← All docs

Run in CI

How agentjail can protect agents running unattended in CI, and what is not yet available.

In local development, you are usually nearby when an agent runs. In CI, you are not. An agent triggered by a pull request, a scheduled job, or an automated release pipeline can run for minutes before anyone notices something went wrong, and by then the damage is done.

agentjail is designed to be the guard that stays in place when you are not watching. agentjail install works on macOS (launchd) and Linux (a systemd user service) - both first-class - and auto-detects Claude Code, Codex, and Cursor. What does not exist yet is a turnkey CI integration (a published GitHub Action, a Docker image, or a --ci flag), so today you wire it yourself in a job step. This page describes what is available today and the direction planned for the future.

Why CI is different

When an agent runs unattended:

  • There are no permission prompts to pause execution. The agent proceeds without checking.
  • Any mistake (a bad path, a leaked secret, a force-push to the wrong remote) executes immediately.
  • The blast radius can be larger than in a local session because CI agents often have broader credentials (deploy keys, cloud tokens, registry access).

What is available today: the strict policy sample

agentjail ships a sample config at samples/configs/policy-strict.yaml that is recommended for CI/CD or any max default-deny environment. If you are already running agentjail locally (macOS or Linux) and want to validate what a strict policy looks like before a CI path exists, that file is the reference starting point.

Enable it with:

agentjail policy list          # see available rulesets
agentjail policy enable <name> # enable the strict ruleset

CI integration: not yet available

A turnkey mechanism for running agentjail inside GitHub Actions, GitLab CI, CircleCI, or other CI environments does not exist yet. Specifically:

  • There is no --ci flag, prebuilt Docker image, or published GitHub Action.
  • You wire it manually: run the install one-liner in a setup step (macOS via launchd, Linux via a systemd user service; both auto-detect Claude Code, Codex, and Cursor), or run agentjail-hook directly against the daemon socket.

When a turnkey CI integration is available it will appear in the changelog and the integration guides will be updated accordingly.

What happens on a denial (once wired)

When agentjail blocks a tool call, agentjail-hook exits 2 and prints a structured reason. The agent receives the block message, stops, and typically logs an explanation. A CI job that fails loudly on a blocked call is better than one that silently succeeds on a destructive one.

See also