SkillFoxx

agentutils CLI

Three UNIX tools: a directory fork without copying, a sandboxed agent run and a patch with the changes it made.

  • 64 ★ on the repository
  • Last commit
  • MIT
CLI

Extended access

Why this level

  • Isolation does not close the network: the launched command can send out anything it may read.
  • Writable paths stay readable, so tokens kept there are reachable.
All reasons and checks

penberg/agentutilsAuthor:penberg

Install

Manual install

make install

Builds the commands and installs them to `~/.local/bin`, man pages to `~/.local/share/man`. Set `PREFIX` for another location. Rust is required.

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • Isolation does not close the network: the launched command can send out anything it may read.
  • Writable paths stay readable, so tokens kept there are reachable.

This is third-party code. Review the repository files before installing.

What it does

agentutils is three separate commands. `fsfork` clones a directory with copy-on-write: the fork sits next to it, takes no space until the first edit and includes uncommitted changes. `confine` runs a command in such a fork and lets it write only there, while reading secrets in the home folder is closed. `fsdiff` shows what the agent changed in the fork as a patch for `git apply`. The tools keep no state: a fork is an ordinary folder, its path is its name, and `ls`, `rm` and `git` do the rest. On macOS isolation comes from Seatbelt, on Linux from Landlock. The network is not restricted.

Who it is for. Developers who run Claude Code or another agent without confirmations and want to isolate the working copy without setting up a container.

Good fit when

  • The agent must rewrite half the project and you want to review the result as a patch before applying it.
  • The home folder holds `~/.ssh` and `~/.aws`, and the launched command must not read them.
  • Several attempts at one task run in parallel and each needs its own copy of the directory.
  • The repository is large and a full copy would cost time and disk space.
  • After a session the forks should go away with one `fsfork --prune` command.

Not a fit when

  • You need network isolation: `confine` does not close outgoing connections or pushes to remote repositories.
  • The file system cannot share blocks, so a fork becomes a full copy.
  • The machine runs a Linux kernel older than 5.19: without Landlock `confine` refuses to start.

Example request

Run Claude Code in a fork of this project, then show me the patch with its changes.

Limitations

Runs on macOS and Linux. macOS needs APFS and forks must live on the same volume. On Linux `confine` needs kernel 5.19 or newer with Landlock, and a fast `fsfork` needs a file system with shared blocks such as Btrfs or XFS. `fsdiff` requires `git`. The network stays open: a confined process can send anywhere whatever it may read. Writable paths are readable too, so a token in `~/.cargo/credentials.toml` stays reachable. Builds in a fork start cold unless `--no-ignore` is given.

How to disable. Run `make uninstall` with the same `PREFIX` used at install. Delete the forks by hand together with their `.name.N.base` bases.

FAQ

How do I run Claude Code in a sandbox with confine?

Go to the project directory and run `confine -w ~/.claude claude`. The tool creates a `project.1` fork, says so and launches the agent there. The `-w ~/.claude` flag leaves Claude Code room for sessions and settings.

How do I take the agent's changes?

Run `fsdiff ../project.1 | git apply`. The command compares the fork with the base made at fork time, so the patch holds only the agent's changes and not your edits in the main directory.

What does the --rm flag do?

With `--rm`, `confine` waits for the agent to finish and removes the fork itself. Without it the fork stays, `fsfork -l` shows its state and `fsfork --prune` removes unchanged ones.

Does confine protect against network leaks?

No. The network is not restricted, so the command can send out what it read or push wherever it has access. The tool only closes writes outside the fork and reads of home-folder secrets.

Which systems are supported?

macOS with APFS and Linux. On Linux `confine` needs kernel 5.19 or newer with Landlock. Without Landlock the tool exits with an error and does not run the command unconfined.

Discussion

No questions or reviews yet.

CLI tools

A Docker sandbox for coding agents: a Debian image with Copilot CLI, Codex and Pi, and SSH, RDP and Docker enabled by flags.

CLIExtended access154

A CLI that installs shared skills, commands, subagents, hooks and MCP servers into eight AI coding tools in their native layouts

CLIExtended access91

A command-line SSH tool for agents: remote execution, file upload and download, and command allow and block lists.

CLIBroad access88

CLI that runs commands and AI agents in isolated microVMs that boot in under 125 ms and keeps API keys out of the sandbox itself.

CLIBroad access62

A native macOS terminal built on Ghostty with vertical tabs and notifications when an agent needs your input

CLIBroad access28.8K
Official

A platform on your own server that gives each agent its own Linux box with SSH and MCP tools for commands and files

MCP serverBroad access318

README in short

Each tool solves one task and knows the others only minimally. The commands come with `man` pages that `make install` installs.

README badge

Report a problem