v1.8.0: Clearer approvals, faster cost reports
AgentJail v1.8.0 makes agents explain host access before approval and keeps local cost reports fast with an incremental usage index.
Read post ↗Introducing credentials in agentjail v1.6.0
agentjail v1.6.0 introduces encrypted credential storage, eager session delivery, and exact-ID credential requests from Codex and Claude.
Read post ↗v1.7.0: Bounded authority, visible to the agent
agentjail v1.7.0 guides agents to governed host access, adds exact session-bound grant foundations, and fixes Codex 0.150.1 approval loops.
Read post ↗v1.5.0: Network visibility, without startup noise
agentjail v1.5.0 tunnels opted-in agent commands by default, trims startup output, keeps private diagnostics, and opens the local UI on macOS.
Read post ↗v1.4.0: Your agent bill, broken down locally
agentjail v1.4.0 adds local cost reports from three agent data sources, plus budget alerts, a Cost dashboard, and safer Linux updates.
Read post ↗v1.3.0: Codex can ask before Bash runs
agentjail v1.3.0 turns every effective Codex Bash ask into a native approval prompt backed by a one-use, session-bound command broker.
Read post ↗v1.2.0: See what AgentJail actually did
agentjail v1.2.0 adds a local activity report and makes PATH-shim consent survive both manual and automatic updates.
Read post ↗v1.1.0: Codex and Cursor get the full shield
agentjail v1.1.0 gives Codex and Cursor the same OS sandbox, policy enforcement, and visible protection state already available for Claude Code.
Read post ↗Announcing agentjail v1.0.0 🎉
Read the transcript your coding agent sends its model. agentjail v1.0.0 captures the full request and response on Linux and macOS - no system extension needed.
Read post ↗v0.9.0: See what your policy would block
Monitor mode shows what a rule would allow, deny, or ask about before you enforce it, plus verified daemon attestation and control-plane token auth.
Read post ↗v0.8.0: Six binaries became two
Six binaries became two: smaller install, updates that can't half-apply, and the same guardrail - with the hook still on its own fast path.
Read post ↗v0.7.0: Tighter shield, self-starting broker
The Linux shield no longer exposes ~/.ssh when you launch from $HOME, the credential broker auto-starts on demand, and every CLI flow is recorded on a clean VM.
Read post ↗v0.6.0: Hand it your codebase, not your secrets
Let your coding agent work on real repos across macOS and Linux - and it still can't read your secrets, leak DB passwords, or reach cloud metadata.
Read post ↗v0.5.0: Daemon Grant Server, Policy Fixes
Grants move from netproxy to daemon with PID-based session binding - no agent can approve its own requests.
Read post ↗v0.4.0: Session Proxy, Overlays, Runtime Grants
agentjail's sandbox is now a live, negotiable perimeter - scoped per session, per project, and per human approval.
Read post ↗v0.3.0: MCP inventory and tool policy
agentjail now inventories every MCP server across your team, enforces policy at the tool level inside MCP servers, and tracks active agent sessions.
Read post ↗