cplt CLI
cplt runs AI coding agents in a kernel sandbox: code gets edited, SSH keys and pushes to the default branch stay out of reach.
- 147 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The sandbox narrows exposure, but on Linux some protections are partial, and `--allow-browser` and Keychain access widen the agent's rights.
- Installing through `curl | bash` or adding the apt repository requires trusting the publisher.
Install
- Works in
Manual install
brew install navikt/tap/cpltFirst command of the README Install section, for macOS. Debian and Ubuntu have an apt package; other distributions use the install script.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The sandbox narrows exposure, but on Linux some protections are partial, and `--allow-browser` and Keychain access widen the agent's rights.
- Installing through `curl | bash` or adding the apt repository requires trusting the publisher.
This is third-party code. Review the repository files before installing.
What it does
cplt, a Rust CLI wrapper, runs Claude Code, Copilot CLI, OpenCode, Gemini CLI, `goose` and any shell inside a sandbox. On macOS it uses Apple Seatbelt through `sandbox-exec`; on Linux it combines Landlock, `seccomp-BPF` and optional Bubblewrap. The agent reads and writes the project but cannot see `~/.ssh`, `~/.aws`, `.env*`, `.pem` or `.key` files. Command guards for `git` and `gh` block pushes to the default branch, force pushes, PR merges and releases. Outbound traffic is limited to port 443, and a proxy with domain allow and block lists writes an audit log. Repository policy lives in `.cplt.toml` and is committed with the code.
Who it is for. Developers and teams who run agents on work laptops with access to keys, and the people responsible for the safety of those runs.
Good fit when
- An agent runs on a repository with secrets and key leaks are unacceptable.
- A team needs one agent access policy committed to the repository.
- An agent installs dependencies from the internet, so prompt injection or a malicious MCP server is a real risk.
- Pushes to `main` and PR merges from an agent session must be blocked.
- Any command, such as `npm install`, should run in a sandbox separate from the agent.
Not a fit when
- You need native Windows without WSL2: there is no sandbox backend for it.
- VM or container-grade isolation is required.
- The build must install global tools such as `bun install -g` or `mise use -g` inside the sandbox.
Example request
Run Claude Code through cplt in this repository, show which paths and domains are blocked, and run `cplt doctor`.Limitations
The sandbox is not absolute. On macOS `sandbox-exec` is deprecated and Apple may remove it. Linux needs kernel 5.13+ with Landlock, TCP port filtering starts at 6.7, and `.env` protection inside the project is not kernel-enforced without Bubblewrap. The `--allow-browser` flag lets the agent launch any application outside the sandbox. Keychain access on macOS cannot be narrowed to one item.
How to disable. Remove the alias or wrapper created by `cplt --shell-install` and start the agent directly. Uninstall with the manager you installed with: `brew uninstall cplt` or `sudo apt remove cplt`. Delete `.cplt.toml` from repositories by hand.
FAQ
Which agents does cplt support?
GitHub Copilot CLI, OpenCode, Gemini CLI, Antigravity CLI, Pi, Claude Code, `goose`, DeepSeek Harness and any shell via `--agent shell`. Pick one with the `--agent` flag.
Does cplt work on Windows?
Not natively. Run it inside WSL2, where it is an ordinary Linux install and the Microsoft kernel includes Landlock.
How do I run a plain command in the sandbox without an agent?
Run `cplt exec -- npm install`, or `cplt exec -c "npm install && npm test"` for compound commands. You can alias it with `alias npm="cplt exec -- npm"`.
Can I only warn on pushes instead of blocking?
Yes. `cplt config set git_guard.mode warn` switches the git guard to warnings, and `--no-git-guard` disables it entirely.
How does cplt differ from the Codex CLI sandbox?
cplt adds outbound domain filtering through a proxy, a `.cplt.toml` policy file with a trust flow and support for nine agents. Codex CLI has read-only and workspace-write modes, which cplt does not offer yet.
Discussion
No questions or reviews yet.
Related
CLI toolsClaude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.
A Go CLI that runs a coding agent in an OS sandbox with skills and secrets behind a bridge and isolated files and network.
Fence runs commands and agents like Claude Code in a sandbox: network blocked by default, file access and the command list set through config
A local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
An authorization engine for agents: every action gets allow, deny, human_review or compute, with each decision logged
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| cplt (this card) | no | 147 | |
| nono | no | 4,945 | nono isolates agent processes with its own mechanism; cplt adds `git` and `gh` guards and a domain-list proxy |
| Agent Safehouse | no | 2,149 | Agent Safehouse confines agents on macOS; cplt also covers Linux through Landlock and keeps policy in `.cplt.toml` |
README in short
Install through Homebrew, `mise`, apt or `install.sh`. `cplt doctor` checks the environment, and `cplt --print-profile` prints the full SBPL profile.