Skip to main content
Agent Safehouse provides macOS sandbox wrappers for 15 coding agents, constraining their filesystem and network access using Apple’s sandbox-exec (Seatbelt) framework.

​
Supported Agents

Aider

Python CLI assistant with terminal UI

Amp

Clipboard-aware coding agent

Auggie

Augment Code CLI agent

Claude Code

Anthropic’s CLI/TUI agent

Cline

VS Code extension agent

Codex

OpenAI Codex CLI (Rust)

Copilot CLI

GitHub Copilot command line

Cursor Agent

Cursor IDE agent mode

Droid

Factory CLI coding agent

Gemini CLI

Google’s Gemini CLI agent

Goose

Block’s open-source agent

Kilo Code

VS Code extension (Cline fork)

OpenCode

Open-source CLI/TUI agent

Pi

Minimal CLI coding agent

​
How Agent Profiles Work

Each agent has a dedicated sandbox profile in profiles/60-agents/<agent>.sb that grants:
  • Binary paths — Where the agent CLI is installed (~/.local/bin/, brew, npm global, etc.)
  • Config directories — Agent settings, sessions, logs (~/.agent-name/)
  • State/cache — Session data, model caches, MCP configurations
  • Integrations — Keychain access (when needed), MCP paths, hooks directories
Profiles are layered on top of base system access. See Policy Architecture for the complete policy stack.

​
Shell Wrapper Functions

Safehouse provides shell functions for each agent. Add to your ~/.zshrc or ~/.bashrc: 
# Source the generated shell wrappers
source ~/path/to/safehouse/dist/safehouse.sh

# Now use agents with automatic sandboxing:
aider --help
claude "write a function"
goose
Each function wraps the agent binary with safehouse -- to apply the sandbox policy.

​
Sandbox Policy Examples

​
Read-Only Workspace (Default)

# Agent can read workspace but not modify files
safehouse -- aider --no-auto-commits

​
Workspace Write Access

# Allow file modifications in current directory
safehouse --add-dirs=$PWD -- claude "refactor this"

​
Network Isolation

By default, agents have no network access in the sandbox. Enable selectively: 
# Enable network for LLM API calls
safehouse --enable=network -- goose

​
Custom Integrations

Some agents require additional integrations: 
# Claude Code with keychain + browser
safehouse --enable=keychain,browser-native-messaging -- claude

# Aider with clipboard (Amp-style)
safehouse --enable=clipboard -- amp

​
Agent Investigation Reports

Each agent has a detailed investigation report analyzing:
  • UI architecture (TUI framework, Electron, web UI)
  • Authentication mechanisms (API keys, OAuth, keychain)
  • Filesystem access patterns (config, state, temp files)
  • Network endpoints (LLM APIs, telemetry, update checks)
  • Subprocess execution (shell commands, git, npm, docker)
  • Known vulnerabilities and CVEs
See the individual agent pages for complete analysis.

​
Adding New Agents

To add support for a new agent:
  1. Create profile — profiles/60-agents/new-agent.sb with binary and config paths
  2. Test access — Use --explain to verify granted paths match agent needs
  3. Add dependencies — Use $$require=path/to/integration.sb$$ for keychain, clipboard, etc.
  4. Regenerate dist — Run ./scripts/generate-dist.sh to update packaged artifacts
  5. Test sandbox — Verify agent works with minimal policy
See Contributing for detailed instructions.

​
Comparison Matrix

AgentLanguageKeychainNetwork DefaultSubprocessUI
AiderPythonNoDeniedShellTerminal
AmpBunNoDeniedShellTUI
AuggieNode.jsNoDeniedShellTUI
Claude CodeRustYesDeniedSandboxedTUI
ClineTypeScriptYesDeniedVS Code TerminalWebview
CodexRustYesDeniedSandboxedTUI
Copilot CLINode.jsYesDeniedShellTerminal
Cursor AgentElectronYesDeniedShellElectron
DroidBunNoDeniedShellTUI
Gemini CLINode.jsYesDeniedShellTUI
GooseRustYesDeniedShellTUI
Kilo CodeTypeScriptYesDeniedVS Code TerminalWebview
OpenCodeNode.jsNoDeniedShellTUI
PiNode.jsNoDeniedShellCustom TUI

​
Special Integration Notes

​
VS Code Extensions (Cline, Kilo Code)

VS Code extensions run in the Extension Host process, inheriting VS Code’s sandbox. Safehouse cannot directly sandbox VS Code extensions. Instead:
  • Use --add-dirs to restrict workspace access via VS Code’s file watchers
  • Extensions inherit VS Code’s network policy
  • Terminal commands spawn through VS Code’s Terminal API
For stronger isolation, run VS Code itself in a container.

​
Electron Apps (Cursor)

Electron apps have their own Chromium sandbox. Safehouse profiles grant access to:
  • App bundle (/Applications/Cursor.app)
  • Application Support directories
  • Temp directories for IPC
Cursor’s agent mode runs within the Electron renderer with standard Chromium isolation.

​
Rust Agents (Codex, Goose)

Rust agents (Codex, Goose) have built-in sandboxing:
  • Codex uses sandbox-exec (macOS Seatbelt) for its own tool calls
  • Goose has no built-in sandbox but is compiled native code
Safehouse profiles grant access to their binaries and config paths. The agent’s own sandboxing is orthogonal.

Build docs developers (and LLMs) love

Get started for freeTalk to us