agentjail

Policy checks and OS sandboxing for coding agents

A safety rail for Claude Code, Codex, and Cursor.
Install policy hooks, then launch your agent through AgentJail for OS-level filesystem protection.

 
 
 
 
 

Install minisign through your trusted package manager first (brew install minisign on macOS; sudo apt-get install minisign on Debian/Ubuntu). The installer verifies the signed release manifest before extracting or running the download.

or

Follow the installer's shell activation instruction, restart any running agent, then start your first protected session:

Installation registers hooks; agentjail run adds the OS sandbox. Hooks alone are cooperative checks, not a filesystem isolation boundary. For automatic sandboxing of ordinary agent commands, opt into the PATH shim. Use --tunnel when you also want network visibility; the launch banner reports the active protection level.

A coding agent gets blocked before it fires. ▶ Watch the 36-second demo with sound · source in video/.

Recent updates

See CHANGELOG.md for full details, or check the releases page.

How it works

Supported agent tool calls are checked against policy before execution while the daemon is available:

Hooks provide policy decisions and explanations. Launching through agentjail run adds the OS sandbox, which enforces filesystem restrictions independently of the hook daemon.

- 🪝 Zero-config - one install command auto-detects your agents and wires the hook
- ⚡ ~8 ms median - persistent OPA daemon + decision cache. You won't feel it
- 🛡️ Defense in depth - hook-level policy + optional kernel sandbox (agentjail-shield)
- 📜 Real policy engine - OPA Rego rules, not regex hacks
- 🔒 Explicit failure posture — credential and approval authorization fail closed.…