← All docs

Quickstart

Go from zero to a blocked tool call in about two minutes.

This page gets you from zero to a live, blocked tool call in about two minutes. For a more detailed setup walkthrough, see Installation.

Prerequisites: macOS or Linux (arm64 or amd64). Claude Code, Codex, and Cursor are all supported: the installer auto-detects whichever are present.

1. Install agentjail

curl -fsSL https://agentjail.io/install.sh | sh

This downloads the release tarball, verifies its SHA256 checksum, and installs the agentjail binaries to ~/.agentjail/bin/.

2. Confirm the install

agentjail version

Then check that the default policies are loaded:

agentjail policy list

You should see the core policies (such as file_policy) listed in the output.

3. Wire it into your coding agents

agentjail install

This presents an interactive multi-select picker of all detected agents (Claude Code, Codex, Cursor). Press Enter to wire them all, or Space to deselect agents you want to skip. The installer starts the background daemon (agentjail-daemon), registers agentjail-hook as a PreToolUse hook for each selected agent, and seeds the MCP allowlist from your existing MCP server configurations.

To wire a single agent non-interactively:

agentjail install --for claude-code

From this point on, every tool call the agent is about to make is evaluated against your policy before it runs. Denied calls never reach the shell.

3b. Check your policy

agentjail policy list

This shows every rule: core (always-on), optional (opt-in library rules), and any custom rules you have installed, along with their on/off/locked status.

4. See a denial in action

With the daemon running, pipe a PreToolUse payload directly to agentjail-hook to confirm the policy is working:

echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf ~/.ssh/"}}' \
  | agentjail-hook

You should get a nonzero exit code and a message like:

DENY: Blocked: command targets sensitive path ~/.ssh/

The call is blocked. Because agentjail-hook is wired into Claude Code’s PreToolUse hook, the same evaluation happens automatically for every tool call Claude Code tries to make.

5. Run your agent shielded (and see its network)

Wiring the hook protects every tool call. To also get the OS-native sandbox and network visibility, launch your agent through agentjail:

agentjail claude                # Claude Code
agentjail run -- codex          # Codex
agentjail run -- cursor         # Cursor

This runs the agent inside the kernel sandbox (Seatbelt on macOS, Landlock on Linux) so shell tricks and subprocesses can’t slip past the hook, and it captures the agent’s LLM traffic - on macOS with no system extension - so you can read exactly what it sends the model. Add --tunnel to MITM and enforce per-host network policy across all of the agent’s traffic.

Pass --no-sandbox to opt out of the OS-native sandbox and run hook-only (the PreToolUse hook still evaluates every call; only the kernel-level isolation is skipped).

Watch decisions and captured network calls live in the local dashboard:

agentjail ui              # loopback-only web UI: Monitor + Network tabs
agentjail logs            # or tail decisions in the terminal

Next steps