mode Exit fullscreen mode 
OPENAI_API_KEY=your-key
OPENAI_BASE_URL=https://your-openai-compatible-endpoint/v1
OPENAI_MODEL=your-model-name

# Optional web research tools
SERPER_API_KEY=
JINA_API_KEY=
Enter fullscreen mode Exit fullscreen mode

Web search goes through Serper and page fetching through Jina Reader; without keys you get a closed-book agent. A fix merged 9 Sep (issue #34) makes the TUI warn about missing search credentials at startup instead of failing mid-run. .env.example also exposes SUMMARY_LLM_* so whole-page condensation can go to a cheaper model, and READDOC_VISION_URL for image-only PDF pages.

# Single stateful agent
uv run frontier-agent --mode react --cwd /path/to/project

# Coordinator plus parallel sub-agents, with a task
uv run frontier-agent --mode agent_team --cwd /repo \
  "Research the alternatives, verify the evidence, and write a report"

# One-shot / line mode / resume
uv run frontier-agent --mode react --cwd /repo -p "explain src/main.py"
uv run frontier-agent --mode agent_team --no-tui "compare these implementations"
uv run frontier-agent --resume

# Attach read-only inputs; auto-approve for trusted batch use
uv run frontier-agent --mode react --cwd /repo --input ~/Downloads/claim.pdf
uv run frontier-agent --cwd /repo --yes "add a --verbose flag to the CLI"
Enter fullscreen mode Exit fullscreen mode

Scientific and document packages are optional in native mode; the agent installs only what a task needs into <project>/.apodex/runtime/native. Pre-built linux/amd64 and linux/arm64 images are on GHCR (docker compose run --rm agent).

Asynchronous intervention is the TUI feature people notice first: type while an agent is running and the instruction is injected at the next safe turn boundary without discarding the active run. In Agent Team mode it steers the coordinator; running sub-agents finish.

Going fully local with Apodex-1.1-mini

The mini is a 35B MoE fine-tune of Qwen3.5-35B-A3B with 262K context, published as FP16 (roughly 70 GB) plus FP8, GPTQ-Int4, NVFP4, and GGUF. Apodex's serving command:

python3 -m sglang.launch_server --model-path apodex/Apodex-1.1-mini \
  --tp 8 --host 0.0.0.0 --port 1234 --context-length 262144 \
  --tool-call-parser qwen3_coder --reasoning-parser qwen3
Enter fullscreen mode Exit fullscreen mode

config/sglang/ ships templates for one RTX 4090 (24 GB), one RTX 5090 (32 GB), and a two-GPU host. Read the caveat: none of the consumer-GPU templates can load FP16 as-is — quantize first (GPTQ-Int4 is "the only format that fits" a 5090) and set SGLANG_LOCAL_MODEL_PATH. Driver/CUDA/SGLang mismatches surface late as opaque Triton errors; check the GPU compatibility matrix first.

Benchmark Evaluation

Each question runs in an isolated subprocess with resumable multi-run experiments and benchmark-specific judges:

uv sync --extra eval --extra sandbox --extra document-readers
uv run python -m benchmarks.public.runner.run_subprocess \
  --benchmark browsecomp --pipeline stateful-react-agent --profile default \
  --limit 1 --concurrency 1 --out ./results/smoke
Enter fullscreen mode Exit fullscreen mode

Supported: BrowseComp, BrowseComp-ZH, xbench-DeepResearch, HLE, SuperChem, FrontierScience-Research/Olympiad, DeepSearchQA, WideSearch, FrontierSearchBench, OfficeQA, GDPval, APEX, OneMillion-Bench. GDPval uses deterministic deliverable validation only — the agentic pairwise grader is excluded, so the 78.8 GDPval figure is not reproducible from this repo alone. Agent Team parallelism multiplies with --concurrency; start at 1.

For reference, Apodex's own table has Apodex-1.1 Agent Team at 38.5 APEX-Agents / 78.8 GDPval / 56.1 HLE versus 34.4 / 69.5 / 53.2 for the same model in ReAct mode.

Community Reaction

No big Hacker News thread — the discussion happened on r/LocalLLaMA, X, and in the repo. The pattern is consistent: praise for the harness, skepticism about the model claims. Julian Goldie called it "the most complete open-source agent-team harness to ship this month" while noting the model claims "need independent verification"; explainx.ai flagged the Kimi K2.6 comparison as "a strong signal on Apodex's own benchmark suite, not yet an independently reproduced result."

The GitHub issues are the better signal, because they come from people who ran it:

  • #39 — Bash allow-rule bypass via command substitution. A saved Bash(git push) rule matches by string prefix without unwrapping $(...), and the rules layer downgrades CONFIRM to SAFE, so git push --force can slip past the typed-confirmation gate — the exact case the module docstring says is impossible. Reproduced on main; fix PR #42 is open.
  • #40 — run_shell leaks the child process on timeout on the host/native/container path (the Linux default). The caller sees TimeoutError; the child keeps mutating the workspace. Only the bwrap path reaps.
  • Benchmark-runner bugs, fixed fast: inverted --web/--no-web (#26, fixed 1 Sep), --limit applied before the seeded shuffle (#32, fixed 8 Sep). Still open: the FrontierChallenge open track needs a licensed ORCA runtime for one task and ships a stale checksum file (#27, #28).

Read together: a young codebase with real users, maintainers merging community fixes within days, and the bugs you expect three weeks in — including one in the safety layer.

Honest Limitations

  • Three weeks old, no tagged releases. You are tracking main. Open issues #39 and #40 touch exactly the pieces you trust when you pass --yes.
  • Research-shaped, not code-shaped. It can edit code, but there is no test-runner, git, or LSP integration; it is not competing with Claude Code or Codex on software work.
  • Web research needs paid keys (Serper, Jina). Otherwise closed-book.
  • Local model is a real GPU commitment. 35B, 4-bit export, 24-32 GB card minimum; no Ollama-style path.
  • Runaway watchdogs are streaming-only. Non-streaming protocols get only the post-hoc reduced-cap resample.
  • macOS native is not isolated. Approval-gated, journaled, revertible — but running as your user.
  • Partly vendor-owned benchmarks, and the GDPval agentic grader is excluded from the open harness.

Who Should Use FrontierAgent

Good fit: teams testing whether Agent Team decomposition helps their model; analysts working from piles of PDFs and spreadsheets who want an auditable, revertible local agent; runtime builders who want a reference implementation of observers, spawn guards, and a manifest-aware sandbox; self-hosters with a 24 GB+ NVIDIA card who want a fully local deep-research stack.

Bad fit: coding-agent users (Claude Code, Codex, OpenCode are better at software work); anyone who needs it fully local on a Mac; production deployment today — wait for a tagged release and the #39/#40 fixes.

FrontierAgent vs Alternatives

FrontierAgent GPT Researcher Local Deep Research PRAXIST
Primary job file + web research deliverables web research reports self-hosted research, local models ML experiment campaigns
Multi-agent coordinator + parallel sub-agents, task board planner + parallel researchers no (iterative) parallel peers across generations
Sandbox 3-dir layout, bwrap/container, fail-closed none Docker project-scoped
Document I/O PDF/DOCX/PPTX/XLSX read + write web + local docs web + local docs task project defines
Eval harness 14 benchmarks bundled no no MLE-bench focus
License Apache 2.0 Apache 2.0 MIT Fair Source 1.0

If your question is "which open framework should I copy the design from," FrontierAgent's observer contract and sandbox policy are the most carefully specified of the four. If your question is "what runs on my laptop tonight," Local Deep Research still wins.

FAQ

Does FrontierAgent require Apodex's models?
No. It needs an OpenAI-compatible chat endpoint; OPENAI_BASE_URL can point at OpenAI, OpenRouter, vLLM, SGLang, or anything else that speaks the API. Apodex-1.1-mini is the intended companion and the target of the shipped SGLang templates, but the harness is model-agnostic.

What is the difference between react and agent_team mode?
react runs one stateful agent through the research/read/write/run loop in a task-scoped sandbox. agent_team runs a coordinator that decomposes the request into a task board, dispatches bounded parallel sub-agents, collects their structured reports, and synthesizes an answer (optionally via a fast "reporter"). Apodex reports 4.1-9.3 points of lift; it also multiplies concurrent model calls.

Can I run FrontierAgent on macOS?
Yes, natively without Docker, against a hosted or reachable endpoint — ./scripts/run-macos.sh does the install. The native macOS path is approval-gated and revertible but not an OS-level sandbox; use Docker Desktop for isolation. Local SGLang serving is Linux/NVIDIA only.

How much GPU do I need for Apodex-1.1-mini?
The FP16 checkpoint is about 70 GB. The shipped templates target one 24 GB RTX 4090 or one 32 GB RTX 5090 with a 4-bit export, or two GPUs with tensor parallelism. FP8, NVFP4, and GGUF variants are on Hugging Face. Budget KV cache separately; you will cap the 262K context.

Is FrontierAgent production-ready?
Not yet. No tagged releases, and two open issues affect the safety layer: the Bash allow-rule bypass (#39) and the child-process leak on timeout (#40). Treat it as a research workbench until those close.

Does it work with Claude Code or Codex skills?
Not directly. Unlike PRAXIST, which ships as Codex/Claude Code skills, FrontierAgent is its own runtime. You can embed run_agent_loop in Python or drive it with --no-tui, but there is no MCP server or skill package in the repo as of 2026-09-12.

Verdict

FrontierAgent is the rare vendor open-source release that is more interesting than the model it ships with. The observer contract, the repetition and no-progress guards, the fixed three-directory sandbox with fail-closed authorization, the journaled /revert, and the bundled eval runner add up to a genuinely reusable reference for building an agent-team harness. Because it is endpoint-agnostic, it lets you test Apodex's central claim — trained-in decomposition beats scripted orchestration — with your own model instead of taking the benchmark table on faith.

What it is not, yet, is something to hand --yes and walk away from. Give it a tagged release and the #39/#40 fixes and it becomes the default open workbench for file-heavy research agents. Today: star it, run the smoke benchmark against your endpoint, and read docs/framework.md even if you never adopt the tool.

Rating: 4/5 — excellent architecture and documentation, model-agnostic, Apache 2.0; docked for age, open safety-layer bugs, and the GPU bar for going fully local.

Sources

Top comments (0)