A container-free, deny-by-default sandbox for AI coding agents, enforcing kernel-level filesystem, network, and syscall isolation on Linux and macOS.
Greywall is a security sandbox for AI coding agents that provides container-free, kernel-enforced isolation for Linux and macOS systems. It operates on a deny-by-default principle, restricting filesystem access, network connections, and system calls to only what is explicitly permitted, preventing AI tools from accessing sensitive data like SSH keys or environment secrets. The tool includes a learning mode to trace command behavior and auto-generate least-privilege profiles.
Developers and security engineers who use AI coding assistants (e.g., Claude Code, Cursor, Codex) and need to run them in a secure, isolated environment without the overhead of containers.
Greywall offers a lightweight, kernel-level sandboxing solution that doesn't require containers, reducing complexity and overhead. Its deny-by-default approach, built-in profiles for popular AI agents, and learning mode for automatic profile generation provide a unique combination of strong security and developer convenience.
Container-free, deny-by-default sandbox for AI coding agents. Kernel-enforced filesystem, network, and syscall isolation for Linux and macOS
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Enforces strict, kernel-level isolation using multiple layers like Bubblewrap and Landlock on Linux, preventing unauthorized access to sensitive files like SSH keys and .env files.
Provides one-command setup for popular AI coding agents such as Claude Code and Cursor, with pre-configured allow/deny lists that balance security and usability.
Traces filesystem access via strace or eslogger to auto-generate least-privilege profiles, reducing manual configuration effort for new tools.
Uses kernel-enforced sandboxing without requiring Docker, minimizing performance impact and setup complexity compared to container-based solutions.
macOS lacks key features like transparent proxy and DNS capture available on Linux, limiting full security monitoring and control capabilities.
Requires installation of external tools like bubblewrap and socat, which may not be pre-installed and add setup steps, especially on minimal systems.
Manual profile editing for custom tools can be intricate, and the learning mode may miss edge cases or require sudo on macOS, adding operational friction.