The OpenHands Software Agent SDK: A Composable and Extensible Foundation for Production Agents — arXiv

Claims

1. benchmarks-v1
   Self-reported results for the V1 SDK: on SWE-Bench Verified, 72.8% with Claude Sonnet 4.5, 68.8% with GPT-5 at high reasoning effort, 68.0% with Claude Sonnet 4, and 65.2% with Qwen3 Coder 480B. On the GAIA validation set, 67.9% with Claude Sonnet 4.5, 62.4% with GPT-5, 57.6% with Claude Sonnet 4, and 41.2% with Qwen3 Coder 480B. The authors state evaluations were run at a single named commit of the SDK and of the benchmark harness.

   "SDK achieves 72% resolution rate using Claude Sonnet 4.5 with extended thinking ... SDK achieves 67.9% accuracy with Claude Sonnet 4.5 ... Evaluations were performed at commit 54c5858 of the SDK and commit 88f1d80 of the benchmarks"

   Locator: table: Table 2 and Section 5.2 · Quote language: en
2. model-agnostic
   The SDK reaches more than 100 model providers through LiteLLM, a library that exposes many model APIs behind one interface. For models lacking native function calling, a mixin converts tool schemas into text prompts and parses tool calls back out of the model's output, which the authors say expands the set of usable models. A RouterLLM class allows different requests within one conversation to be sent to different models, for example routing image-bearing messages to a multimodal model and text to a cheaper one.

   "Through LiteLLM, it supports 100+ providers with two APIs ... This enables models that do not support function calling to be used for agentic tasks, dramatically expanding the set of usable models"

   Locator: section: 4.3 · Quote language: en
3. openhands-dev-contacts
   The November 2025 preprint gives its corresponding authors' contact addresses on the openhands.dev domain, and cites the project's repositories under the OpenHands GitHub organisation rather than All-Hands-AI. This places the company's public use of the OpenHands name no later than November 2025.

   "{xingyao, graham}@openhands.dev ... https://github.com/OpenHands/software-agent-sdk"

   Locator: section: Title block, contact and metadata lines · Quote language: en
4. security-confirmation
   The SDK separates risk assessment from enforcement using two components. A security analyzer rates each proposed tool call as low, medium, high, or unknown risk; a confirmation policy decides whether user approval is required. When approval is needed the agent halts in a waiting-for-confirmation state until the user approves or rejects, and may retry with a safer alternative after rejection. The policy can be changed during a session. A built-in pair blocks actions above a configurable threshold, defaulting to high.

   "the SecurityAnalyzer, which rates each tool call as low, medium, high, or unknown risk, and the ConfirmationPolicy, which determines whether user approval is required ... the agent pauses in a special WAITING_FOR_CONFIRMATION state ... blocks actions exceeding a configurable risk threshold (default: high)"

   Locator: section: 4.9 · Quote language: en
5. v0-problems
   The authors describe three architectural problems in the original OpenHands design, which they call V0. Mandatory Docker sandboxing split each conversation across two processes that could diverge or crash independently, and supporting local execution required duplicated code paths. Configuration had grown to more than 140 fields across 15 classes and about 2,800 lines, spread over parallel hierarchies for the CLI, web UI, GitHub app, and hosted service, so that identical parameters could produce diverging runs. The monorepo mixed agent core, evaluation benchmarks, and applications, letting benchmark dependencies leak into deployments.

   "severe sprawl — 140+ fields, 15 classes, and 2.8K lines of configuration code — a brittle system where small changes often cascaded into unrelated failures"

   Locator: section: 3.1-3.3 · Quote language: en
6. v1-packages-and-state
   OpenHands V1 is organised into four Python packages: openhands.sdk for core abstractions and the event system, openhands.tools for tool implementations, openhands.workspace for execution environments, and openhands.agent_server for a REST and WebSocket API. Agents, tools, and LLM configurations are immutable and validated at construction; the only mutable component is a conversation state object holding an append-only event log, which allows sessions to be persisted incrementally and resumed by replaying events.

   "components like Agent, Tool, and LLM are immutable and serializable — all changing variables live in ConversationState, making it the only stateful component ... Conversations resume by loading base_state.json and replaying events"

   Locator: section: 4.1-4.2 · Quote language: en