Agent Safehouse CLI
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
- 2,118 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The tool launches the agent as a child process and decides which folders and integrations it can reach
- The --enable=launch-services and --enable=shell-init flags widen access: the first lets the agent start apps outside the sandbox, the second exposes shell startup files that may export keys
Install
- Works in
Manual install
brew install eugene1g/safehouse/agent-safehousemacOS only. Launch with safehouse claude --dangerously-skip-permissions.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The tool launches the agent as a child process and decides which folders and integrations it can reach
- The --enable=launch-services and --enable=shell-init flags widen access: the first lets the agent start apps outside the sandbox, the second exposes shell startup files that may export keys
This is third-party code. Review the repository files before installing.
What it does
Agent Safehouse is a bash wrapper over the macOS sandbox-exec. You put safehouse before the agent command, for example safehouse claude --dangerously-skip-permissions, and the process starts under a deny-everything-except policy. The working directory you launched from gets read and write access. The home directory as a whole stays closed: ls $HOME and reading ~/secret.txt remain denied until you grant access. The policy is assembled from .sb profile modules. The repository has profiles for languages and runtimes (Node, Python, Go, Rust, Java and others), for Git, GPG and 1Password, for Docker and kubectl, and for agents: Claude Code, Codex, Gemini, Cursor Agent, Copilot CLI, Aider, Amp, Goose, OpenCode, Cline and others. There are also profiles for the Claude, Codex, Cursor and VS Code apps. Extra access comes through flags: --add-dirs for read and write, --add-dirs-ro for read-only, --enable=docker, --enable=kubectl and more. A .safehouse file in the project is loaded only after an explicit --trust-workdir-config. Your own rules go in with --append-profile; they load last and can narrow access.
Who it is for. For macOS developers who run agents with confirmations turned off and want to limit their reach into files and keys.
Good fit when
- You run claude with --dangerously-skip-permissions and want the agent unable to read ~/.ssh or other files outside the project
- The agent needs a shared library next to the project: add it read-only with --add-dirs-ro=/repos/shared-lib
- Your Git worktree sits beside others: Safehouse detects it, opens the shared .git directory and lets the agent read the repo's other trees
- You want to allow docker or kubectl for one task only: switch on --enable=docker or --enable=kubectl for that launch
- Project config must not carry personal paths: put them in a local file and attach it with --append-profile
Not a fit when
- You work on Linux or Windows: Safehouse relies on sandbox-exec and targets macOS only. For Linux the author suggests vetto, bubblewrap, firejail, nono.sh, sandlock and isolated-agent
- You need a strict boundary against a determined attacker: the author calls the project a hardening layer, not a perfect security boundary
- You want the agent in an isolated container with its own Git branch: that needs a different tool
- You need a GUI agent with broad system access: you would grant so many exceptions that the protection loses its point
Example request
safehouse --add-dirs-ro=/repos/shared-lib -- claude --dangerously-skip-permissionsLimitations
- Works on macOS only, through sandbox-exec.
- The author calls the project a hardening layer rather than a perfect boundary against a determined attacker.
- Codex with a shared background server needs --no-daemon: otherwise launching the setuid /bin/ps inside the Seatbelt sandbox fails.
- The set of worktrees is fixed when the process starts, and later trees do not open by themselves.
- The --enable=launch-services flag lets the sandboxed process start ANY app outside the sandbox, so switch it on deliberately.
How to disable. Launch the agent without the safehouse prefix. If you installed through Homebrew, remove the package with brew uninstall agent-safehouse. A script downloaded by hand is deleted from ~/.local/bin.
FAQ
How do I run Claude Code in a sandbox on macOS?
Install Agent Safehouse with brew install eugene1g/safehouse/agent-safehouse and add the prefix: safehouse claude --dangerously-skip-permissions. The agent gets read and write access in the current folder and cannot read the rest of your home directory.
How do I give the agent access to an extra folder?
The --add-dirs=/path flag opens a folder for read and write, and --add-dirs-ro=/path for read only. Several paths are separated by a colon. The same values can be set with the SAFEHOUSE_ADD_DIRS and SAFEHOUSE_ADD_DIRS_RO variables.
Does Agent Safehouse work on Linux?
No, the project targets macOS and relies on sandbox-exec. The README lists Linux alternatives: vetto, bubblewrap, firejail, nono.sh, sandlock and isolated-agent.
How do I run Codex through Safehouse?
For Codex versions with a shared background server add --no-daemon: safehouse -- codex --no-daemon --dangerously-bypass-approvals-and-sandbox. That keeps the interface and the server in one sandbox.
How do I give the agent Docker or kubectl access?
Add a flag at launch: safehouse --enable=docker -- docker ps grants Docker socket access, safehouse --enable=kubectl -- kubectl get pods -A opens the kubectl config and cache. Turn such integrations on only for the task that needs them.
Discussion
No questions or reviews yet.
Related
CLI toolsAgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
A security scanner for AI-written code: secrets, dependencies, MCP and CI, findings investigated with evidence, and fixes you approve
Fence runs commands and agents like Claude Code in a sandbox: network blocked by default, file access and the command list set through config
cli sandbox for ai agents without containers or daemons: runs Claude Code, Codex, or OpenCode with restricted access to files, network, and credentials
A sandbox for commands and agent-written code: writes, network and environment variables are closed by default, keys are injected only for allowed domains
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Agent Safehouse (this entry) | no | 2,118 | ||
| nono | no | 4,634 | a cross-platform sandbox limiting files, network and credentials, while Safehouse runs on macOS only | |
| container-use | yes | not required | 4,078 | gives each agent its own container and Git branch, while Safehouse restricts a process on your own machine |
| HOL Guard | yes | 971 | intercepts agent actions and waits for your decision, while Safehouse closes access at the OS level |
README in short
The README offers installation through Homebrew or a standalone safehouse.sh script. It explains least privilege: start from full denial and grant only what is needed. One section describes the default access to the home directory and how profiles resolve macOS paths. It then shows how to move machine-specific settings into a shell function and a local profile, how Git worktrees are handled and which tools to use on Linux.