Give AI agents your team's recurring engineering work, without giving them your credentials.
SecondShift runs agent jobs you define in your repository. Write a skill, commit it with its config, and review it like any other change. Each run is sandboxed, with no network and no secrets, and can use only the tools the workspace approved. Results land where your team already works, such as Slack, a GitHub issue or a draft PR.
Runs on your laptop with one command, or on your own server in production.
Quick start · Skill catalog · Security model · Docs
official-audit-walkthrough.mp4
You need uv, Docker, and a model API key or a Claude Code or Codex subscription. Start Docker, then run:
release=https://github.com/piotrekno1/second-shift/releases
uv tool install --force --python 3.13 \
"$release/download/v0.1.0b10/secondshift-0.1.0b10-py3-none-any.whl"
secondshift upThe first start builds the agent image for subscriptions and takes a few
minutes. Use secondshift up --no-agents to skip it. Your dashboard opens when
SecondShift is ready.
Try it on this repository. SecondShift reviews its own documentation:
- Clone it:
git clone https://github.com/piotrekno1/second-shift.git - In Repositories, choose Add local repository and select the clone.
- In Models, add an API key or a Claude Code or Codex subscription.
- In Jobs, open Documentation drift and click Run now.
For one-off work, open a repository, click New task and write what to do. To connect your coding agent, open Connect your agent in the account menu.
Your team asks agents for the same work every week. Triage the CI failures. Check which docs went stale. Look into the alert that fired at 3am. Each time, someone writes the prompt again, waits for the answer and pays for the tokens. Often two people pay for the same answer.
Automating it means letting agents run unattended. That is the hard part.
- Security. It needs your keys and a shell. One prompt injection reaches everything.
- Cost. Token spend has no ceiling.
- Orchestration. A cron job on someone's laptop, with no retries and no record.
So teams keep prompting by hand, or accept these risks.
With SecondShift you define the work once. It runs on a schedule or when an event arrives, once for the whole team, with the controls you already expect for code. The latest result is already waiting in Slack, or in your coding agent over MCP.
A job is a skill plus a few lines of YAML in .secondshift.yaml:
jobs:
alert-triage:
name: Alert triage
skill: .agents/skills/alert-triage/SKILL.md
triggers: [webhook]
webhook:
skip_when: { status: resolved }
repeat_key: groupKey
repeat_window: 1h
requires:
mcps:
- binding: grafana
tools: [query_prometheus, query_loki_logs, alerting_rules_read]
- binding: sentry
tools: [search_issues, search_errors]
notify:
- binding: alerts-slack- Merge it. SecondShift syncs the repository and finds the job.
- Approve access. The job asks for tools by name. A workspace owner decides which connection provides them and can restrict their arguments. The YAML never holds a credential, endpoint or token.
- It runs. On a schedule, from a webhook, or on demand. The agent works in a networkless sandbox on a snapshot of the commit. Tool calls go through a broker that checks each one against the approved plan.
- It delivers. SecondShift posts the report, opens the issues or the draft pull request, and keeps the run's full record.
Work defined in Git. Skills and schedules are files in the repository. Changes go through pull requests and code owners. Every run records the commit it ran and the exact access it had.
Access an owner approves. Repositories request capabilities. Owners grant them per job, per tool, and can fix, limit or forbid individual arguments. An owner can also make the merge itself the approval for tools a connection already allows.
No secrets in the sandbox. The agent runs with no network and no credentials. SecondShift makes tool calls, opens pull requests and files issues on its behalf. The model is always isolated from keys.
Three ways to start work.
- Schedules for recurring reviews and briefings.
- Webhooks for events such as alerts, with signed requests and filters for resolved and repeated alerts.
- One-off tasks from the dashboard or your coding agent, queued per repository and optionally delayed.
Output your team can act on. Reports to Slack or any webhook, with retry.
Files the agent saved, such as CSVs and images. GitHub issues, deduplicated and
capped per run. Draft pull requests on a secondshift/run-<id> branch. Jobs
can read their own earlier reports, so a weekly review knows what it said last
week.
Your choice of model. Use an API key from a model provider, a local model, or a Claude Code or Codex subscription. Subscription logins can be capped per 24 hours so overnight jobs don't use up the team's day.
Costs with a ceiling. Each run has a token budget and a tool-call limit. The gateway cuts a run off when its budget is used.
History you can see. Each run shows its trigger, commit, tool calls, token usage and model cost. Runs are durable workflows. They survive restarts, and retries don't repeat tool calls.
Works with your coding agent. SecondShift is an MCP server. Claude Code,
Codex, Cursor and other clients can check a .secondshift.yaml before you
commit it, start approved jobs, submit tasks and read reports. Tokens are
scoped to a person and a workspace and can never approve access.
The skill catalog has example skills to copy into your repository and adapt.
| Team | Examples |
|---|---|
| Developers | Repository health, docs drift, implicit state machines, CI failures |
| SRE and operations | Alert triage, production errors, monitoring coverage, on-call coverage |
| Security and compliance | Security regression, quarterly access review |
| Engineering management | Monday briefing, release readiness, ticket reconciliation |
The deployment guide covers a single-server Docker Compose setup with HTTPS, PostgreSQL, S3 or local artifact storage, and gVisor. It includes tested backup, restore and upgrade steps.
See GitHub repository access to set up access with a GitHub App or a personal access token.
| What | Where it lives during a run | Never reaches |
|---|---|---|
| Model provider key | Gateway | Agent loop, sandbox, model |
| MCP and API credentials | Worker or gateway, per broker call | Sandbox, model |
| GitHub write token | Worker, after the sandbox stops | Sandbox, model |
| Subscription login | Runner, sealed to its key | Container arguments, environment, logs |
SecondShift treats repository content, model output and tool results as untrusted.
Approving a write tool means trusting the agent with it. The security model covers this and the other risks that remain.
SecondShift is in beta. See the release notes for what changed and what was tested.