# newagent.build

> Build an AI agent stack layer by layer. Compare 88 components — harness, model, memory, retrieval, security, runtime — and leave with a runnable setup script.

Every stack is addressable as a URL. `GET /api/stack?<layer>=<component-id>&format=sh` returns a runnable
setup script; `format=json|md|yml|agents|env` return the other artifacts. `GET /api/advise?q=<description>`
returns a recommended stack for a plain-English description. `GET /api/registry` returns everything below as JSON.

Every page on this site supports content negotiation: send `Accept: text/markdown` to any URL and you get
markdown instead of HTML — same content, roughly a tenth of the tokens. Appending `.md` to a path works too,
for clients that cannot set headers.

## Guides

- [AI agent prompt injection defence](https://newagent.build/guides/prompt-injection-defence) — Prompt injection has no known complete fix. The practical defence is layered: detect what you can, then remove the attacker's payout with sandboxing and default-deny egress. A guide for teams putting agents in front of untrusted content. Updated 2026-08-21.
- [Choosing agent memory](https://newagent.build/guides/choosing-agent-memory) — Agent memory vendors publish benchmark scores that independent re-runs contradict by up to 30 points. A guide to what memory actually does, when you need a product rather than a table, and how to read the numbers. Updated 2026-08-21.
- [Self-hosted AI agent stack](https://newagent.build/guides/self-hosted-agent-stack) — A complete AI agent architecture where no component calls out to a third party — for regulated industries, data-residency requirements and air-gapped environments. Every layer, with the open-source option that fills it. Updated 2026-08-21.
- [What is an agent harness?](https://newagent.build/guides/what-is-an-agent-harness) — A harness is the loop that runs your agent — reading files, calling tools, managing sessions and approvals. Understanding the difference between a harness and a framework is the first architectural decision, and most guides skip it. Updated 2026-08-21.

## Published benchmark scores

Every figure below is reproduced with its source and who ran it. Where a vendor's own number and an
independent re-run disagree, both are listed. Blank pairings mean nobody has published a figure.

### LoCoMo (Memory)
Question-answering accuracy over long, multi-session conversations.

- Mem0: 92.5% — self-reported, Mem0 research page, 2026-08. https://mem0.ai/research
- Mem0: 62.47% — independent, Memori Labs evaluation, 2026-08. https://memorilabs.ai/docs/memori-cloud/benchmark/results/
- Zep: 79.09% — independent, Memori Labs evaluation, 2026-08. https://memorilabs.ai/docs/memori-cloud/benchmark/results/
- Zep: 58.44% — independent, Corrected evaluation, zep-papers #5, 2026-08. https://github.com/getzep/zep-papers/issues/5
- LangMem: 78.05% — independent, Memori Labs evaluation, 2026-08. https://memorilabs.ai/docs/memori-cloud/benchmark/results/
- Letta: 83.2% — self-reported, Reported in comparative write-up, 2026-08. https://mem0.ai/blog/benchmarked-openai-memory-vs-langmem-vs-memgpt-vs-mem0-for-long-term-memory-here-s-how-they-stacked-up
- Caveat: Treat every figure here as contested. Most headline LoCoMo numbers are produced by the vendor being measured, and independent re-runs have differed from vendor claims by as much as 30 points on the same benchmark name. The spread between rows is the story, not the winner.

### Agent Data Injection — attack success rate (Security)
Share of injection attacks that still succeed with the guardrail in place. Lower is better.

- Llama Guard: 50% — peer-reviewed, Agent Data Injection Attacks, 2026-07. https://arxiv.org/pdf/2607.05120

### Agent Data Injection — detection rate (Security)
Share of instruction-injection attempts the guardrail flags.

- Llama Guard: 34.9% — peer-reviewed, Agent Data Injection Attacks, 2026-07. https://arxiv.org/pdf/2607.05120

### Recall @ 1% FPR (English) (Security)
Injections caught while holding false positives to 1% — the metric that decides whether a filter is usable in production.

- Llama Guard: 97.5% — self-reported, LlamaFirewall (Meta), 2026-05. https://arxiv.org/pdf/2505.03574

### SWE-bench Verified (Model provider)
Share of real, human-validated GitHub issues resolved end to end.

- Anthropic: 96% — leaderboard, SWE-bench Verified leaderboard, 2026-08-18. https://benchlm.ai/benchmarks/sweVerified
- DeepSeek: 96.4% — leaderboard, SWE-bench Verified leaderboard, 2026-08-18. https://benchlm.ai/benchmarks/sweVerified
- Caveat: Scores attach to a specific model, not to a provider — the model measured is named in each cell. Frontier results now cluster inside a single point and different leaderboards report different figures for the same model, so treat anything under ~1 point as noise rather than a ranking.

## The ten layers

1. [Harness](https://newagent.build/layers/harness) — What thinks. The loop that runs your agent. Take one off the shelf, or skip it and write the loop yourself. 12 options. Required.
2. [Model provider](https://newagent.build/layers/model) — What thinks. Where the tokens come from. A frontier API, a gateway you control, or your own GPUs. 13 options. Required.
3. [Framework](https://newagent.build/layers/framework) — What thinks. The library you write orchestration in, when an off-the-shelf harness is not enough. 8 options. Optional.
4. [Memory](https://newagent.build/layers/memory) — What it knows. What the agent still knows tomorrow. 7 options. Optional.
5. [Retrieval](https://newagent.build/layers/retrieval) — What it knows. Your own corpus, made searchable. 6 options. Optional.
6. [Web grounding](https://newagent.build/layers/search) — What it knows. Live information from outside your walls, in a shape a model can read. 5 options. Optional.
7. [Tools & integrations](https://newagent.build/layers/tools) — What it touches. How the agent acts inside other people's software, and who holds the token when it does. 6 options. Optional.
8. [Security](https://newagent.build/layers/security) — What stops it. Two halves, and you want both. Guardrails decide what the agent may say and do — injection defence, PII redaction, identity. Containment decides what holds when the guardrails do not: a kernel boundary around code it wrote, a default-deny boundary around everything it can reach. Egress control does not stop prompt injection; it removes the payout. 17 options. Required. Multiple picks expected.
9. [Observability & evals](https://newagent.build/layers/observability) — How you run it. Traces of what it did, and a score for whether that was any good. 6 options. Required.
10. [Runtime & deploy](https://newagent.build/layers/runtime) — How you run it. Where it runs, and whether it survives a restart. 8 options. Required.

## Harness

- [Claude Code](https://newagent.build/c/claude-code) — Anthropic's coding agent — terminal, IDE and SDK, with hooks, skills and MCP built in. (proprietary, paid, hosted only) Docs: https://claude.com/claude-code
- [Claude Agent SDK](https://newagent.build/c/claude-agent-sdk) — The Claude Code loop as a library, for agents that are not about code. (proprietary, usage based, hosted only) Docs: https://docs.claude.com/en/api/agent-sdk/overview
- [Hermes Agent](https://newagent.build/c/hermes-agent) — Self-improving agent from Nous Research — writes its own skills from experience and carries them forward. (open source, open source, self-hostable) Docs: https://github.com/NousResearch/hermes-agent
- [OpenClaw](https://newagent.build/c/openclaw) — Self-hosted gateway putting an agent in Slack, Telegram, WhatsApp, Signal, Discord and iMessage at once. (open source, open source, self-hostable) Docs: https://docs.openclaw.ai/
- [Prime Agent](https://newagent.build/c/prime-agent) — Prime Intellect's recursive-language-model harness — a persistent IPython kernel is the only tool, sub-agents are function calls. (open source, open source, self-hostable) Docs: https://www.primeintellect.ai/blog/prime-agent
- [DeepSeek Harness](https://newagent.build/c/deepseek-harness) — Everything is a plugin — the model adapter, the tool registry, the sandbox and the agent loop itself are all swappable. (open source, open source, self-hostable) Docs: https://github.com/deepseek-ai/deepseek-harness
- [OpenAI Agents SDK](https://newagent.build/c/openai-agents-sdk) — Lightweight loop with handoffs, guardrails and sessions. (open source, usage based, hosted only) Docs: https://openai.github.io/openai-agents-python/
- [Codex CLI](https://newagent.build/c/codex-cli) — OpenAI's terminal coding agent. (open source, paid, hosted only) Docs: https://developers.openai.com/codex/cli/
- [OpenCode](https://newagent.build/c/opencode) — Open-source terminal coding agent, provider-agnostic. (open source, open source, self-hostable) Docs: https://opencode.ai/
- [Goose](https://newagent.build/c/goose) — Block's open-source on-machine agent with an extension system. (open source, open source, self-hostable) Docs: https://block.github.io/goose/
- [Letta](https://newagent.build/c/letta) — Stateful agent server where memory is the primary abstraction. (open source, freemium, self-hostable) Docs: https://www.letta.com/
- [Roll your own loop](https://newagent.build/c/build-your-own) — No harness. A while-loop, a model call and your own tool dispatch. (open source, open source, self-hostable) Docs: https://docs.claude.com/en/docs/agents-and-tools/tool-use/overview

## Model provider

- [Anthropic](https://newagent.build/c/anthropic) — Claude Opus, Sonnet and Haiku. Strong tool use and long-horizon agentic work. (proprietary, usage based, hosted only) Docs: https://docs.claude.com/en/docs/about-claude/models
- [OpenAI](https://newagent.build/c/openai) — GPT and o-series via the Responses API. (proprietary, usage based, hosted only) Docs: https://platform.openai.com/docs/models
- [Google Gemini](https://newagent.build/c/google-gemini) — Gemini models with very long context and native multimodality. (proprietary, freemium, hosted only) Docs: https://ai.google.dev/
- [Amazon Bedrock](https://newagent.build/c/bedrock) — Frontier models inside your AWS account, with IAM and VPC boundaries. (proprietary, usage based, hosted only) Docs: https://aws.amazon.com/bedrock/
- [Google Vertex AI](https://newagent.build/c/vertex) — Claude and Gemini under GCP billing, IAM and regional controls. (proprietary, usage based, hosted only) Docs: https://cloud.google.com/vertex-ai
- [DeepSeek](https://newagent.build/c/deepseek) — Strong reasoning and coding at a fraction of frontier pricing, with the weights published so you can move off the API later. (proprietary, usage based, hosted only) Docs: https://api-docs.deepseek.com/
- [OpenRouter](https://newagent.build/c/openrouter) — One API key, several hundred models, automatic failover. (proprietary, usage based, hosted only) Docs: https://openrouter.ai/
- [Hugging Face](https://newagent.build/c/huggingface) — One OpenAI-compatible endpoint routed across Groq, Together, Fireworks, Cerebras and Replicate — with the open-weight catalogue behind it. (proprietary, freemium, hosted only) Docs: https://huggingface.co/docs/inference-providers/index
- [Venice AI](https://newagent.build/c/venice) — Hosted open-weight inference with no prompt logging or retention, plus an anonymising proxy in front of the frontier APIs. (proprietary, freemium, hosted only) Docs: https://venice.ai/
- [LiteLLM](https://newagent.build/c/litellm) — Self-hosted proxy that speaks one API to 100+ providers, with keys and budgets. (open source, open source, self-hostable) Docs: https://www.litellm.ai/
- [Groq](https://newagent.build/c/groq) — Open-weight models at very low latency. (proprietary, freemium, hosted only) Docs: https://groq.com/
- [Ollama](https://newagent.build/c/ollama) — Open-weight models on your own machine. Nothing leaves the box. (open source, open source, self-hostable) Docs: https://ollama.com/
- [vLLM](https://newagent.build/c/vllm) — High-throughput open-weight serving on your own GPUs. (open source, open source, self-hostable) Docs: https://docs.vllm.ai/

## Framework

- [LangGraph](https://newagent.build/c/langgraph) — Graph-shaped orchestration with checkpointing, interrupts and human-in-the-loop. (open source, open source, self-hostable) Docs: https://langchain-ai.github.io/langgraph/
- [Mastra](https://newagent.build/c/mastra) — TypeScript agent framework with workflows, memory, evals and a local playground. (open source, open source, self-hostable) Docs: https://mastra.ai/
- [Pydantic AI](https://newagent.build/c/pydantic-ai) — Type-safe Python agents with structured output that actually validates. (open source, open source, self-hostable) Docs: https://ai.pydantic.dev/
- [CrewAI](https://newagent.build/c/crewai) — Role-based crews of agents with delegation between them. (open source, freemium, self-hostable) Docs: https://www.crewai.com/
- [Agno](https://newagent.build/c/agno) — Fast, lightweight multi-agent runtime with built-in memory and knowledge. (open source, open source, self-hostable) Docs: https://www.agno.com/
- [LlamaIndex](https://newagent.build/c/llamaindex) — Data-first framework — ingestion, indexing and RAG-heavy agents. (open source, freemium, self-hostable) Docs: https://www.llamaindex.ai/
- [DSPy](https://newagent.build/c/dspy) — Programs, not prompts — compile and optimise the prompt against a metric. (open source, open source, self-hostable) Docs: https://dspy.ai/
- [Vercel AI SDK](https://newagent.build/c/vercel-ai-sdk) — Streaming-first TypeScript SDK with a unified provider interface and UI hooks. (open source, open source, self-hostable) Docs: https://ai-sdk.dev/

## Memory

- [Mem0](https://newagent.build/c/mem0) — Extracts durable facts from conversations and recalls them on the next turn. (open source, freemium, self-hostable) Docs: https://mem0.ai/
- [Zep](https://newagent.build/c/zep) — Temporal knowledge graph memory — facts with validity windows, not just embeddings. (open source, freemium, self-hostable) Docs: https://www.getzep.com/
- [Honcho](https://newagent.build/c/honcho) — Treats memory as a reasoning problem, not a retrieval one — you ask its Dialectic API a question about the user and get a synthesised answer. (open source, freemium, self-hostable) Docs: https://github.com/plastic-labs/honcho
- [Supermemory](https://newagent.build/c/supermemory) — Memory graph plus automatic user profiles, with connectors that sync from Drive, Gmail, Notion and GitHub. (proprietary, freemium, hosted only) Docs: https://supermemory.ai/
- [LangMem](https://newagent.build/c/langmem) — Memory primitives that plug straight into LangGraph checkpoints. (open source, open source, self-hostable) Docs: https://langchain-ai.github.io/langmem/
- [Cognee](https://newagent.build/c/cognee) — Builds a graph + vector memory layer over your agent's history and documents. (open source, open source, self-hostable) Docs: https://www.cognee.ai/
- [Postgres (rolled by hand)](https://newagent.build/c/postgres-memory) — A messages table and a summaries table. Boring, auditable, yours. (open source, open source, self-hostable) Docs: https://www.postgresql.org/

## Retrieval

- [pgvector](https://newagent.build/c/pgvector) — Vector search inside the Postgres you already run. (open source, open source, self-hostable) Docs: https://github.com/pgvector/pgvector
- [Qdrant](https://newagent.build/c/qdrant) — Rust vector database with strong payload filtering, self-host or cloud. (open source, freemium, self-hostable) Docs: https://qdrant.tech/
- [Pinecone](https://newagent.build/c/pinecone) — Fully managed vector database. No index to operate. (proprietary, freemium, hosted only) Docs: https://www.pinecone.io/
- [Chroma](https://newagent.build/c/chroma) — Embedded vector store that runs in-process. Ideal first index. (open source, open source, self-hostable) Docs: https://www.trychroma.com/
- [turbopuffer](https://newagent.build/c/turbopuffer) — Vector and full-text search on object storage — very cheap at rest. (proprietary, usage based, hosted only) Docs: https://turbopuffer.com/
- [LanceDB](https://newagent.build/c/lancedb) — Embedded multimodal store backed by the Lance columnar format. (open source, open source, self-hostable) Docs: https://lancedb.com/

## Web grounding

- [Exa](https://newagent.build/c/exa) — Embeddings-native web search built for agents, with full-content retrieval. (proprietary, freemium, hosted only) Docs: https://exa.ai/
- [Tavily](https://newagent.build/c/tavily) — Search API that returns model-ready answers rather than ten blue links. (proprietary, freemium, hosted only) Docs: https://tavily.com/
- [Firecrawl](https://newagent.build/c/firecrawl) — Turns any site into clean markdown, including the JavaScript-heavy ones. (open source, freemium, self-hostable) Docs: https://www.firecrawl.dev/
- [Brave Search API](https://newagent.build/c/brave-search) — Independent web index with straightforward per-query pricing. (proprietary, freemium, hosted only) Docs: https://brave.com/search/api/
- [SearXNG](https://newagent.build/c/searxng) — Self-hosted metasearch. No third-party search vendor in the path. (open source, open source, self-hostable) Docs: https://docs.searxng.org/

## Tools & integrations

- [MCP (Model Context Protocol)](https://newagent.build/c/mcp) — The open protocol for exposing tools and data to agents. The default answer. (open source, open source, self-hostable) Docs: https://modelcontextprotocol.io/
- [Composio](https://newagent.build/c/composio) — Managed auth and tool-calling for 250+ SaaS apps. (open source, freemium, hosted only) Docs: https://composio.dev/
- [Arcade](https://newagent.build/c/arcade) — Tool-calling with per-user OAuth, so the agent acts as the user, not as root. (open source, freemium, self-hostable) Docs: https://www.arcade.dev/
- [Browserbase](https://newagent.build/c/browserbase) — Managed headless browsers with stealth and session replay, plus Stagehand. (proprietary, freemium, hosted only) Docs: https://www.browserbase.com/
- [Playwright MCP](https://newagent.build/c/playwright-mcp) — Drive a real local browser over MCP, using the accessibility tree. (open source, open source, self-hostable) Docs: https://github.com/microsoft/playwright-mcp
- [Nango](https://newagent.build/c/nango) — Open-source integration platform — you own the OAuth and the sync logic. (open source, freemium, self-hostable) Docs: https://www.nango.dev/

## Security

- [Llama Guard](https://newagent.build/c/llama-guard) — Open-weight classifier for input and output safety. Runs wherever you run it. (open source, open source, self-hostable) Docs: https://www.llama.com/docs/model-cards-and-prompt-formats/llama-guard-3/
- [Guardrails AI](https://newagent.build/c/guardrails-ai) — Declarative input/output validators with a hub of prebuilt checks. (open source, open source, self-hostable) Docs: https://www.guardrailsai.com/
- [NeMo Guardrails](https://newagent.build/c/nemo-guardrails) — NVIDIA's programmable rails — constrain topic, dialogue path and tool use. (open source, open source, self-hostable) Docs: https://github.com/NVIDIA/NeMo-Guardrails
- [Lakera Guard](https://newagent.build/c/lakera) — Prompt-injection and jailbreak detection as a low-latency API call. (proprietary, freemium, hosted only) Docs: https://www.lakera.ai/
- [Rebuff](https://newagent.build/c/rebuff) — Open-source prompt-injection detector with canary tokens. (open source, open source, self-hostable) Docs: https://github.com/protectai/rebuff
- [Invariant](https://newagent.build/c/invariant) — Policy engine and analyzer for agent traces and MCP tool calls. (open source, freemium, self-hostable) Docs: https://invariantlabs.ai/
- [Descope Agentic Identity](https://newagent.build/c/descope-agentic) — Identity, delegated consent and scoped tokens for agents acting on behalf of users. (proprietary, freemium, hosted only) Docs: https://www.descope.com/agentic-identity
- [Auth0 for AI Agents](https://newagent.build/c/auth0-ai) — Token vault, async user approval and fine-grained authorization for tool calls. (proprietary, freemium, hosted only) Docs: https://auth0.com/ai
- [Oso](https://newagent.build/c/oso) — Authorization-as-a-service — decide what this agent may touch, per record. (open source, freemium, self-hostable) Docs: https://www.osohq.com/
- [Microsoft Presidio](https://newagent.build/c/presidio) — PII detection and redaction before text ever reaches a model provider. (open source, open source, self-hostable) Docs: https://microsoft.github.io/presidio/
- [Cloudflare AI Gateway](https://newagent.build/c/cf-ai-gateway) — Rate limiting, caching, spend caps and logging in front of any provider. (proprietary, freemium, hosted only) Docs: https://developers.cloudflare.com/ai-gateway/
- [iron-proxy](https://newagent.build/c/iron-proxy) — Default-deny egress firewall for untrusted workloads. The sandbox holds worthless proxy tokens; real credentials are swapped in at the boundary. (open source, open source, self-hostable) Docs: https://github.com/paradigmxyz/iron-proxy
- [gVisor](https://newagent.build/c/gvisor) — Google's user-space kernel. Intercepts syscalls before they reach the host, without paying for a full VM. (open source, open source, self-hostable) Docs: https://gvisor.dev/
- [Firecracker](https://newagent.build/c/firecracker) — AWS microVMs — a separate Linux kernel per sandbox, booting in about 125ms. (open source, open source, self-hostable) Docs: https://firecracker-microvm.github.io/
- [Kata Containers](https://newagent.build/c/kata) — MicroVM isolation behind the ordinary container API — drops into Kubernetes as a RuntimeClass. (open source, open source, self-hostable) Docs: https://katacontainers.io/
- [No isolation (host process)](https://newagent.build/c/host-only) — The agent runs as an ordinary process on the host. Honest default only when it executes no code and reads nothing untrusted. (open source, open source, self-hostable) Docs: https://owasp.org/www-project-top-10-for-large-language-model-applications/
- [E2B](https://newagent.build/c/e2b) — Firecracker sandboxes for running code the agent wrote, safely. (open source, freemium, self-hostable) Docs: https://e2b.dev/

## Observability & evals

- [Langfuse](https://newagent.build/c/langfuse) — Open-source tracing, prompt management and evals. Self-hostable in one compose file. (open source, freemium, self-hostable) Docs: https://langfuse.com/
- [LangSmith](https://newagent.build/c/langsmith) — Tracing, datasets and evals from the LangChain team. (proprietary, freemium, hosted only) Docs: https://www.langchain.com/langsmith
- [Braintrust](https://newagent.build/c/braintrust) — Eval-first platform — scorers, datasets and a playground for prompt iteration. (proprietary, freemium, self-hostable) Docs: https://www.braintrust.dev/
- [Arize Phoenix](https://newagent.build/c/phoenix) — OpenTelemetry-native tracing and evals you can run locally. (open source, open source, self-hostable) Docs: https://phoenix.arize.com/
- [Pydantic Logfire](https://newagent.build/c/logfire) — OpenTelemetry observability with first-class Python and Pydantic AI support. (open source, freemium, hosted only) Docs: https://pydantic.dev/logfire
- [promptfoo](https://newagent.build/c/promptfoo) — Local eval and red-team harness that runs in CI. No account needed. (open source, open source, self-hostable) Docs: https://www.promptfoo.dev/

## Runtime & deploy

- [Docker Compose](https://newagent.build/c/docker-compose) — One file, one box, everything local. The honest starting point. (open source, open source, self-hostable) Docs: https://docs.docker.com/compose/
- [Vercel](https://newagent.build/c/vercel) — Streaming-friendly serverless for TypeScript agents with a web front end. (proprietary, freemium, hosted only) Docs: https://vercel.com/
- [Cloudflare Workers](https://newagent.build/c/cloudflare-workers) — Edge runtime with Durable Objects for long-lived, stateful agent sessions. (proprietary, freemium, hosted only) Docs: https://developers.cloudflare.com/agents/
- [Modal](https://newagent.build/c/modal) — Python-native serverless with GPUs and sandboxes, scale to zero. (proprietary, freemium, hosted only) Docs: https://modal.com/
- [Fly.io](https://newagent.build/c/fly) — Long-running containers close to users, without owning a Kubernetes cluster. (proprietary, usage based, hosted only) Docs: https://fly.io/
- [Temporal](https://newagent.build/c/temporal) — Durable execution — the run survives a crash, a deploy and a week of waiting. (open source, freemium, self-hostable) Docs: https://temporal.io/
- [Centaur](https://newagent.build/c/centaur) — Paradigm's self-hosted control plane: one shared team agent, an isolated k8s sandbox per Slack thread, and no raw API keys in the agent's environment. (open source, open source, self-hostable) Docs: https://github.com/paradigmxyz/centaur
- [Kubernetes](https://newagent.build/c/k8s) — Your existing cluster. Nothing new for the platform team to approve. (open source, open source, self-hostable) Docs: https://kubernetes.io/

## Notes

- The registry is hand-curated and opinionated. Every entry links to its own upstream docs; check there before quoting specifics.
- Two layers are covered here that most agent directories omit: harnesses (the loop you take off the shelf) and security (guardrails plus containment).
- Security is multi-select by design. A guardrail, a sandbox and an egress boundary are complements, not alternatives.