Agno AgentOS API by Software Sushi

Run an Agno agent through a local authenticated API and keep its conversation sessions in SQLite across service restarts. The included CSV Analyst agent reads a local CSV, invokes a calculation tool, and writes a JSON result that you can check independently.

This is a paid repackaging of open-source Agno 3.1.11 (Apache-2.0), with Software Sushi installation, service configuration, documentation and a CSV starter. Agno's commercial control-plane UI, hosted service, no-code editor and SSO are not included. No model weights, provider subscription or API credit is included. Provider terms and charges apply separately. Software Sushi is independent of Agno and does not imply endorsement.

Launch and connect

Use Ubuntu's ubuntu account. A t3.medium with 4 GiB RAM and a 24 GiB root volume is the starting configuration for this API with a remote model; scale for your workload. No GPU is required. Use encrypted storage and restrict administration to your organization.

Connect using AWS Systems Manager Session Manager, or SSH with your configured instance key. Do not open an inbound application port. The API listens only on 127.0.0.1:7777. There is no bundled browser UI. Every HTTP route, including health, requires a Bearer token. Browser Origin requests are rejected.

The service starts automatically and creates a unique per-instance API token at first boot. It can answer health requests before a model provider is configured. To check it:

sudo -iu ubuntu sushi-agno health

Configure a model provider

In an unrecorded interactive terminal, run:

sudo -iu ubuntu sushi-agno configure

Enter the model ID and an OpenAI-compatible base URL. For OpenAI, use https://api.openai.com/v1 and a model available to your account, for example gpt-4.1-mini. The provider key prompt does not echo. Other compatible providers need their own exact model ID and HTTPS URL. A model server on this instance can use a loopback HTTP URL and its configured token. This image does not install or download a model server. Tool calling and non-streaming chat completions must be supported. A provider that only implements text completion is insufficient.

Restart the service after saving:

sudo systemctl restart sushi-agno
sudo -iu ubuntu sushi-agno health
sudo -iu ubuntu bash /opt/sushi/docs/demo.sh

The demo makes one bounded agent task, normally two model requests. It creates input.csv containing 5, 17 and 20, calls the real Agno calculation tool, checks that the sum is 42 and the row count is 3, and reads the stored native session. The task files are kept in the reported directory under /var/lib/agno/workspace/. Model requests have a 60-second timeout, no SDK retries and a 512-token response limit. Network and provider failures can still incur charges. The agent has a calculation tool; no shell, email, Slack or CRM tools are configured. Agno telemetry and OpenTelemetry collection are disabled.

Use the API

Use sushi-agno on the instance to avoid putting tokens in terminal arguments. For your own client, read api_token from /home/ubuntu/.config/sushi-agno/settings.json and set the HTTP Authorization: Bearer header in memory. Never print the file, header or token. The file also contains your model provider key and must stay mode 0600.

POST /agents/csv-analyst/runs accepts form fields message, session_id, user_id, and stream=false. Use a unique task name made of letters, numbers and hyphens, at most 80 characters. Create its directory under /var/lib/agno/workspace/ as ubuntu, and add input.csv with exactly one value column of integers. Ask the agent to use calculate_csv with that task name as run_id. The tool accepts at most 1,000 rows and 64 KiB, and writes result.json once. Use a new task directory for another calculation.

Read a session with GET /sessions/SESSION_ID/runs?type=agent&db_id=sushi-agno-sqlite, replacing SESSION_ID with the ID you supplied. The local API token grants administrator access to this single-user runtime, including upstream session-management APIs. It is not a multi-tenant service or an operating-system sandbox. Do not share it with untrusted callers.

For access from a workstation, keep the listener local and use the Session Manager port-forwarding command printed by the instance login banner. For SSH, take the connection command shown by your EC2 console and add -N -L 7777:127.0.0.1:7777 using your existing key configuration. Point your API client at http://127.0.0.1:7777 through that tunnel and load the token using your approved secret handling procedure. No public application ingress is needed.

Persistence and recovery

sushi-agno.service runs as ubuntu. Application code and dependencies live in /opt/agno/; only /var/lib/agno/ is writable by the service. Settings are in the separate file above. SQLite stores sessions in /var/lib/agno/sessions.db; task inputs, JSON results and readbacks live under workspace/.

To create a task, retain its actual directory in the current shell, and verify it after a restart:

task_directory=$(sudo -iu ubuntu sushi-agno demo)
sudo -iu ubuntu python3 -I -B /opt/agno/readback.py "$task_directory"
sudo systemctl restart sushi-agno
sudo -iu ubuntu sushi-agno session "$task_directory"
sudo -iu ubuntu python3 -I -B /opt/agno/readback.py "$task_directory" --after-restart

The session command creates its restart readback once and refuses to overwrite it. These commands verify an idle restart; they do not promise exactly-once execution after a crash during a model/tool call. Preserve failed task directories and use a new one when retrying. Back up /var/lib/agno/ while the service is stopped, including any SQLite WAL files, and back up settings through an encrypted secret backup process. Deleting or replacing the instance or its EBS volume loses local state unless backed up.

Check sudo systemctl status sushi-agno and sudo journalctl -u sushi-agno after a failure. HTTP 401 means the client token does not match; 503 on a run means provider setup is incomplete. For provider authentication, model or connectivity errors, rerun the interactive configuration, confirm provider access and restart. Never paste populated settings or provider errors into a public support ticket. To rotate API access, stop the service, replace api_token in the settings with a fresh URL-safe token of at least 43 characters using a secure editor, retain mode 0600, and restart. Existing clients need the new token.

Agno and dependency licenses/notices are retained in /usr/share/doc/agno/. The exact original source and wheel inputs are in /opt/agno/sources/ and /opt/agno/wheels/. Updates require reviewing your provider compatibility and backups; do not upgrade the installed environment in place with an unpinned pip command.