v1.1.0: Codex and Cursor get the full shield
agentjail v1.1.0 gives Codex and Cursor the same OS sandbox, policy enforcement, and visible protection state already available for Claude Code.
Read post ↗Announcing agentjail v1.0.0 🎉
Read the transcript your coding agent sends its model. agentjail v1.0.0 captures the full request and response on Linux and macOS - no system extension needed.
Read post ↗v0.9.0: See what your policy would block
Monitor mode shows what a rule would allow, deny, or ask about before you enforce it, plus verified daemon attestation and control-plane token auth.
Read post ↗v0.8.0: Six binaries became two
Six binaries became two: smaller install, updates that can't half-apply, and the same guardrail - with the hook still on its own fast path.
Read post ↗v0.7.0: A tighter shield, and the broker starts itself
The Linux shield no longer exposes ~/.ssh when you launch from $HOME, the credential broker auto-starts on demand, and every CLI flow is recorded on a clean VM.
Read post ↗v0.6.0: Hand it your codebase, not your secrets
Let your coding agent work on real repos across macOS and Linux - and it still can't read your secrets, leak DB passwords, or reach cloud metadata.
Read post ↗v0.5.0: Daemon Grant Server, Policy Fixes
Grants move from netproxy to daemon with PID-based session binding - no agent can approve its own requests.
Read post ↗v0.4.0: Session Proxy, Overlays, Runtime Grants
agentjail's sandbox is now a live, negotiable perimeter - scoped per session, per project, and per human approval.
Read post ↗Announcing v0.3.0: MCP inventory, per-tool policy
agentjail now inventories every MCP server across your team, enforces policy at the tool level inside MCP servers, and tracks active agent sessions.
Read post ↗