Your coding agent can rm -rf ~/.ssh.
agentjail blocks it before it runs.

Policy guardrails for coding agents. Offline. Open Source.

  • OS-native sandbox · Landlock + Seatbelt
  • Network visibility · reads the LLM transcript
  • No VM · no kernel module
  • Rego on OPA · CNCF Graduated
  • Policy decisions in ~8ms median
  • Guards files, shell, MCP & cloud/DB creds
install now!
$ curl -fsSL https://agentjail.io/install.sh | sh
GitHub
Works with
Claude Code
Codex CLI
Cursor
// SEE IT IN ACTION

Watch it block a live agent.

A dangerous action, blocked live in under 10 ms, on your machine. How it works →

// SELF-DIAGNOSIS

Do I need this?

If any of these hit close to home, yes.

Don't trust your production data to a markdown fileCLAUDE.md, agents.md, .cursorrules. Use deterministic guardrails.

01

Every dev on your team can install any MCP server.

No approval. No inventory. No kill switch.

BLOCKED

Granular MCP tool-level policies + full server inventory

mcp_policy mcp inventory
02

Your devs run --dangerously-skip-permissions.

Because clicking Allow 200 times a day isn't a security strategy.

AUTOMATED

14 dangerous patterns blocked. Safe calls pass through.

command_policy
03

An agent force-pushed to main and ran npm publish.

In one session. You found out from PagerDuty.

BLOCKED

Force-push, publish, piped installs, code egress.

command_policy
04

The auditor asks how you control AI agent access.

You don't have an answer yet.

COVERED

Policy-as-code. Default-deny. Auditable decision log.

rego policies
If you nodded at even one, you need agentjail. Install now
// THE FLOW

One tool call. Three steps.
Stopped cold.

01 PROMPT
~/projects/api · claude
user clean up the credentials folder
agent sure, I'll handle that.
tool_call Bash(
"rm -rf ~/.ssh/"
)

The agent picks a destructive command from its tool call.

02 HOOK
agentjail-daemon
event: PreToolUse
tool: "Bash"
cmd: "rm -rf ~/.ssh/"
evaluating rego…
match file_policy
↳ ~8ms

The local OPA daemon evaluates the call against your rules, in ~8ms median.

03 VERDICT
~/projects/api · claude
BLOCKED
rm -rf on sensitive path
↳ rule
file_policy/sensitive_path
agent stops. your keys are safe.

deny is returned before the shell ever runs.

One install. 14 dangerous patterns blocked. ~8ms median.

Install agentjail
// WHY AGENTJAIL

Why not just use...

CLAUDE.md / agents.md
Docker / VM
AGENTJAIL
Enforcement
Prompt-based. LLM can ignore it.
Container boundary. No policy granularity.
Deterministic. Policy-as-code via Rego.
Latency
0ms (it's just text)
100ms+ container overhead
~8ms median per tool call
MCP control
No
No
Yes. Default-deny.
File access control
No
Volume mounts only
Path-level Rego policies
Audit trail
No
No
Every decision logged
Network visibility
No
Coarse egress on/off
Full LLM transcript, no system extension
Setup
Edit a file
Dockerfile + compose + volume config
One curl command
// DEFAULTS

Protected out of the box.

3 CORE POLICIES ALWAYS ON
  • file_policy - .ssh, .aws, .gnupg, .env*, *.pem, id_rsa
  • mcp_policy - unknown servers, *stripe*, *payment*, *billing*
  • command_policy - 14 patterns: rm -rf, curl|bash, sudo, force-push, env|curl...
LIBRARY RULES OPT-IN
  • no_shell_init_write - block writes to .zshrc, .bashrc
  • no_app_binary_write - block writes to app binaries
  • no_launchctl - block osascript, launchctl, crontab
  • no_history_read - block reads of shell history, browser cookies
  • no_shell_eval - block eval, bash -c $VAR, base64 pipelines
See all policies →
// ROADMAP

What's shipped. What's next.

Currently at v1.1.0. Read the full changelog →

✓
Hook + OPA daemon + core policies shipped

Intercepts every tool call before it runs, evaluates Rego policies in <5ms

✓
Network egress control shipped

Default-deny network egress: the agent reaches only allowlisted hosts, every other connection is blocked - enforced by the transparent tunnel, even if a hook is bypassed

✓
Self-protection + structured parsing shipped

Agents cannot disable their own hooks, daemon, or policy files

✓
Web UI + replay TUI + daemon auto-update shipped

Live dashboard, full-screen session replay, and automatic daemon updates

✓
Per-tool MCP policy + MCP inventory shipped

Granular tool-level gating within MCP servers, full surface inventory from configs, npm, pip, and Docker

✓
Per-project policy + session tracking shipped

Policy cascading from global to per-project overrides, PID-based active session detection, Cobra CLI

✓
agentjail-shield - Landlock + Seatbelt sandbox shipped

The same OS sandbox that already contains the internet's most hostile code: Seatbelt, which runs untrusted web JavaScript in Chrome and Safari, and Landlock, the mainline-kernel LSM Microsoft uses in Azure and Google ships in ChromeOS. Files and exec denied by default - no bespoke VM to trust

✓
Network visibility - capture gateway + transparent tunnel shipped

Read exactly what your agent sends its model: the LLM request/response is captured (on macOS with no system extension), and the opt-in tunnel MITMs and enforces per-host policy on all traffic, HTTP/2 and gRPC included

macOS app planned

Native menu bar app for one-click install, policy management, and live session monitoring

Cost tracking + session budgets planned

Track token usage per agent, session, and project. Set session limits so a runaway agent doesn't eat your entire daily quota

eBPF LSM / System extension planned

System-wide kernel enforcement for any process, not just hooked agents. The strongest isolation tier