Fuselee

Reference

Self-hosting with fuselee-agent

Keep every credential in your own environment; the agent reports numbers only.

fuselee-agent is an MIT-licensed daemon that runs the same provider adapters inside your network. It reads spend and executes cutoffs locally and talks to the Fuselee API over outbound HTTPS with a revocable token. No inbound ports, read-only container, non-root user.

Run it

  1. Dashboard → Agents → New agent. Copy the fsa_ token (shown once).
  2. Run the container with FUSELEE_API_URL, FUSELEE_AGENT_TOKEN and the provider credentials you want it to own.
  3. Within one heartbeat the providers appear on your dashboard as agent-managed; create budgets as usual.
docker run -d --name fuselee-agent --restart unless-stopped --read-only --tmpfs /tmp \
  -e FUSELEE_API_URL=https://worker.example \
  -e FUSELEE_AGENT_TOKEN=fsa_... \
  -e OPENAI_ADMIN_KEY=sk-admin-... -e OPENAI_ORG_ID=org_... \
  ghcr.io/fuselee/fuselee-agent:latest

Least-privilege policies for every provider ship with the agent. Source and README: the fuselee-agent repository on GitHub.