Fence CLI
Fence runs commands and agents like Claude Code in a sandbox: network blocked by default, file access and the command list set through config
- 996 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Runs any command it's given inside a sandbox on your machine, including dependency installs and build scripts
- The Linux network bridge through socat passes traffic to the domains you yourself allowed in the configuration
- The fence import command carries over and saves Claude Code's current permissions into its own config file
Install
- Works in
Manual install
brew tap fencesandbox/tap && brew install fencesandbox/tap/fenceThe macOS route. On Linux, bubblewrap and socat are additionally required, bpftrace is optional.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Runs any command it's given inside a sandbox on your machine, including dependency installs and build scripts
- The Linux network bridge through socat passes traffic to the domains you yourself allowed in the configuration
- The fence import command carries over and saves Claude Code's current permissions into its own config file
This is third-party code. Review the repository files before installing.
What it does
Fence is a command-line wrapper that puts any command into a sandbox before running it: on macOS through the built-in `sandbox-exec`, on Linux through `bubblewrap`. By default all outbound network access is blocked; the allowed domain list, readable and writable file paths, and denied commands like `git push` or `npm publish` are set in a `fence.jsonc` file, which Fence looks for first in the current folder and its parents, falling back to `~/.config/fence/fence.jsonc`. The `fence config show` command prints the whole configuration inheritance chain and the final merged result as JSON, and `fence config init` creates a starter file with sensible defaults. Ready-made configuration templates for a specific scenario are selected with the `-t` flag, for example `fence -t code -- claude` runs Claude Code under the code template's settings. There's separate SSH command filtering, letting you restrict which hosts and commands an agent can reach over SSH. Monitor mode (`-m`) shows blocked network or file attempts in real time, and on Linux with `bpftrace` installed it adds visibility into filesystem-level violations. The `fence import --claude --save` command carries Claude Code's current permissions over into Fence's own configuration, and any Fence command can be built and used as a Go library rather than only as a standalone binary.
Who it is for. For developers who run coding agents and semi-trusted scripts (builds, package installs, unfamiliar repositories) and want an extra layer limiting their network, filesystem and dangerous commands on top of the agent's own permissions.
Good fit when
- You want to run Claude Code, Codex or another agent with extra network and filesystem limits on top of its own permissions
- You want to safely run a package install or build script from an unfamiliar repository with no network access by default
- You want to block specific dangerous commands like git push or npm publish regardless of what the agent itself allowed
- You want to see in real time exactly what the agent tried to do outside what's allowed (network, files, commands)
Not a fit when
- You need VM-level isolation with a separate kernel: Fence uses sandbox-exec on macOS and bubblewrap on Linux, a process sandbox, not a separate system
- bubblewrap and socat are not installed on Linux: without them network isolation and the allowed-domain bridge won't work
- You need protection against an agent with administrator rights or a kernel-level vulnerability: the sandbox limits a regular process, not privileged access
Example request
Run the project's dependency install through fence with the code template so network and files outside the project are blockedLimitations
License is Apache-2.0.
- On Linux, besides Fence itself you need `bubblewrap` for the sandbox and `socat` for the network bridge; `bpftrace` is optional and only needed for filesystem-violation visibility in monitor mode.
- The sandbox limits a regular process through sandbox-exec on macOS and bubblewrap on Linux; it is not a substitute for a virtual machine with a separate kernel.
- The project moved from `github.com/Use-Tusk/fence`: an earlier Homebrew install from the old tap needs `brew untap` and `brew tap fencesandbox/tap` to switch over, or updates won't arrive.
- SSH filtering restricts which hosts and commands can be reached, but does not inspect the content of an already-established connection after an allowed request.
- Configuration is resolved through a chain: an explicit --settings path, then fence.jsonc in the current and parent folders, then ~/.config/fence/fence.jsonc, and an error in any file in that chain shows up in fence config show's output.
How to disable. Remove the binary (`brew uninstall fencesandbox/tap/fence` or delete the file after a go install) and the `fence.jsonc` or `~/.config/fence/fence.jsonc` configuration file, if it isn't needed for anything else.
FAQ
Does Fence block network access by default?
Yes, with no allowed domains configured, all outbound network access from the running command is blocked. The domains you need go into network.allowedDomains in the config file, and the rest of the network stays closed.
Can Fence be used with Claude Code without writing rules by hand?
Yes, fence import --claude --save carries Claude Code's current permissions into Fence's own configuration format and saves them. The code template, selected with -t code, is also built for running coding agents with ready settings.
How does Fence block dangerous commands like git push?
The denied-command list goes in the config file's command.deny field, for example {"command": {"deny": ["git push", "npm publish"]}}. A command on that list does not run inside the sandbox regardless of what permissions the agent itself was given.
What does monitor mode -m show?
It prints blocked attempts at network access, file access or denied commands in real time, and the output can be routed to a separate file with --fence-log-file and read with tail -f. On Linux with bpftrace installed, filesystem-level violation visibility is added to this.
Does Fence replace a virtual machine or a Docker container?
No, it's a process sandbox through sandbox-exec on macOS and bubblewrap on Linux, with no separate kernel or image. Kernel-level isolation or a full container needs a different tool; Fence solves a lighter task — limiting a regular process on the same machine.
Discussion
No questions or reviews yet.
Related
CLI toolsThe safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
A sandbox for commands and agent-written code: writes, network and environment variables are closed by default, keys are injected only for allowed domains
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
A security CLI for coding agents: secret scanning, command policies, pre-commit hooks, third-party skill auditing
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Fence (this entry) | yes | 996 | ||
| AIO Sandbox | no | key is optional | 6,206 | a full Docker container with a browser, terminal and VS Code inside, rather than a sandbox wrapper around a command on your own machine |
| Zerobox | no | 723 | a sandbox for commands and agent-written code |
README in short
The repository description opens with a short definition and basic usage examples: blocking network access, running with shell expansion, debug mode, running from a template. A configuration section with a sample fence.jsonc file and a description of the settings inheritance chain follows, then a section on carrying rules over from Claude Code and a bulleted feature list. A short closing Attribution section states the project was inspired by Anthropic's experimental sandbox-runtime.