This page gets you from zero to a live, blocked tool call in about two minutes. For a more detailed setup walkthrough, see Installation.
Prerequisites: macOS or Linux (arm64 or amd64). Claude Code, Codex, and Cursor are all supported: the installer auto-detects whichever are present.
1. Install agentjail
curl -fsSL https://agentjail.io/install.sh | sh
This downloads the release tarball, verifies its SHA256 checksum, and installs
the agentjail binaries to ~/.agentjail/bin/.
2. Confirm the install
agentjail version
Then check that the default policies are loaded:
agentjail policy list
You should see the core policies (such as file_policy) listed in the output.
3. Wire it into your coding agents
agentjail install
This presents an interactive multi-select picker of all detected agents (Claude
Code, Codex, Cursor). Press Enter to wire them all, or Space to deselect agents
you want to skip. The installer starts the background daemon (agentjail-daemon),
registers agentjail-hook as a PreToolUse hook for each selected agent, and
seeds the MCP allowlist from your existing MCP server configurations.
To wire a single agent non-interactively:
agentjail install --for claude-code
From this point on, every tool call the agent is about to make is evaluated against your policy before it runs. Denied calls never reach the shell.
3b. Check your policy
agentjail policy list
This shows every rule: core (always-on), optional (opt-in library rules), and any custom rules you have installed, along with their on/off/locked status.
4. See a denial in action
With the daemon running, pipe a PreToolUse payload directly to agentjail-hook
to confirm the policy is working:
echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf ~/.ssh/"}}' \
| agentjail-hook
You should get a nonzero exit code and a message like:
DENY: Blocked: command targets sensitive path ~/.ssh/
The call is blocked. Because agentjail-hook is wired into Claude Code’s
PreToolUse hook, the same evaluation happens automatically for every tool call
Claude Code tries to make.
5. Run your agent shielded (and see its network)
Wiring the hook protects every tool call. To also get the OS-native sandbox and network visibility, launch your agent through agentjail:
agentjail claude # Claude Code
agentjail run -- codex # Codex
agentjail run -- cursor # Cursor
This runs the agent inside the kernel sandbox (Seatbelt on macOS, Landlock on
Linux) so shell tricks and subprocesses can’t slip past the hook, and it captures
the agent’s LLM traffic - on macOS with no system extension - so you can read
exactly what it sends the model. Add --tunnel to MITM and enforce per-host
network policy across all of the agent’s traffic.
Pass
--no-sandboxto opt out of the OS-native sandbox and run hook-only (thePreToolUsehook still evaluates every call; only the kernel-level isolation is skipped).
Watch decisions and captured network calls live in the local dashboard:
agentjail ui # loopback-only web UI: Monitor + Network tabs
agentjail logs # or tail decisions in the terminal
Next steps
- How it works: understand the tool-call boundary and how evaluation runs offline.
- Installation: the full setup guide, including binary paths and policy bundle details.
- Default policies: what ships in the bundle and how to tune it.
- Writing your first rule: add your own Rego rule.