Agent Safehouse
Sandbox your local AI agents so they can read/write only what they need
Last verified:
What is Agent Safehouse?
Agent Safehouse is a macOS-native sandboxing tool that secures local LLM coding agents by restricting their file and system access to only what they need. It uses Apple's kernel-level sandbox-exec (Seatbelt) mechanism with a deny-first approach: nothing is accessible unless explicitly granted. This protects sensitive files like SSH keys, AWS credentials, browser profiles, and other repos from accidental or malicious access by AI agents that run with your full user privileges.
Key features include composable policy profiles with --enable flags for optional integrations (Xcode, LLDB, keychain, clipboard, process control, shell init, browser-native-messaging), automatic workdir grants (read/write to git root by default), pre-built profiles for 14+ agents including Claude Code, Codex, Copilot CLI, Gemini CLI, Aider, Goose, Amp, Cline, Cursor Agent, and more, shell function wrappers for zsh/bash/fish that make sandboxing automatic, LLM-assisted custom profile generation, machine-local overrides for host-specific exceptions, and workdir-based .safehouse config files for project-specific policies. Installation is via Homebrew or a single self-contained shell script with zero dependencies beyond Bash and macOS.
The tool is designed for developers using local AI coding agents on macOS who want practical security without workflow disruption. It prioritizes agent productivity over paranoid lockdown, reducing the blast radius from prompt injections, confused deputy flows, or bad commands while keeping common coding workflows working. It's open-source, free to use, and requires no Docker or VM overhead.
Safehouse automatically grants read access to installed toolchains (compilers, package managers, Apple Command Line Tools) and allows network access for registries, APIs, remotes, and MCP servers by default. Sensitive paths like ~/.ssh, shell startup files, browser cookies/login data/history/bookmarks, clipboard, host process enumeration, LLDB/task-port access, and full Xcode developer roots are denied unless explicitly enabled with the appropriate --enable flag.
Agent Safehouse pricing
Pricing model: Freemium
Completely free and open-source. No paid tiers or subscriptions. Available via Homebrew (brew install eugene1g/safehouse/agent-safehouse) or as a single self-contained shell script from GitHub releases. All features including composable profiles, --enable flags, shell wrappers, and LLM-assisted profile generation are included at no cost.
Agent Safehouse pros
- Kernel-level enforcement via macOS sandbox-exec (Seatbelt)
- Deny-first security model - nothing accessible unless explicitly granted
- Zero dependencies beyond Bash and macOS
- Single self-contained shell script - no build step required
- Homebrew installation available
- Automatic read/write access to project workdir (git root)
- Read access to installed toolchains automatically granted
- Supports 14+ coding agents (Claude, Codex, Copilot, Gemini, Aider, Goose, Amp, Cline, Cursor, OpenCode, Kilo, Pi, Goose, Auggie)
- Composable policy profiles with --enable flags for granular control
- Shell function wrappers for zsh/bash/fish make sandboxing automatic
- LLM-assisted custom profile generation available
- Machine-local overrides for host-specific exceptions
- Workdir-based .safehouse config for project-specific policies
- Network access allowed by default for APIs and registries
- Low overhead - not a VM or container
- Open-source and completely free
- Easy proof the sandbox works - try reading ~/.ssh to see denial
- Bypass sandbox with command <agent> when needed
- Sanitized runtime environment by default
- SDKROOT preserved when set
Agent Safehouse cons
- macOS-only - does not work on Linux or Windows
- Not a VM/hypervisor boundary - sandbox escapes possible
- Does not protect against data exfiltration over network from allowed files
- Does not prevent abuse through already-allowed IPC/credential channels
- Does not prevent leakage from explicitly allowed paths
- Requires manual shell config setup for automatic sandboxing
- Learning curve for --enable flag options
- Kernel blocks access but agents still attempt restricted operations
- No GUI - CLI and shell functions only
- Docker and VM overhead not eliminated (just not needed)
Frequently asked questions about Agent Safehouse
What is Agent Safehouse?
Agent Safehouse is a macOS-native sandboxing tool that secures local LLM coding agents by restricting their file and system access using Apple's kernel-level sandbox-exec (Seatbelt). It follows a deny-first model where nothing is accessible unless explicitly granted, protecting SSH keys, credentials, and other sensitive files from AI agents that run with your full user privileges.
Which agents does it support?
Agent Safehouse supports 14+ coding agents including Claude Code, Codex, OpenCode, Amp, Copilot CLI, Gemini CLI, Aider, Goose, Auggie, Pi, Cursor Agent, Cline, Kilo, and Code Droid. Pre-built agent-specific profiles are applied automatically when you wrap the agent command with safehouse.
Does it work on Linux or Windows?
No, Agent Safehouse is macOS-only because it relies on Apple's sandbox-exec (Seatbelt) kernel-level sandboxing mechanism, which is not available on Linux or Windows.
Is it safe to use with sensitive projects?
Yes, Safehouse reduces the blast radius by denying access to SSH keys, AWS credentials, browser profiles, and other repos by default. However, it is a hardening layer not perfect security - it does not protect against sandbox escapes, network exfiltration from allowed files, or abuse through already-allowed IPC channels.
How do I install Agent Safehouse?
Install via Homebrew with brew install eugene1g/safehouse/agent-safehouse, or download the single self-contained shell script: curl -fsSL https://github.com/eugene1g/agent-safehouse/releases/latest/download/safehouse.sh -o ~/.local/bin/safehouse && chmod +x ~/.local/bin/safehouse. No build step or dependencies beyond Bash and macOS.
How do I prove the sandbox works?
Run safehouse cat ~/.ssh/id_ed25219 to see 'Operation not permitted' - the kernel blocks access to SSH keys. Try safehouse ls ~/other-project to see that other repos are invisible. Your current project directory still works normally with safehouse ls .
What does --enable flag do?
The --enable flag adds optional capabilities to the sandbox profile. Examples: --enable=shell-init for shell startup files, --enable=clipboard for clipboard access, --enable=process-control for host process enumeration, --enable=lldb for debugger access, --enable=xcode for Xcode developer roots, --enable=keychain for keychain integration, --enable=browser-native-messaging for native-messaging manifests.
How do I bypass the sandbox if needed?
Use command <agent> to bypass the shell function wrapper and run the unsandboxed binary directly. For example, command claude runs Claude without sandboxing. This is useful when you need full access for specific tasks.
What is the deny-first model?
Deny-first means the sandbox starts from a deny-all posture. Nothing is accessible unless explicitly granted. Safehouse automatically grants read/write to the project workdir and read to toolchains, while denying ~/.ssh, other repos, browser profiles, and sensitive files by default.
Can I customize the sandbox policy?
Yes, you can create machine-local overrides in ~/.config/agent-safehouse/local-overrides.sb for host-specific exceptions, use --add-dirs-ro to add read-only directories, --append-profile to add custom policy files, or drop a .safehouse file in your repo for project-specific policies with --trust-workdir-config.