nono CLI
cli sandbox for ai agents without containers or daemons: runs Claude Code, Codex, or OpenCode with restricted access to files, network, and credentials
- 4,935 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Installs a system binary and manages access policies for files, network, and credentials
- Runs arbitrary agent commands and the tools it calls, albeit in a restricted environment
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/nonoDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Installs a system binary and manages access policies for files, network, and credentials
- Runs arbitrary agent commands and the tools it calls, albeit in a restricted environment
This is third-party code. Review the repository files before installing.
What it does
nono wraps agent execution in a process-level sandbox: the binary installs with a single command and immediately isolates the agent from disk, network, and credentials outside the allowed policy. Policies (profiles) define which folders, domains, and secrets the agent can access and are stored as plain JSON files that can be extended using the profile init command. The registry registry.nono.sh provides ready-made profiles for popular agents like OpenCode. A separate component monitors the agent itself and the tools it calls—git, gh, curl, kubectl, package managers, and MCP clients and servers run under a broker in their own child sandboxes with separate permissions, preventing the agent from inheriting broad access.
Who it is for. For developers and security engineers who run AI agents on their machines or in teams and want to restrict their access to SSH keys, cloud tokens, and unnecessary folders.
Good fit when
- You need to run Claude Code, Codex, or another agent without risking exposure of SSH keys or cloud credentials
- You require different network and file access policies for different projects or team members
- The agent calls tools like git, curl, or kubectl, which also need separate restrictions
Not a fit when
- The agent already runs in an isolated environment such as a separate virtual machine
- You need full hardware emulation or hypervisor-level isolation rather than a lightweight process sandbox
Example request
Wrap Codex in a nono sandbox with a profile for this agent so it has no access to my SSH keys or other foldersLimitations
The sandbox operates at the operating system and process level rather than as a full virtual machine, so isolation depends on OS capabilities. Ready-made profiles from the registry are created by third parties, so their policies should be reviewed before production use. Windows is supported via WSL2.
How to disable. Run the agent directly without the nono run wrapper. To remove the tool itself, use brew uninstall nono or delete the installed binary manually.
FAQ
How does nono differ from running an agent in Docker?
nono does not start a daemon, container, or virtual machine; the sandbox works at the process level and starts instantly, with access policies defined declaratively in a JSON profile.
Can access be restricted for MCP servers called by the agent?
Yes, the nono broker runs tools called by the agent, including MCP clients and servers, in separate child sandboxes with their own network, file, and credential permissions.
Discussion
No questions or reviews yet.
Related
CLI toolsA Go CLI that runs a coding agent in an OS sandbox with skills and secrets behind a bridge and isolated files and network.
Access control for agents: rules for what Claude Code, Codex, Cursor and MCP servers may do, review of risky actions before they run, and one audit log
Claude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.
NVIDIA's open stack for running OpenClaw, Hermes and LangChain Deep Agents in OpenShell sandboxes with network policy and managed inference
An isolated box for coding agents on your own machine: access only to chosen projects and credentials, secured registry
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
README in short
The README describes nono as the fastest way to run an AI agent in a sandbox without configuration: installation via curl script, Homebrew, or Nix; then find a ready profile in the public registry and run with nono run. Profiles can be extended with profile init and shared with your team. A dedicated section explains how nono isolates the agent and the tools it calls along the way—such as git, gh, curl, kubectl, and MCP clients—via a broker with separate policies for each. The project is created by the team behind Sigstore and is used by engineers at Datadog and Okta.