Open-Inspect
GitHub
Someone open-sourced a clone of Ramp's internal coding agent, called Open-Inspect. It's a hosted AI agent that codes in the background from Slack, GitHub, or Linear, then opens PRs.
Based on reporting by GitHub — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Ramp built an internal tool called Inspect that let its engineers hand off coding tasks to an AI agent running in the background, complete with its own dev environment and the ability to open pull requests. Now someone's released an MIT-licensed clone of that system, fittingly named Open-Inspect, and it's a genuinely ambitious piece of infrastructure for a side project.
The pitch is simple: instead of babysitting an AI coding assistant in your terminal, you fire off a task from wherever you already work — a Slack mention, a GitHub PR comment, a Linear issue, a webhook, even a Sentry alert — and the agent goes and does it in a sandbox with Node.js, Python, git, and headless Chromium for browser testing. It can spawn sub-tasks that run in parallel sandboxes, support multiplayer sessions where several people watch and prompt the same run, and attribute every commit to whoever actually typed the prompt. You pick the brain doing the work too: Anthropic's Claude lineup, OpenAI's Codex models through your existing ChatGPT subscription, or a grab-bag of open models via OpenCode Zen like Kimi and GLM.
Under the hood it's a Cloudflare Workers control plane talking to sandbox backends — Modal, Daytona, E2B, or OpenComputer, take your pick — with Durable Objects handling session state and a D1 database storing repo-scoped secrets encrypted with AES-256-GCM. The engineering around startup speed is the part that stands out: filesystem snapshots restore instead of re-cloning, images rebuild every 30 minutes with fresh dependencies, and sandboxes start warming the moment you begin typing a prompt, before you've even hit enter.
The catch, and it's a big one, is baked right into the security model. Open-Inspect is explicitly single-tenant only. Every user shares the same GitHub App installation, and the system does zero per-user repository access checks before spinning up a session — so anyone who can log in can touch any repo the App can see. The docs are upfront about this being a Ramp-style internal tool for trusted coworkers, not something you'd point at a mix of untrusted clients or outside contributors without adding tenant isolation and access validation yourself. GitHub OAuth logins do get proper PR attribution and repo-scoped permissions; sign in with Google instead and your PRs quietly fall back to the shared bot identity.
If you run an engineering org where everyone already has repo access anyway, this closes the gap between "AI agent as a chat window" and "AI agent as a teammate with its own dev environment and Slack presence." Just don't mistake the single-tenant warning for boilerplate — deploy this behind SSO, restrict the GitHub App to specific repos, and don't hand out the URL to anyone outside the building.
My take — AI-written commentary, not fact-checked reporting
This is exactly the kind of tool that makes internal engineering orgs faster and makes security teams nervous, and both reactions are correct. The single-tenant caveat isn't a footnote, it's the whole ballgame — someone will inevitably deploy this multi-tenant anyway, skip the access checks, and end up in a very bad blog post next year. Still, credit where due: cloning Ramp's internal tool and open-sourcing it under MIT is a much healthier way to spread this kind of agent infrastructure than every startup rebuilding it behind a paywall.
Read more about this at: GitHub