Brig CLI
Brig runs Claude Code and other coding agents inside an isolated microVM on your machine with access to one project only.
- 266 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The agent can freely change and delete project files, including `.git`.
- By default the sandbox reaches the internet and can send out what it reads.
Install
- Works in
Manual install
brew tap brig-sh/brigFor macOS, then `brew trust brig-sh/brig` and `brew install --cask brig`. On Linux `curl -fsSL https://raw.githubusercontent.com/brig-sh/brig/main/install.sh | sudo sh` installs Brig for the whole machine.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent can freely change and delete project files, including `.git`.
- By default the sandbox reaches the internet and can send out what it reads.
This is third-party code. Review the repository files before installing.
What it does
Brig starts a sandbox as a microVM where the agent has its own kernel and home directory, while host access is limited to one project. `brig run claude ~/code/demo` brings up the sandbox and launches Claude Code in it, while `brig run ubuntu ~/code/demo` opens a root shell with no account login. The rest of the disk, the keychain and the SSH agent of the host stay invisible to the agent. The project and the guest home remain real host directories, so changes persist. Brig forwards into the sandbox only what the agent profile names, verifies the signatures of its own images and accepts an egress policy to limit the network. `brig doctor` checks the host, while `brig stop` and `brig rm` stop and remove the sandbox.
Who it is for. Developers who want to run an agent without approving every command while keeping it away from keys, SSH and other files.
Good fit when
- An agent must edit a project in `~/code/demo` without confirmations while the rest of the disk stays closed.
- Before running a third-party repository a sandbox without keychain and SSH-agent access is needed.
- The agent outbound traffic is restricted by a policy so it cannot send out what it reads.
- Several sessions run in parallel, each keeping its own guest home directory.
Not a fit when
- An Intel Mac is needed: it is not supported.
- A Linux machine without KVM: virtualization is unavailable.
- Protection against deletion inside the project itself is needed: the agent can change or delete any project file, including `.git`.
Example request
Run Claude Code in a Brig sandbox on ~/code/demo, create a file there and show what is forwarded to the sandbox with brig info claude.Limitations
It runs on Apple Silicon Macs with macOS 15 or newer (macOS 14 needs the variables `BRIG_HYPERVISOR=vz BRIG_NETWORK=shared`) and on Linux with KVM; on Linux installation and all commands run as root. The sandbox reaches the internet by default, so the agent can send out anything it reads until a policy is bound. Host git hooks run what the agent wrote into `.git`, so review them. The version is below 1.0 and minor releases may break compatibility. On first run in a terminal Brig asks about telemetry.
How to disable. Stop the sandbox with `brig stop claude` and delete it along with the guest home through `brig rm claude`. The project folder stays and is deleted by hand. `brig telemetry off` disables telemetry.
FAQ
How do I install Brig on macOS?
Run `brew tap brig-sh/brig`, then `brew trust brig-sh/brig` and `brew install --cask brig`. Check the host with `brig doctor`.
How do I install Brig on Linux?
The script `curl -fsSL https://raw.githubusercontent.com/brig-sh/brig/main/install.sh | sudo sh` installs Brig and its runtime for the whole machine, and all commands then run as root, for example `sudo brig doctor`. The docs also cover a single-user install without root.
Is an Anthropic account needed?
For Claude Code yes: login happens inside the sandbox. Without an account `brig run ubuntu ~/code/demo` opens a root shell with no login.
What can the agent change on the host?
Only the project and its guest home. The rest of the disk, the keychain and the SSH agent are unreachable. Credentials are forwarded according to the profile, which `brig info claude` lists.
How do I restrict the network?
Bind an egress policy. Brig enforces it on Linux and on macOS with the `hvi` backend and refuses a policy-bound run on other paths.
Discussion
No questions or reviews yet.
Related
CLI toolsA CLI that runs Claude Code and Codex in isolated Docker containers with a firewall, worktrees and a no-Dockerfile image.
CLI that runs commands and AI agents in isolated microVMs that boot in under 125 ms and keeps API keys out of the sandbox itself.
A container for Claude Code, Codex, Copilot, OpenCode and Pi: the agent runs without prompts while a gateway limits network.
AgentBox runs Claude Code, Codex and Open Code in separate virtual machines on your PC, a self-hosted server or a cloud.
ArcBox runs Claude Code in a disposable microVM on a Mac: its own kernel, an empty workspace and a start in about a second
devvm gives each project its own virtual machine with the right toolchains, where Claude Code and Codex cannot see your secrets
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Brig (this card) | no | 266 | ||
| Agent-Sandbox | no | key is optional | 232 | A sandbox for agents; Brig isolates the agent in a microVM with its own kernel and an egress policy |
| SandVault | no | 454 | Isolates an agent through a separate macOS user; Brig runs it in a microVM on Mac and Linux |
README in short
The README explains the sandbox principle, supported hosts and a first run with step-by-step commands. The access section describes what the agent sees in files, credentials, network and images. Apache-2.0 license, with further links on security and policies.