yoloAI CLI
Sandbox CLI for agents: Claude Code and Codex run without prompts on a project copy, and changes apply after a diff.
- 255 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The agent in the sandbox acts without confirmation prompts, and with the `container-privileged` option isolation is weaker than usual.
- Agent credentials are mounted into the sandbox and the agent uses them, so the network is worth restricting.
Install
- Works in
Manual install
brew install --cask kstenerud/tap/yoloaiThe Homebrew route. The README lists a manual binary download from the releases page first.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent in the sandbox acts without confirmation prompts, and with the `container-privileged` option isolation is weaker than usual.
- Agent credentials are mounted into the sandbox and the agent uses them, so the network is worth restricting.
This is third-party code. Review the repository files before installing.
What it does
yoloAI runs an agent in a disposable sandbox where it may edit and execute anything without confirmation prompts. The agent works on a copy of the project while the real files stay untouched until the user accepts the changes. The flow: `yoloai new fix-bug ./my-project --prompt "fix the failing tests"` creates a sandbox and starts the agent, `yoloai diff fix-bug` shows the edits, `yoloai apply fix-bug` moves chosen commits into the project, and `yoloai destroy fix-bug` removes the sandbox. Claude Code, Codex, Gemini CLI, Aider and OpenCode are supported. The isolation level ranges from the runc container through gVisor to Kata virtual machines. API keys stay on the host and reach the agent through a broker, and the network can be restricted to an allowlist of domains with `--network-isolated` or switched off with `--network-none`. The `yoloai mcp serve` command exposes sandbox control to an outer agent as MCP tools.
Who it is for. Developers who run Claude Code or Codex with confirmations off and want an isolation layer with a reviewable diff between the agent and their machine.
Good fit when
- An agent has to fix tests all night and nobody will sit over permission prompts.
- A risky refactoring experiment runs in a copy and only the good commits move into the main repository.
- In CI a one-shot agent run with `yoloai run --prompt ... --rm` returns its result as JSON.
- Development secrets must not be shown to the agent: the network is restricted and keys stay on the host.
Not a fit when
- Protection against a deliberate break-in is needed: the README is open about the limits of its security model.
- The project does not fit into a copy or depends on outside services missing from the sandbox.
- The machine has no Docker, Podman or other supported backend and installing one is unwelcome.
Example request
Run yoloai new fix-bug ./my-project --prompt "fix the failing tests", then show the diff and wait for my decision on apply.Limitations
One of the backends is required: Docker, Podman, containerd with Kata, Apple Container, Tart or Seatbelt on macOS. Building from source needs Go 1.26 or newer. Virtual machine modes are available only on Linux with containerd. Files listed in `.gitignore` are not copied into the sandbox, so local secrets stay out, but needed ignored files must be passed explicitly. Isolation reduces the damage of an agent's mistake, yet it does not replace protection from malicious code.
How to disable. Remove sandboxes with `yoloai destroy <name>`, then the `yoloai` binary and the `~/.yoloai/` directory. The MCP connection is removed from the client configuration.
FAQ
How do I install yoloAI?
On macOS and Linux use `brew install --cask kstenerud/tap/yoloai`. There are prebuilt binaries on the releases page, deb and rpm packages, and `go install github.com/kstenerud/yoloai/cmd/yoloai@latest`.
Does the agent change my files directly?
No. It edits a copy in the sandbox. Only `yoloai apply` changes project files, after you have looked at `yoloai diff`.
How do I cut off the agent's network?
The `--network-none` flag removes the network entirely, and `--network-isolated` leaves access to the agent's API and allowed domains.
How do I drive sandboxes from another agent?
Start `yoloai mcp serve` and connect it as an MCP server: the outer agent gets tools to create and inspect sandboxes.
Which agents are supported?
Claude Code, Codex, Gemini CLI, Aider and OpenCode, plus a `shell` mode for anything else.
Discussion
No questions or reviews yet.
Related
CLI toolsAn orchestrator CLI for coding agents: loops, typed tasks, receipt-backed merges and a skill set for Claude Code and Codex
Self-hosted AI coding agent with a web interface: project map, decision memory, local models via Ollama and permission modes
PromptOps keeps Claude Code, Codex and Gemini CLI side by side by project and gives a lead agent MCP to launch helpers
LACP runs Claude Code, Codex and Hermes through local policy gates, budgets and an evidence log, and rolls back failed changes
A terminal coding agent in one Rust binary that reads code, edits files and runs tests with any model of your choice.
oah links 80-plus skills, five roles and /commit, /review, /test-tdd commands into Claude Code, Cursor, Codex and other agent folders
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| yoloAI (this card) | no | 255 | |
| Agent Safehouse | no | 2,149 | confines an agent with sandbox-exec on macOS only; yoloAI works on a project copy across six backends and applies edits by diff |
| nono | no | 4,945 | runs an agent with restricted access without containers; yoloAI isolates through containers and virtual machines and moves edits with apply |
README in short
A single static Go binary with a detailed guide and a security model section that lists its limits openly. Releases are signed with cosign and carry GitHub build provenance, and CI includes a nightly audit.