brava

Coding agents that start on their own. Nobody at the keyboard.

Brava is a hosted harness for coding agents. Choose what starts a session, tell the agent what to do, and it works on its own, in a sandbox that cannot phone home.

Talk to us See how it works
  1. Cloned
  2. Installed
  3. Network locked
  4. Tests run

brava bot reviewed this pull request

acme/api #482

This retry can charge a customer twice. src/billing/charge.ts:52 retries on a timeout with no idempotency key. I ran charge.test.ts with the gateway timing out after it accepts the charge, and it charged twice. Pass the invoice id as the key.

The export can read another team's invoices. src/export/route.ts:31 takes teamId from the query string and never compares it to the signed-in team.

Verdict: blocking

One example of a result: a review on a pull request. The repository and the code are made up.

How it works

You decide what starts it and what it does.

  1. Something happens

    A trigger fires: a pull request on GitHub, an incident in incident.io, or any system that can send a signed webhook.

  2. An agent picks it up

    A session starts in its own sandbox, with your repository, your connected tools and the instructions your team wrote for that trigger.

  3. The result lands

    On a pull request, it is posted as a review. Otherwise it is in Brava, or goes out through the tools your instructions name.

Use cases

Two jobs to start with. Neither should wait for someone to be free.

On every pull request

  1. A PR opens, a reviewer is requested, or someone comments @brava review.
  2. A fresh sandbox clones the branch, installs dependencies and locks its network.
  3. The agent reads the diff and the code around it, and runs your tests. If the screens changed, it can open the app in a browser.
  4. The review lands on the PR with file and line references. After a pass, the next one covers only what changed.

The moment an incident is declared

  1. incident.io sends the event and a session starts. Nobody has to start it.
  2. The agent gets your code and your connected tools.
  3. It follows the failure from the error to the code that caused it.
  4. Its findings are waiting in Slack or in Brava when the first person opens a laptop.

Or write your own. Anything that can send a signed webhook can start a session, with your instructions and your connected tools. Anyone on the team can also start one from the browser.

The environment

The agent loop is the easy part. A real environment is what makes its answer worth reading.

Its own machine
Each session gets a microVM with its own kernel: 4 vCPUs, 12 GB of memory and 20 GB of disk.
Your project, installed
It clones the repository and installs its dependencies, so it can run your tests instead of guessing.
Its own browser
Chromium beside the sandbox, for checking screens and recording what it saw. It reaches only that sandbox.
Your team's tools
Slack, Linear, Sentry, incident.io, PostHog and Notion, connected once for the whole workspace.

Security

Model-written code runs next to your secrets. So we tested the walls from inside.

Probes from inside a deployed sandbox, November 1, 2026
What the sandbox triedWhat happened
Postgres on port 5432Denied The connection times out.
SSH on port 22Denied The connection times out.
DNS over TCP to 1.1.1.1Denied
DNS over UDP to public resolversNever arrives The platform answers instead, so a lookup cannot carry data out.
Two sandboxes alive at onceSeparate Each boots its own microVM kernel.

What holds on every session

  • GitHub tokens stay out of the sandbox. A private clone uses a read-only token for that one repository, added on the way out, and only during the checkout.
  • So do connection credentials. Your tools are called from our server, never from the sandbox.
  • Secrets are write-only. They reach the sandbox only after its network is locked and verified.
  • The network is default-deny. Every host you open has a person and a reason next to it.
  • Limits are set by people. Owners and admins decide what sessions can reach, and each session stops at a cost cap.

Who it is for

Built for teams, and not for everyone.

A good fit

  • Product engineering teams of about 5 to 50 people.
  • Code on GitHub.
  • Tools like incident.io, Linear and Sentry already in use.

Not a fit

  • One person's daily coding. A Claude Max plan is the better deal.
  • A requirement to self-host.

Talk to us.

We are starting with a small number of teams. Tell us about yours and what you would want Brava to do, and we will reply by email.

We use this only to reply to you.