Skip to content
ai-jail
EnglishPortuguês (Brasil)Españolעברית日本語한국어
Menu
Do I need it?What an agent can reach on your machineHow it worksThe layers between the agent and your systemCompareBuilt-in sandboxes, Docker and VMsConfigureOpen only what a task needsSecurityThe threat model and its limitsDownloadBinaries, checksums and release notesInstall
An OS sandbox for AI coding agents

A jail for your AI coding agent

ai-jail runs Claude Code, Codex and other AI coding agents inside an OS sandbox on Linux and macOS. The project stays writable. Your files and credentials stay out of reach, except for the invoked agent's own login.

terminal
ai-jail claude
InstallDo I need it?
Not a VM

Give the agent the project, not the whole machine. ai‑jail makes that boundary real.

How a good agent goes wrong

All day the agent reads text you did not write: web pages, issues, READMEs, packages. One page with instructions hidden in it is enough, and the agent does not need to be hostile to follow them.

↔ Swipe sideways to see the full diagram

The same page, with and without ai-jail. The key is not there to read, and the general internet stays closed except for the agent's own API host and the package registries on Linux.
What else an agent can reach

  1. Your agent runs as you

    A coding agent is a program under your user account. So is every script, package and MCP server it starts; an MCP server is a helper program that gives the agent extra tools. All of them can open anything you can open.

  2. Start it through ai-jail

    Type ai-jail in front of the command. The agent starts in its own namespaces, with your project mounted at the same path.

  3. Your home is not mounted

    The agent gets a fresh, empty home directory. SSH keys (the files that log you in to your servers), cloud credentials, browser profiles and your other projects do not exist in there.

  4. Secrets, network and devices are closed

    ai-jail cuts environment variables down to an allowlist, so your shell secrets stay in your shell. The network is closed, except the agent's own API host and, on Linux, the package registries your toolchains fetch from. The Docker socket, the screen and the clipboard are off.

  5. Open what the task needs

    Claude Code, Codex, Gemini, Grok and Devin start logged in and reach their own API host. A flag, an option you type after ai-jail, opens more: --allow-host adds hosts, --network opens all of it.

The wall goes around the whole harness

Agents that ship a sandbox put it around the commands the model runs. The agent process, its file tools, its MCP servers and its hooks (scripts the agent runs at set moments) stay outside, under your account. ai-jail starts all of them inside. A prompt asks a person, and a person can be rushed or fooled. A sandbox asks the kernel, the core of the operating system, which gives the same answer every time.

↔ Swipe sideways to see the full diagram

One policy for every agent you use, written once.
See the full comparison

What you get with no configuration

Everything that reaches your machine is off until you turn it on, except the agent's own login, its own API host, your toolchains (on Linux) and their package registries, each with a --no- switch. Writes outside the project land in memory and vanish when the session ends.

Inside the jail

  • Your project, read and write, at its real path
  • Your toolchains, read only, with a cache the jail owns (Linux)
  • The agent's own login, such as ~/.claude, so it starts signed in
  • A known agent's own API host, and the package registries on Linux
  • A fresh home directory and a private /tmp

Out of reach

  • ~/.ssh, ~/.aws, ~/.gnupg, browser profiles
  • Your shell secrets, except the agent's own API key
  • Other processes, host IPC, ptrace and bpf

Off until you ask

  • --allow-host for more hosts, --forward-port for one local service, --network for all of it
  • --ssh, --gpu, --display, --docker and more
All the switches

ai-jail is one small program with no daemon and no root. On Linux it builds the walls from kernel features: bubblewrap for the namespaces and mounts, plus Landlock, seccomp and resource limits where the kernel has them. On macOS it translates what the platform supports into a thinner sandbox-exec profile. The agent uses the compilers and runtimes already on your machine, and by default a .ai-jail file inside a repository can tighten the jail and never open it.

How the layers work

Questions people ask first

Does it slow the agent down?
No. The sandbox is made of kernel features, namespaces and mount rules. There is no emulation and no virtual machine, and the agent runs at native speed.
Which agents does it support?
Any command. It knows where Claude Code, Codex, Gemini CLI, OpenCode, Antigravity, Kimi, Kiro, Prime Agent, Devin, Crush, Grok, jcode, pi, aider, SoulForge and omp keep their login, and mounts it by default. The table on Install lists what each one gets, and ai-jail bash gives you a shell inside the jail to look around.
Does it work on Windows?
Not natively. Use WSL2 and the Linux backend inside it.
My agent needs the internet. Is the jail still useful?
Yes. A known agent such as Claude Code reaches its own API host out of the box, plus the package registries on Linux, and nothing else. --allow-host adds the hosts you name. With --network on instead, the agent can still only read your project, so your keys and the rest of your home are not there to send. What it can read, it can send, which is why masking secrets inside the project matters. See how to mask them.
Is it free?
Yes. ai-jail is open source under the GPL 3.0 license.

Put your agent behind bars

ai-jail is a single binary that needs no daemon and no root. You add one word in front of the command you already run.

terminal
brew tap akitaonrails/tap && brew install ai-jailai-jail claude
Install ai-jailView on GitHub