Your coding agent can rm -rf ~/.ssh.
agentjail blocks it before it runs.

Policy guardrails for coding agents. Offline. Open Source.

  • OS-native sandbox · Landlock + Seatbelt
  • Network visibility · reads the LLM transcript
  • No VM · no kernel module
  • Rego on OPA · CNCF Graduated
  • Policy decisions in ~8ms median
  • Guards files, shell, MCP & cloud/DB creds
install now!
$ curl -fsSL https://agentjail.io/install.sh | sh
GitHub
Works with
Claude Code
Codex CLI
Cursor
// SEE IT IN ACTION

Watch it block a live agent.

A dangerous action succeeds unguarded, then policy and network controls stop it. Watch the full 2.5-minute tour → · How it works →

// SELF-DIAGNOSIS

Do I need this?

If any of these hit close to home, yes.

Don't trust your production data to a markdown fileCLAUDE.md, agents.md, .cursorrules. Use deterministic guardrails.

01

Every dev on your team can install any MCP server.

No approval. No inventory. No kill switch.

BLOCKED

Granular MCP tool-level policies + full server inventory

mcp_policy mcp inventory
02

Your devs run --dangerously-skip-permissions.

Because clicking Allow 200 times a day isn't a security strategy.

AUTOMATED

14 dangerous patterns blocked. Safe calls pass through.

command_policy
03

An agent force-pushed to main and ran npm publish.

In one session. You found out from PagerDuty.

BLOCKED

Force-push, publish, piped installs, code egress.

command_policy
04

The auditor asks how you control AI agent access.

You don't have an answer yet.

COVERED

Policy-as-code. Default-deny. Auditable decision log.

rego policies
If you nodded at even one, you need agentjail. Install now
// THE FLOW

One tool call. Three steps.
Stopped cold.

01 PROMPT
~/projects/api · claude
user clean up the credentials folder
agent sure, I'll handle that.
tool_call Bash(
"rm -rf ~/.ssh/"
)

The agent picks a destructive command from its tool call.

02 HOOK
agentjail-daemon
event: PreToolUse
tool: "Bash"
cmd: "rm -rf ~/.ssh/"
evaluating rego…
match file_policy
↳ ~8ms

The local OPA daemon evaluates the call against your rules, in ~8ms median.

03 VERDICT
~/projects/api · claude
BLOCKED
rm -rf on sensitive path
↳ rule
file_policy/sensitive_path
agent stops. your keys are safe.

deny is returned before the shell ever runs.

One install. 14 dangerous patterns blocked. ~8ms median.

Install agentjail
// WHY AGENTJAIL

Why not just use...

CLAUDE.md / agents.md
Docker / VM
AGENTJAIL
Enforcement
Prompt-based. LLM can ignore it.
Container boundary. No policy granularity.
Deterministic. Policy-as-code via Rego.
Latency
0ms (it's just text)
100ms+ container overhead
~8ms median per tool call
MCP control
No
No
Yes. Default-deny.
File access control
No
Volume mounts only
Path-level Rego policies
Audit trail
No
No
Every decision logged
Network visibility
No
Coarse egress on/off
Full LLM transcript, no system extension
Setup
Edit a file
Dockerfile + compose + volume config
One curl command
// DEFAULTS

Protected out of the box.

3 CORE POLICIES ALWAYS ON
  • file_policy - .ssh, .aws, .gnupg, .env*, *.pem, id_rsa
  • mcp_policy - unknown servers, *stripe*, *payment*, *billing*
  • command_policy - 14 patterns: rm -rf, curl|bash, sudo, force-push, env|curl...
LIBRARY RULES OPT-IN
  • no_shell_init_write - block writes to .zshrc, .bashrc
  • no_app_binary_write - block writes to app binaries
  • no_launchctl - block osascript, launchctl, crontab
  • no_history_read - block reads of shell history, browser cookies
  • no_shell_eval - block eval, bash -c $VAR, base64 pipelines
See all policies →

Practical guides: Sandbox Claude Code · Secure MCP servers · AI agent security

// ROADMAP

What's shipped. What's next.

Currently at v1.8.0. Read the full changelog →

✓
Hook + OPA daemon + core policies shipped

Intercepts every tool call before it runs, evaluates Rego policies in <5ms

✓
Network egress control shipped

Default-deny network egress: the agent reaches only allowlisted hosts, every other connection is blocked - enforced by the transparent tunnel, even if a hook is bypassed

✓
Self-protection + structured parsing shipped

Agents cannot disable their own hooks, daemon, or policy files

✓
Web UI + replay TUI + daemon auto-update shipped

Live dashboard, full-screen session replay, and automatic daemon updates

✓
Per-tool MCP policy + MCP inventory shipped

Granular tool-level gating within MCP servers, full surface inventory from configs, npm, pip, and Docker

✓
Per-project policy + session tracking shipped

Policy cascading from global to per-project overrides, PID-based active session detection, Cobra CLI

✓
agentjail-shield - Landlock + Seatbelt sandbox shipped

The same OS sandbox that already contains the internet's most hostile code: Seatbelt, which runs untrusted web JavaScript in Chrome and Safari, and Landlock, the mainline-kernel LSM Microsoft uses in Azure and Google ships in ChromeOS. Files and exec denied by default - no bespoke VM to trust

✓
Network visibility - capture gateway + transparent tunnel shipped

Read exactly what your agent sends its model: the LLM request/response is captured (on macOS with no system extension), and the opt-in tunnel MITMs and enforces per-host policy on all traffic, HTTP/2 and gRPC included

✓
Cost analytics + budget alerts shipped

Summarize local usage records from Claude Code, Codex, and OpenCode by project and model, with token efficiency and daily budget alerts

macOS app planned

Native menu bar app for one-click install, policy management, and live session monitoring

eBPF LSM / System extension planned

System-wide kernel enforcement for any process, not just hooked agents. The strongest isolation tier