Agents on exe.dev: Shelley and friends

“exe.dev is a great place to run a coding agent securely, with minimal supervision. Each exe.dev VM has little access to your data … except for the data that you put in it, so there’s very little to exfiltrate.”

Sources: https://exe.dev/docs/boxes, https://exe.dev/docs/shelley/intro, https://exe.dev/docs/shelley/unique, https://exe.dev/docs/shelley/byok, https://exe.dev/docs/shelley/agents-md, https://exe.dev/docs/shelley/upgrading, https://exe.dev/docs/shelley/llm-gateway, https://exe.dev/docs/upgrade-codex, https://exe.dev/docs/teams/shelley, https://exe.dev/docs/guts.

Shelley in one paragraph

“Shelley is a coding agent. It is web-based, works on mobile, and, when you start an exe.dev VM with the default exeuntu image, it is running on port 9999, and you can access it securely at https://vmname.shelley.exe.xyz/.” By default it uses the LLM integration, “so you don’t need to configure any API keys”. You can bring your own key.

Its name comes from the shell, its main tool, and “an appropriately ironic nod” to Percy Bysshe Shelley’s “Ozymandias”.

What is different about Shelley

• No fixed directory. Because it runs on the web, you choose a starting directory for each conversation, and conversations can run in parallel across VMs.
• Generations. Compacting a long conversation starts a new “generation”, and only the current generation goes to the model. exe.dev’s reasoning is that LLMs are “quadratically expensive in the context length”.
• Browser tool. It drives Chromium to navigate, take screenshots, take profiles and debug.
• Guidance files. It reads ~/.config/shelley/AGENTS.md, project AGENTS.md files, and also notices CLAUDE.md and DEAR_LLM.md.
• Upgrades. The menu has a “Check for New Version” option, or you can run shelley install <vm> from the exe.dev shell.
• Turning it off. sudo systemctl disable --now shelley.service.

Models and keys

• Default. The llm integration at https://llm.int.exe.xyz, backed by the exe.dev LLM gateway.
• Bring your own key. In the model picker, choose “Add / Remove Models…”. Anthropic, OpenAI and Gemini are straightforward to add. Subscribers to the z.ai coding plan use https://api.z.ai/api/coding/paas/v4.
• Credits. “Plans with Shelley access include an initial credit.” Team Startup and the legacy Individual and Team plans also get a monthly credit. The billing overview says the current Personal, Work and Enterprise plans “don’t include a monthly Shelley credit” (https://exe.dev/docs/billing/overview). You can buy more at https://exe.dev/user/shelley.
• Deprecated route. Direct gateway access through the metadata endpoint is deprecated and isn’t available to accounts created on or after 2026-08-03 00:00 UTC.
• Bring your own subscription. The pricing page lists “Bring your own LLM subscription” on every plan (https://exe.dev/pricing).

On teams

“Credits aren’t shared between team members.” Members can pay for their own credits with the team’s card, and the credits land in their personal balance. Admins can see spending per member. Shelley can’t be turned off for a whole team, so contact support if you need purchasing disabled for some users.

Other agents

The default exeuntu image ships claude, codex and pi. They are baked in when the image is built and aren’t managed by apt, so long-lived VMs keep their original versions until you update them:

sudo exeuntu update claude
sudo exeuntu update codex
exeuntu update pi
sudo exeuntu update claude --version 2.1.185   # pin

Source: https://exe.dev/docs/upgrade-codex.

The default stack Shelley builds on (GUTS)

The welcome server on exeuntu is written in Go with SQLite. With no other instructions, Shelley “will build on that architecture”. exe.dev’s position is: “Kubernetes, serverless functions, distributed transactions, edge computing, and so on all have their place, but we place our bets on the humble monolith” (https://exe.dev/docs/guts).

A safe agent setup on exe.dev

1. Give each agent its own VM. VMs are KVM-isolated, and there is no private network between them (https://exe.dev/docs/faq/cross-vm-networking).
2. Give it credentials through integrations, never as files (https://exe.dev/docs/integrations).
3. Optionally restrict egress to integrations (https://exe.dev/docs/internet-access).
4. Use a standalone VM so the work is metered by the second, and stop it when it’s done (https://exe.dev/docs/standalone-vms).
5. Look at the result through the private HTTPS proxy, and share it only when it’s ready (https://exe.dev/docs/proxy).

Draw this as the agent sandbox board.