Greywall CLI
Container-free sandbox for AI agents on Linux and macOS: files, network and syscalls stay closed until you open them explicitly
- 313 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The tool manages a network proxy and kernel rules, so a wrong profile gives the agent excess access.
- The install script is downloaded from GitHub and run through `sh`.
Install
- Works in
Manual install
brew tap greyhavenhq/tap && brew install greywallThe first README option for macOS: Homebrew also installs greyproxy.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The tool manages a network proxy and kernel rules, so a wrong profile gives the agent excess access.
- The install script is downloaded from GitHub and run through `sh`.
This is third-party code. Review the repository files before installing.
What it does
Greywall runs Claude Code, Cursor, Codex and other agents inside a deny-by-default sandbox. Only the working directory is reachable, and network traffic goes through the greyproxy proxy with a dashboard showing what was allowed and what was denied. Rules block dangerous commands such as `rm -rf /` and `git push --force`. The `--learning` mode records which files a command touches and builds a least-privilege profile. For observation without restrictions there is `greywatch`, which lets all traffic through but shows it on the dashboard. Ready-made profiles cover popular agents and languages.
Who it is for. Developers who run coding agents on their own machine and do not want to hand over SSH keys, `.env` files and the home directory.
Good fit when
- An agent edits code in one repository and must not see `~/.ssh` or `.env`.
- A new agent works on a project for the first time and its network requests need a look on the dashboard.
- An access profile for a tool is built from an actual run through `--learning`.
- For Claude Code and Codex, `git push` and `npm publish` are closed with a command deny list.
Not a fit when
- The environment is already isolated by a container or a virtual machine, so a second sandbox adds nothing.
- You need transparent capture of all traffic on macOS, where it is not supported.
- The agent needs secrets from the home directory, so the profile has to be widened by hand.
Example request
Run `claude` through `greywall` with the `claude,python` profile and show which paths and addresses it touched.Limitations
On Linux `bubblewrap` and `socat` are required. macOS has no transparent traffic or DNS capture, so the network goes through proxy environment variables. The `--learning` mode on macOS uses `eslogger` and needs `sudo`. Review the built-in profiles before the first run: Greywall shows them and offers to apply, edit or skip. The `greywatch` mode denies nothing and suits observation only. Check the setup with `greywall check` before relying on it.
How to disable. Run the agent without the `greywall --` prefix. To remove the tool, delete the `greywall` and `greywatch` binaries and the profiles in `~/.config/greywall/` (on macOS `~/Library/Application Support/greywall/`).
FAQ
How do I run an agent in the sandbox?
Put `greywall --` before the command, for example `greywall -- claude`. On the first run Greywall shows the built-in agent profile, which you can apply, edit or skip.
How does `greywatch` differ from `greywall`?
`greywatch` blocks nothing: the network is open and the filesystem is broad, yet all traffic shows on the greyproxy dashboard. `greywall` closes everything by default.
How do I build a profile for my own command?
Run `greywall --learning -- opencode` with your command. Greywall traces file access and the next run picks up the generated profile; `greywall profiles list` shows the list.
Which agents have ready-made profiles?
Claude Code, Codex, Cursor, Aider, Goose, Gemini CLI, OpenCode, Amp, Cline, Copilot, Kilo, Auggie and Droid, plus Node, Python, Go, Rust, Java, Ruby and Docker.
What does Greywall need on Linux?
`bubblewrap` and `socat` are required, `xdg-dbus-proxy` and `libsecret-tools` are optional. `greywall check` reports the state of dependencies and protective features.
Discussion
No questions or reviews yet.
Related
CLI toolsThe safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
Claude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.
A control layer for autonomous agents: action policies, review queue, recovery points and config audit for Claude Code and Codex.
cli sandbox for ai agents without containers or daemons: runs Claude Code, Codex, or OpenCode with restricted access to files, network, and credentials
A local guard for coding agents: blocks secret writes and force pushes to main, warns about risky commands.
Access control for agents: rules for what Claude Code, Codex, Cursor and MCP servers may do, review of risky actions before they run, and one audit log
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Greywall (this card) | no | 313 | |
| Fence | yes | 1,013 | Greywall grew out of Fence and adds the greyproxy proxy with a dashboard, a profile learning mode and an observing `greywatch` |
| Agent Safehouse | no | 2,136 | works on macOS only through `sandbox-exec`; Greywall covers Linux and macOS and shows network requests on a dashboard |
README in short
Works in two modes: the deny-by-default `greywall` sandbox and the `greywatch` observation layer. Both route traffic through greyproxy. Configuration lives in `greywall.json`: network, filesystem and denied commands.