Hive: Self-Hosted AI Agent Platform
A personal project: a self-hosted team of AI agents for my own research, email triage and scheduled jobs, with no public ports, sandboxed agents for outside content and a hard monthly spending cap. Paused.
2026
- 25 Architecture Decision Records
- 130+ development tasks shipped across the completed phases; development paused
- Security in layers, from the network down to the add-ons it installs
- Agent teams added one at a time, with nothing on the server open to the public internet
Problem
I wanted a team of AI agents to run my own research, email triage and scheduled jobs. Self-hosting a multi-agent platform means owning security, cost governance, memory recall and uptime yourself, on one server under one budget.
Approach
Security is layered from the network to the supply chain. Agent teams are modular: each domain lead runs in its own Docker sandbox with no network access, its workers share that sandbox, and only the orchestrator may run host commands, each one approved first. The whole system runs on one self-hosted server. Each agent is assigned the cheapest model that does its job well, which holds spending under a hard monthly ceiling.
Architecture
The OpenClaw gateway runs three layers of agents: an orchestrator, domain leads and short-lived workers. A LiteLLM proxy routes every model call, enforces the budget cap and falls back from Google to OpenAI to Anthropic. The orchestrator and the domain leads search the QMD memory before each reply. Tailscale keeps every port closed to the public internet, and 1Password injects secrets into memory at runtime. Agents that need outside data run in containers with no network access of their own, and a scheduled job on the host fetches the data for them.
More Results
- A hard monthly spending ceiling held after the free cloud credits ran out: Pro-tier models where output quality depends on the model, Flash for orchestration, Haiku 4.5 as the fallback, and failover across Google, OpenAI and Anthropic
Lessons Learned
I set the spending ceiling at the proxy from the start, so every call is held to the budget instead of being checked after the bill arrives. Summaries packed into the context degrade as memory grows, so recall moved to a search over memory before each reply; Hive was paused before the first review cycle could show whether that closed the recall misses.