Running Team AI Agents in Slack with Centaur

Developers are rapidly adopting CLI agents like Claude Code, Codex, or Amp. We ask them to refactor a module, run tests, or find a bug in logs. But the results of this work usually stay in the terminal of a specific engineer. When a question about a failed build comes up in a work chat, someone has to go to the console and manually feed data to the neural network.

Venture fund Paradigm has released Centaur as open source. It's a platform that turns local autonomous agents into shared team assistants living right in Slack or Teams.

Why You Need Centaur

The main challenge with deploying AI agents across an entire team is security. Giving an LLM direct access to an environment with production keys is more dangerous than letting an intern into production on a Friday evening. Centaur solves this through isolated sandboxes.

You deploy the platform in your own infrastructure. A team member mentions @centaur in a Slack thread with a task, and the system creates an isolated context and starts working.

# Пример взаимодействия в Slack
@centaur можешь разобраться, почему падают тесты биллинга?

After that, Centaur allocates a separate container for the task, runs an agent there, gives it access to code and tools, and delivers intermediate and final results back to the thread.

Security and Architecture

Paradigm's engineers designed a secure boundary for autonomous code execution. The system consists of several components:

• Rust Control Plane — handles queues, conversation state, authorization, and workflow execution via Postgres.
• Kubernetes Sandbox — each conversation spins up a container-based isolate. It comes pre-installed with Git, Python, Node.js, Bun, and a basic set of CLI utilities.
• iron-proxy Network Proxy — handles secret management.

The most interesting part here is on-the-fly credential substitution. By default, the pod with the agent has NetworkPolicy blocked. The agent doesn't receive real API keys or tokens from internal services at all. Its environment contains fake placeholder strings instead.

When the agent makes an HTTP request to a third-party API, traffic passes through the proxy layer. The proxy checks the destination domain, finds the corresponding header, and substitutes the real key from 1Password right before sending the packet to the external network. Even if the model gets compromised or generates output with all its env, real secrets won't leak out.

Slack / API
    │
    ▼
Centaur API (Rust + Postgres)
    │
    ▼
Kubernetes Sandbox (Agent + Workspace + Shell)
    │
    ▼
iron-proxy (Проверка доменов и инъекция реальных секретов)
    │
    ▼
Внешний интернет / Внутренние сервисы

How to Extend Agent Capabilities

Centaur has two extension formats: Tools and long-running Workflows.

Tools

Tools are packaged as regular Python packages. They can wrap your company's internal APIs, databases, or CLI utilities.

When the container starts, the platform mounts these scripts as command-line wrappers. The agent discovers them at startup via the centaur-tools list command and reads argument instructions from --help.

The tool structure looks familiar:

tools/my_tool/
├── __init__.py
├── client.py
├── cli.py
├── .env.example
└── pyproject.toml

Workflows

If a task takes more than two minutes, requires waiting for external events, or involves service restarts, you use workflows. These are Python functions with durable execution steps.

WORKFLOW_NAME = "daily_digest"

async def handler(inp, ctx):
    # Данные сохранятся, даже если сервис перезагрузится во время выполнения
    data = await ctx.step("collect", lambda: collect_digest_data(inp))
    summary = await ctx.run_agent("summarize", text=f"Сделай краткую выжимку: {data}")
    return {"summary": summary}

This approach saves the day when an agent needs to run a long test suite, wait for a response from an external system, or break a complex task into a chain of independent subtasks.

What You Can Delegate to Centaur

In the project README, the authors highlight several use cases the system was originally designed for:

• Investigating failures in CI/CD pipelines.
• Generating daily digests and on-call reports.
• Quickly finding answers in internal company knowledge bases via custom plugins.
• Analyzing context and summarizing long threads in Slack.
• Connecting agents to an isolated test environment for code debugging.

Deployment and Launch

You won't need to spin up a full heavy Kubernetes cluster just to get familiar with the project. For local development or deployment on a small Mac Mini / VPS, a lightweight k3s is sufficient.

Project management is tied to the just utility. The launch process comes down to a few steps:

# Клонируем репозиторий
git clone https://github.com/paradigmxyz/centaur
cd centaur

# Устанавливаем раннер команд
brew install just

# Настраиваем переменные для Slack и 1Password в bash-сессии
export OP_SERVICE_ACCOUNT_TOKEN=...
export SLACK_BOT_TOKEN=...
export SLACK_SIGNING_SECRET=...

# Создаём секреты в локальном K8s и запускаем стек
just bootstrap-secrets
just up

After the build completes, the bot will start accepting commands in Slack or via REST API.

Summary

Paradigm has delivered a neat tool with the right security focus. Instead of creating another isolated web interface, the developers focused on integration with existing team chat and running code in isolated sandboxes.

If your team already actively uses console AI agents and you're looking for a way to safely share their capabilities between employees, Centaur is definitely worth checking out. The project is released under an open license, and the Rust-based control plane leaves a pleasant impression in terms of resource usage.