v1.1.0: Codex and Cursor get the full shield
agentjail v1.1.0 gives Codex and Cursor the same OS sandbox, policy enforcement, and visible protection state already available for Claude Code.
Read post ↗Announcing agentjail v1.0.0 🎉
Read the transcript your coding agent sends its model. agentjail v1.0.0 captures the full request and response on Linux and macOS - no system extension needed.
Read post ↗v0.9.0: See what your policy would block
Monitor mode shows what a rule would allow, deny, or ask about before you enforce it, plus verified daemon attestation and control-plane token auth.
Read post ↗v0.8.0: Six binaries became two
Six binaries became two: smaller install, updates that can't half-apply, and the same guardrail - with the hook still on its own fast path.
Read post ↗v0.7.0: A tighter shield, and the broker starts itself
The Linux shield no longer exposes ~/.ssh when you launch from $HOME, the credential broker auto-starts on demand, and every CLI flow is recorded on a clean VM.
Read post ↗v0.6.0: Hand it your codebase, not your secrets
Let your coding agent work on real repos across macOS and Linux - and it still can't read your secrets, leak DB passwords, or reach cloud metadata.
Read post ↗v0.5.0: Daemon Grant Server, Policy Fixes
Grants move from netproxy to daemon with PID-based session binding - no agent can approve its own requests.
Read post ↗v0.4.0: Session Proxy, Overlays, Runtime Grants
agentjail's sandbox is now a live, negotiable perimeter - scoped per session, per project, and per human approval.
Read post ↗Announcing v0.3.0: MCP inventory, per-tool policy
agentjail now inventories every MCP server across your team, enforces policy at the tool level inside MCP servers, and tracks active agent sessions.
Read post ↗What did your agent do last night?
agentjail now has a real-time UI with git-aware sessions, live tickers, and full replay. See every decision your agent made.
Read post ↗The agent that fired its own bodyguard
We asked an agent to clean up the dev environment. It found the security hook and tried to remove it. Here is how v0.2.0 makes that a three-layer problem.
Read post ↗Introducing agentjail
Coding agents act on your behalf, which is what makes them risky. agentjail enforces policy at the tool boundary, offline, before a dangerous call runs.
Read post ↗