SandVault CLI
The sv command runs Claude Code, Codex and other agents in a separate macOS user under sandbox-exec, with no virtual machine.
- 450 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Creates a system user and configures passwordless switching.
- Isolation is weaker than a virtual machine: a shared kernel and a shared folder reachable by both owner and sandbox.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/sandvaultDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Creates a system user and configures passwordless switching.
- Isolation is weaker than a virtual machine: a shared kernel and a shared folder reachable by both owner and sandbox.
This is third-party code. Review the repository files before installing.
What it does
SandVault (`sv`) creates a limited macOS user account and runs a shell or an agent inside it. The owner's home directory is unreachable, system files stay unchanged and mounted drives are closed. Working files live in the shared folder `/Users/Shared/sv-$USER`. Protection is layered: a separate user plus `sandbox-exec`. The commands `sv claude`, `sv codex`, `sv opencode`, `sv gemini`, `sv pi`, `sv muse` and `sv shell` start the chosen tool inside. Chrome or Lightpanda automation and the iOS Simulator are reachable from the sandbox. The repository includes an `sv` skill that hands the current task to a Claude inside the sandbox.
Who it is for. Mac users who run agents with broad permissions and refuse to hand over the home directory but do not want to maintain a virtual machine.
Good fit when
- An agent runs third-party code while your home directory must stay closed.
- An overnight task runs in Claude Code or Codex unattended.
- A web test through Chrome in the sandbox must stay apart from the main profile.
- An `xcodebuild` or `swift` build or test should be isolated from personal files.
Not a fit when
- You need a full virtual machine with its own kernel.
- You work on Linux or Windows.
- The agent needs access to GUI applications inside the sandbox.
Example request
Start Claude Code inside SandVault and let it finish the tests in the shared folder without touching my home directory.Limitations
macOS only. This is isolation by user account and `sandbox-exec`, not a virtual machine, so the boundary is weaker. GUI applications cannot be launched from the sandbox. Apps with their own sandbox, such as `swift`, fail inside because macOS forbids nested sandboxes; the the README includes workarounds. Creating the user and passwordless switching need administrator rights during first setup.
How to disable. Run `sv uninstall`: the account is removed while files in the shared folder remain. Delete that folder and the Homebrew package by hand.
FAQ
How is SandVault different from a virtual machine?
It is a regular macOS user plus `sandbox-exec`. Switching is instant with no hypervisor load, but the kernel is shared.
Which agents run inside?
Claude Code, OpenAI Codex, OpenCode, Google Gemini, pi and Muse Code. Any command can run through `sv shell`.
Can I connect over SSH?
Yes. The `-s` or `--ssh` flag runs commands through `ssh sandbox-$USER@127.0.0.1`, and keys go into `~/.config/codeofhonor/sandvault/authorized_keys.d/`.
How do I remove SandVault?
`sv uninstall` removes the account and leaves shared-folder files untouched.
Can Chrome and the iOS Simulator run inside?
Yes, Chrome or Lightpanda automation and the iOS Simulator are reachable from the sandbox. GUI applications cannot be launched.
Discussion
No questions or reviews yet.
Related
CLI toolsIsolated Linux microVMs for agent code: the official Vercel skill on the SDK, network rules and snapshots.
A Rust sandbox for parallel coding agents: each gets its own workspace over one shared project, and changes publish as one set.
AgentBox runs Claude Code, Codex and Open Code in separate virtual machines on your PC, a self-hosted server or a cloud.
A self-hosted agent code sandbox on Kubernetes: REST API, MCP server, E2B compatibility and skills for managing it.
Runtm runs Claude Code, Codex and other agents in isolated sandboxes and deploys the app they build to a live HTTPS endpoint
clawk is a virtual-environment CLI that snapshots a Linux machine’s memory and disk so running processes can be resumed later.
README in short
The `sandvault-$USER` user can read system directories but cannot see other home folders or drives. Shared access is limited to `/Users/Shared/sv-$USER`.