15 Open Source Projects for AI Agents in Production
A practical guide to agent frameworks, durable workflows, execution sandboxes, evaluation, research tools and open source projects for AI agents in production.
Two out of five developers now run AI agents in production, and the tools behind those agents change almost as fast as the agents themselves.
With so much in flux, “which tool is best?” is the wrong place to start. A more useful question is what a particular agent needs in order to do its job reliably, and the answer can look very different from one company to the next.
Genspark’s agents need to execute code, work with files, and maintain state across multi-step tasks. Its published implementation account describes using E2B to provide those execution environments. Canva has a different operating requirement: its support agents need tracing, prompt management, and evaluations, which its team runs through Langfuse.
Those are distinct engineering jobs. The software that runs an agent’s code does not necessarily explain why the agent made a mistake, and an observability platform does not provide its execution environment. The choice depends on which part of the application needs support.
This article covers shared infrastructure and research tooling followed by open source projects that run AI agents in production. The infrastructure entries draw on named deployments and direct dependencies. The applications illustrate complete workflows, including cybersecurity monitoring, geopolitical research, and prediction-market analysis; they are not presented as dependencies used by a majority of agents.
TL;DR
- Build the agent: LangGraph and Pydantic AI offer approaches to stateful control flow, typed tools, and application integration.
- Keep work running: Temporal handles durable background workflows, with a documented role in Sanity’s Content Agent architecture.
- Connect tools and execute tasks: Pydantic, the MCP Python SDK, Playwright, Browser Use, and E2B provide data contracts, tool connectivity, browser control, and execution environments.
- Operate and improve the system: Langfuse, promptfoo, and LiteLLM cover observability, testing, and model access. They serve different roles and are not interchangeable.
- Add research and study complete applications: the Valyu TypeScript SDK provides research APIs; Global Hack Map, Global Threat Map, and Polyseer show domain-specific interfaces and outputs.
The list is grouped by responsibility, not ranked by popularity.
Agent frameworks
1. LangGraph: explicit state and control flow
LangGraph is a framework for stateful agent orchestration. It supports graph-based control flow, checkpointing, and interruptions for human input.
Its published deployment examples include LinkedIn’s recruiting assistant, Uber’s code-testing workflows, and AppFolio’s property-management copilot. These examples describe applications with multiple stages and tools, where execution state matters beyond the latest model response.
LangGraph is worth evaluating when your application needs to branch, pause for approval, or continue a partially completed job. Define the state that must survive and make the transitions visible in application code.
Before adopting it: use persistent checkpoint storage and design external actions for retries. Restoring graph state does not, by itself, prevent a repeated payment or duplicate message.
2. Pydantic AI: typed Python agents
Pydantic AI provides typed tools, structured outputs, and dependency injection for Python agents. It is a separate project from the Pydantic validation library later in this list.
In a published migration account, MindsDB describes adopting Pydantic AI to gain programmatic control over agent state and validate intermediate outputs. There is also public downstream code: marimo’s dependency manifest includes Pydantic AI Slim for its AI features.
The practical fit is a Python application where one component’s output becomes another component’s input. Typed results let ordinary application code decide what happens next, instead of asking another model call to interpret a paragraph.
Before adopting it: keep business validation separate from structural validation. A correctly typed supplier ID can still identify the wrong supplier, and a valid action schema does not authorize the action.
Durable execution and background work
3. Temporal: recover long-running workflows
Temporal separates durable workflow coordination from the activities that perform external work. It records workflow history so execution can recover after interruptions.
The Sanity deployment account describes using Temporal to compute its content schema graph and run parallel mutation tasks in the background. These jobs support the agent without requiring the entire operation to remain inside a live chat request.
Temporal is worth considering when a task crosses service boundaries, waits for an event or approval, or must survive worker failures. A user can submit a job, leave the application, and return to inspect its progress or result.
Before adopting it: understand deterministic workflow code, activity retry behavior, and workflow versioning. External side effects still need appropriate idempotency. Operating the Temporal service yourself is a different commitment from using Temporal Cloud.
Data contracts and tool connectivity
4. Pydantic: a shared dependency across model providers
Pydantic supplies typed data models, validation, serialization, and JSON Schema generation.
The adoption evidence is direct. It is a declared dependency in the official Python SDKs from OpenAI, Anthropic, and Google, as well as OpenAI’s Agents SDK.
For an agent application, explicit data contracts are useful wherever a tool request, model response, or API result enters ordinary code. They make accepted fields and invalid values testable, and give downstream components a predictable representation.
Before adopting it: decide what validation means at each boundary. Shape, business correctness, and authorization are different checks. These SDK dependencies do not tell us how the providers’ private inference services are implemented.
5. MCP Python SDK: a reusable tool interface
The official Model Context Protocol Python SDK provides software for building MCP clients and servers. The project in this entry is the SDK, not the protocol in the abstract.
OpenAI’s Agents SDK declares the Python mcp package as a runtime dependency. Browser Use does too. These manifests establish downstream use in agent software, rather than merely listing compatible products.
A standardized tool interface can let the same service expose operations to different clients. Your application can reuse the tool implementation instead of building a separate adapter for every agent framework.
Before adopting it: implement authentication, authorization, input validation, and tenant isolation. MCP describes communication; it does not decide which customer records a caller may access. Pin compatible SDK versions and review security updates.
Browser control and code execution
6. Playwright: programmed browser automation
Playwright provides browser automation primitives for navigation, page interaction, downloads, and inspection.
OpenClaw’s manifest lists playwright-core as a runtime dependency. Microsoft's Playwright MCP implementation also depends on Playwright. These are concrete downstream dependencies, although they do not mean every agent task opens a browser.
For a known portal workflow, programmed browser actions can be easier to test than asking a model to choose every click. Navigate the expected pages, download the document, and verify the result before handing it to the next component.
Before adopting it: isolate browser sessions and protect authenticated state. Use approval gates for consequential actions. Also avoid assuming every browser agent uses Playwright: some now use their own Chrome DevTools Protocol drivers.
7. Browser Use: task-driven browser interaction
Browser Use provides a browser-agent library and related browser tooling, with separate cloud services.
There is first-party downstream documentation from Hermes Agent. Hermes identifies Browser Use’s browser-harness as the driver behind its browser execution tool and a regular Python dependency. It explains how model-written code operates a local or configured cloud browser.
Get unicodeveloper’s stories in your inbox
Join Medium for free to get updates from this writer.
This is useful when an agent needs to navigate an unfamiliar site, inspect a changing interface, or complete a task whose route cannot be fully scripted in advance. The browser driver executes the operations; the surrounding application determines what the agent is allowed to attempt.
Before adopting it: treat page content as untrusted input, restrict destinations, and bound execution. Separate read-only research from purchases or account changes. Hosted browser adoption and local library use are different deployment choices.
8. E2B: execution environments for agents
E2B provides SDKs for creating and controlling isolated execution environments, including code-interpreter capabilities.
Genspark’s published deployment account describes using E2B for agents that execute code, work with files, and complete multi-step tasks. E2B also publishes named accounts involving Gumloop and Lindy.
This addresses a concrete application requirement: generated code needs somewhere to run without inheriting the authority of the web server. A data-analysis agent can receive a file, execute analysis in a separate environment, and return artifacts for the user to inspect.
Before adopting it: decide what credentials, data, and network access enter each environment. Set resource and lifetime limits. The customer evidence primarily concerns E2B’s service; it does not establish that those customers self-host its open-source components.
Observability, testing, and model operations
9. Langfuse: trace and evaluate agent behavior
Langfuse provides tracing, prompt management, datasets, and evaluations for model-based applications.
Canva’s published account describes using it across a Java Help Assistant and a Python asynchronous support agent. The team traces execution, versions prompts, and runs online and offline evaluations. The account also explains its move from self-hosting to Langfuse Cloud.
This gives the entry a specific operating role. When an agent returns a bad result, trace the retrieval, model calls, and tool operations to find the failure. Preserve representative failures as test cases so the next release can be checked against them.
Before adopting it: plan redaction, access, and retention before logging customer conversations or tool responses. Instrument application logic as well as model calls; a trace containing only the final generation may miss the problem.
10. promptfoo: evaluations and adversarial testing
promptfoo is a CLI and library for evaluating and red-teaming model-based applications, with support for automated development workflows.
Its published adoption statements identify OpenAI and Anthropic as users. That is a vendor-published claim rather than a public dependency manifest or a detailed account of a specific internal deployment. The distinction matters: testing software can support a production product without being present in its request path.
The practical workflow is to turn failures into repeatable tests. Keep examples of valid requests, unsupported claims, and prohibited actions, then run them when a prompt, model, or tool implementation changes.
Before adopting it: test observable behavior, including tool actions where your integration exposes them. A convincing final answer is not enough. Passing an evaluation suite establishes performance on those tests, not protection against every attack. Review where configured evaluators send data.
11. LiteLLM: shared model access and routing
LiteLLM provides a unified model interface and a proxy server with routing, virtual keys, spend tracking, and load-balancing capabilities.
Its published customer testimony includes NVIDIA describing a consistent interface to model endpoints across cloud providers, open-source deployments, and internal services. This supports its role as shared model-access infrastructure, not a claim about every NVIDIA agent.
For a team operating several applications, a common gateway can make usage attributable and provider configuration easier to manage. It also gives operators a place to configure approved routing and investigate failures without searching several unrelated client implementations.
Before adopting it: evaluate fallback models on the tasks they will receive. Compatible API formats do not guarantee equivalent tool use or output quality. Check feature-specific licensing and test budget enforcement rather than treating a dashboard as a hard spending limit.
Research tooling and reference applications
12. Valyu TypeScript SDK: research inside an existing agent
The Valyu TypeScript SDK, published as valyu-js, exposes search, content extraction, and asynchronous DeepResearch through typed JavaScript and TypeScript interfaces.
There is a concrete implementation to inspect: Global Threat Map’s server-side client imports the SDK to retrieve events and run research. This is evidence of use in a Valyu-powered application, not an independent claim about its market share.
For a research assistant preparing a company brief, the SDK lets application code request source material for its own reasoning or create a longer research task and retrieve the completed output. Keep the task ID, status, and source links with the job so a user can inspect the evidence and reopen the result.
Before adopting it: keep API keys server-side, bound usage, and handle incomplete or failed tasks. The SDK’s license does not make the hosted Valyu services free or self-hostable.
13. Global Hack Map: a security-monitoring interface
Global Hack Map presents vulnerabilities, exploits, breaches, and other security developments in a map-based interface. Its dashboard separates new critical vulnerabilities from reports of exploitation and distinguishes confirmed, reported, and claimed incidents.
For a security team operating agent infrastructure, the useful job is triage. Review developments affecting the products in your stack, follow the linked advisory or report, and decide whether the item warrants further investigation. The interface illustrates how a monitoring product can organize research around an operational question rather than return an undifferentiated news summary.
Before adopting it: verify affected versions and exploitation claims against the underlying sources. A reported event does not establish that your environment is vulnerable, and a geographic pin does not prove attribution.
14. Global Threat Map: geographic context for research
Global Threat Map is a situational-awareness application combining a map, an event feed, country research, and entity dossiers. Its repository documents source-linked research and exportable report artifacts.
A regional-risk analyst could use the event feed to identify a development, inspect its sources, and request a dossier on an organization or country before preparing a briefing. The implementation shows how search results, locations, and longer-running research can be presented in one interface, with outputs a colleague can review outside the application.
The repository is useful as an application reference, not evidence that other production agents depend on it.
Before adopting it: review geocoding, source freshness, and the API integrations against current service contracts. Its documented self-hosted mode has no authentication and bills calls to your key, so add access controls and usage limits before a shared deployment. Map rendering also requires a Mapbox token.
15. Polyseer: structured research for prediction markets
Polyseer accepts a Polymarket or Kalshi URL, retrieves the market’s question, prices, close date, and resolution rules, and submits a research task to Valyu DeepResearch.
Its server-side implementation separates market-data retrieval from research creation and status tracking. The documented output includes a structured forecast, evidence for and against it, and downloadable report artifacts. A researcher can compare the analysis with the market’s actual resolution terms before deciding which assumptions deserve further checking.
This is a useful application pattern: external facts define a bounded research question, an asynchronous task does the investigation, and a structured result remains available through a stable task ID.
Before adopting it: evaluate forecast quality on resolved markets. A generated probability is not evidence of calibration. The documented self-hosted mode has no authentication and uses your Valyu API key, so review access and spending controls before exposing it to others.
Frequently asked questions
Which open-source agent framework should I start with?
Evaluate Pydantic AI for typed Python application code and LangGraph when explicit stateful control flow is central. Run a representative task and test its failure paths before committing to a framework. A research SDK or reference application addresses a different layer and does not necessarily require adopting another agent framework.
Does production adoption mean a project is safe to deploy as-is?
No. Adoption establishes a reported use or dependency, not a security guarantee. Your deployment still needs appropriate permissions, isolation, resource limits, and operational testing. Managed services and self-hosted components also have different responsibilities.
Are these projects free to operate?
Open-source licenses do not cover operating costs such as model inference, hosting, storage, or browser and sandbox services. The Valyu-powered applications also depend on hosted APIs. Check license declarations and source availability for the exact project you plan to use; the Global Hack Map source-access limitation is noted in its entry.
