SkillFoxx

The Construct CLI

A single binary runs coding agents inside an isolated sandbox: a microVM, network policies and secrets hidden from the agent.

  • 61 ★ on the repository
  • Last commit
  • MIT
CLI

Extended access

Why this level

  • The CLI runs agents in a sandbox and proxies their traffic with key substitution; the project working directory stays mounted into the sandbox.
All reasons and checks

estebanforge/construct-cliAuthor:EstebanForge

Install

Manual install

curl -fsSL https://raw.githubusercontent.com/EstebanForge/construct-cli/main/scripts/install.sh | bash

The first Quick Install command from the README for macOS and Linux.

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • The CLI runs agents in a sandbox and proxies their traffic with key substitution; the project working directory stays mounted into the sandbox.

This is third-party code. Review the repository files before installing.

What it does

The Construct boots a clean isolated sandbox where 14 agents run, including Claude Code, Codex, Copilot, OpenCode, Amp, Cline, Goose and Antigravity. By default it is a microVM (through microsandbox), and on hosts without support the fallback is an OCI runtime. The agent sees only the directory it was launched from. Real API keys stay on the host: a proxy hands the agent key-shaped sentinels and inspects outbound traffic. The network has four tiers (`allowlist`, `open`, `internet`, `none`), host Git repositories are locked against writes, and with `--clone` changes come out as a Git bundle.

Who it is for. People running broad-permission agents on their own machine who want to shield the host from prompt injection and accidental deletions.

Good fit when

  • An agent gets a dangerous migration and the host must stay untouched.
  • API keys must not be shown to the agent in files or environment variables.
  • Several agents work in parallel on different branches and need separate Git worktrees.
  • A browser agent must open a local dev site on the host `localhost`.

Not a fit when

  • Full agent access to the host is needed: the sandbox restricts paths and network.
  • The environment has neither microVM support nor an OCI runtime.
  • Work happens on native Windows: only WSL is supported.

Example request

construct claude "Help me refactor this function" in a sandbox with an allowlist network policy and no access to keys.

Limitations

It runs on macOS, Linux and Windows through WSL. The first `construct sys image init` prepares the sandbox image and installs agents. The `internet` and `open` tiers are wider than `allowlist`, so strict isolation means `allowlist` or `none`. The proxy inspects HTTPS through dynamic leaf certificates, which corporate policies must account for. The host `.git` lock uses the `chattr +i` or `chflags uchg` attributes. Detailed settings are in `docs/CONFIGURATION.md`.

How to disable. Remove the binary and PATH shims with the command from `docs/INSTALLATION.md`, and clear sandbox images and the cache in `~/.cache/construct` by hand.

FAQ

How do I install Construct?

`curl -fsSL https://raw.githubusercontent.com/EstebanForge/construct-cli/main/scripts/install.sh | bash` on macOS and Linux. There are also `mise use -g github:EstebanForge/construct-cli` and `brew install EstebanForge/tap/construct-cli`.

How do I run an agent?

First `construct sys image init`, then `construct claude "task"`. `construct sys shims install` makes a plain `claude` run inside the sandbox.

How are secrets hidden?

A host proxy substitutes sentinels for real keys. Hide Secrets mode keeps the agent from seeing secrets in files and environment.

Which network tiers exist?

Four: `allowlist` with presets for npm, PyPI, crates, Go, GitHub and apt, `open`, `internet` and `none`. Diagnostics are available through `construct sys network explain`.

Can I work without touching the working copy?

Yes, starting with `--clone` makes a disposable copy and the edits are exported as a Git bundle.

Discussion

No questions or reviews yet.

CLI tools
Official

The bbox CLI runs Claude Code, Codex and other agents inside a microVM and shows a diff before any change lands in your project

CLIBroad access80

A CLI that creates separate virtual machines for coding agents, keeping their development tools away from the main host system.

CLIBroad access814

Claude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.

CLIBroad access131
Official

An isolated box for coding agents on your own machine: access only to chosen projects and credentials, secured registry

CLIExtended access240

agents-sandbox runs a coding agent inside a separate microVM, hiding the rest of your system and secrets from it.

CLIExtended access87

cli sandbox for ai agents without containers or daemons: runs Claude Code, Codex, or OpenCode with restricted access to files, network, and credentials

CLIExtended access4.9K

README in short

Installation is one line and image setup is a separate command. The agent list and all settings live in the `docs` directory.

README badge

Report a problem