# eugene1g/agent-safehouse

Sandbox your local AI agents so they can read/write only what they need

Repository: https://github.com/eugene1g/agent-safehouse
Canonical: https://ross.abutalabs.com/products/agent-safehouse
Homepage: https://agent-safehouse.dev
Language: Shell
License: Apache-2.0
License Family: permissive
Topics: ai-agents, claude-code, llm, macos, sandbox, security
Last push: 2026-08-26T19:50:51+00:00

## Health v2 (maintenance only)
Score: 80/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 93, longevity 14
- inputs: {"age_days": 205, "days_push": 7, "days_rel": 47, "gap_med": 0, "n_releases_24m": 16}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2037, forks 88 (observed 2026-08-28T04:06:08.127090+00:00)

## What it is
Agent Safehouse is a macOS-native sandboxing tool that runs local LLM coding agents (Claude Code, Codex, Gemini CLI, Aider, etc.) inside a deny-first sandbox built on sandbox-exec/Seatbelt. It ships as a single Bash script or Homebrew formula with composable policy profiles that grant agents only the file and integration access they need.

## Use cases
- run claude code with --dangerously-skip-permissions without risking my home directory
- sandbox an AI coding agent so it can't read ~/.ssh or ~/.aws
- restrict an LLM agent to read/write only the current project directory
- prevent an AI agent from running rm -rf on my files
- create a custom least-privilege sandbox profile for my own agent
- safely try out new coding agents on my macbook
- kernel-enforced file access limits for autonomous agents

## When to choose
- you run AI coding agents on macOS and want kernel-enforced protection of files outside your project
- you want to use agents in permissive/yolo modes with reduced blast radius
- you need composable, auditable sandbox profiles without extra dependencies beyond Bash and macOS

## When to avoid
- you need sandboxing on Linux or Windows (macOS-only via sandbox-exec)
- you require a hard security boundary against a determined malicious attacker - it is a hardening layer, not a perfect isolation
- your workflow depends on agents accessing many paths outside the workdir and you don't want to manage policy rules

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, cli, developer-tools
- domain: security, developer-tools
- platform: cli
- tags: sandboxing, seatbelt, sandbox-exec, llm-agents, least-privilege, claude-code, coding-agents, shell-script, deny-first, sandbox, ai-agents, command-line, macos

## Member repositories
- eugene1g/agent-safehouse (main) score 80

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:08.127090+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:59:16.258748+00:00, confidence not recorded.
  - readme: https://github.com/eugene1g/agent-safehouse (fetched 2026-08-28T04:06:08.127090+00:00, sha 6fa5eb444870)
  - homepage: https://agent-safehouse.dev (fetched 2026-08-29T10:38:50.490310+00:00, sha ccc347d2f649)
  - site_page: https://agent-safehouse.dev/docs (fetched 2026-08-29T10:38:50.499448+00:00, sha 93433a50b1ef)
  - site_page: https://agent-safehouse.dev/docs/agent-investigations/claude-code (fetched 2026-08-29T10:38:50.501266+00:00, sha e3a45a7b9d60)
  - site_page: https://agent-safehouse.dev/docs/agent-investigations/codex (fetched 2026-08-29T10:38:50.504503+00:00, sha f98e7cfaeee5)
  - site_page: https://agent-safehouse.dev/docs/agent-investigations/opencode (fetched 2026-08-29T10:38:50.507144+00:00, sha b88c025f9682)
  - site_page: https://agent-safehouse.dev/docs/agent-investigations/copilot-cli (fetched 2026-08-29T10:38:50.509745+00:00, sha 22f05430eff8)
  - site_page: https://agent-safehouse.dev/docs/agent-investigations/gemini-cli (fetched 2026-08-29T10:38:50.511716+00:00, sha f627434a750f)
  - site_page: https://agent-safehouse.dev/docs/agent-investigations/aider (fetched 2026-08-29T10:38:50.514452+00:00, sha 6a015e880781)
  - site_page: https://agent-safehouse.dev/docs/agent-investigations/goose (fetched 2026-08-29T10:38:50.516966+00:00, sha 40d4404703a4)
- Data as of 2026-08-30T08:39:29.467469+00:00.