SkillFoxx

Sandcat CLI

A Docker sandbox that runs agents without confirmations behind a traffic filter and with secret substitution at the proxy.

  • 204 ★ on the repository
  • Last commit
  • Apache-2.0
CLI

Extended access

Why this level

  • `--dangerous` mode removes the agent's confirmations, and protection rests on network rules the user sets.
  • The network installer and proxy keep API keys in settings on your machine.
All reasons and checks

virtuslab/sandcatAuthor:VirtusLab

Install

Manual install

curl -fsSL https://raw.githubusercontent.com/VirtusLab/sandcat/master/install.sh | sh

The first quick start step. Then `sandcat init` and `sandcat run`.

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • `--dangerous` mode removes the agent's confirmations, and protection rests on network rules the user sets.
  • The network installer and proxy keep API keys in settings on your machine.

This is third-party code. Review the repository files before installing.

What it does

Sandcat sets up a sandbox for the AI agents Claude Code, Cursor CLI, Codex CLI and GitHub Copilot CLI. All container traffic runs through a transparent mitmproxy over WireGuard with no per-tool proxy setup. A rule engine allows or denies HTTP/S requests and DNS by list, and other TCP and UDP is dropped. Secrets are substituted at the proxy: the container never sees real values. The `sandcat` CLI initializes a project with `sandcat init`, for example `--agent claude --ide vscode --stacks "python,node"`, and runs it with `sandcat run` or as a dev container in VS Code. The project is part of VirtusLab's Visdom platform.

Who it is for. Developers and security teams who want to give an agent full command access while limiting the network and protecting keys.

Good fit when

  • An agent runs with no confirmations and the network must be limited to an allow list.
  • API keys cannot be left inside the container where the agent runs.
  • A reproducible environment is needed in VS Code as a dev container.
  • A team wants the agent to reach only package registries.

Not a fit when

  • You need kernel-level isolation from malicious code: a Docker container is weaker than a virtual machine.
  • Docker with `docker compose` and `yq` are unavailable.
  • You must run the agent on a remote machine with no Docker.

Example request

Set up Sandcat for this Python and Node project with the Claude agent and open it as a dev container.

Limitations

Docker with `docker compose` and `yq` are required. Installation runs through the repository `install.sh`, so read the script before running it. API keys go into `~/.config/sandcat/settings.json` and the user writes the allow rules, so an overly broad list weakens protection. A Docker sandbox does not replace virtual machine isolation. Documentation lives on sandcat.virtuslab.com. The last commit dates to November 2026.

How to disable. Stop the containers with the project compose command, delete the `.devcontainer` folder with Sandcat files and the `~/.config/sandcat/` settings.

FAQ

How do I install Sandcat?

Run `curl -fsSL https://raw.githubusercontent.com/VirtusLab/sandcat/master/install.sh | sh`. Docker with `docker compose` and `yq` are required.

How do I initialize a project?

With `sandcat init --agent claude --ide vscode --stacks "python,node" --name myproject`. Then add keys to `~/.config/sandcat/settings.json` and run `sandcat run`.

How does the container get secrets?

It does not. The proxy substitutes real values into outgoing requests while the container holds only placeholders.

What about non-HTTP traffic?

HTTP/S and DNS requests pass through the rules, while any other TCP and UDP, which carry no hostname, are blocked.

Which agents are supported?

Claude Code, Cursor CLI, Codex CLI and GitHub Copilot CLI.

Discussion

No questions or reviews yet.

CLI tools

agents-sandbox runs a coding agent inside a separate microVM, hiding the rest of your system and secrets from it.

CLIExtended access87

Container-free sandbox for AI agents on Linux and macOS: files, network and syscalls stay closed until you open them explicitly

CLIExtended access315

Claude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.

CLIBroad access131

The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags

CLIExtended access2.1K

A single binary runs coding agents inside an isolated sandbox: a microVM, network policies and secrets hidden from the agent.

CLIExtended access61

VibeKit runs Claude Code, Codex and other CLI agents through a proxy that masks secrets in replies, keeps a log and can hold the agent in Docker

CLIBroad access1.9K

README in short

The README covers the transparent proxy design, a three-step quick start and the repository layout: the CLI, dev container templates and network filtering scripts. Full documentation lives on a separate site.

README badge

Report a problem