Agent Safehouse
Hacker ApprovedRanked 2 of 10 sandboxing tools by recommenders
Free shell-script wrapper around macOS sandbox-exec that restricts coding agents to the current folder; people value its transparency and simplicity. Main caveat: it only works on macOS.
Free shell-script wrapper around macOS sandbox-exec that restricts coding agents to the current folder; people value its transparency and simplicity. Main caveat: it only works on macOS.
45 people gave an opinion
- recommend it
- 43
- criticize it
- 2
- approval share
- 96%
Recommended in 7 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 43 people recommend itNeeds 10 or more, met.
- 22 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 7 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Restricts agents to the current folder
“hides and protects your filesystem from the agent CLI - it cannot read/write/delete anything outside of the current folder”
Comment from 11 Aug 2026 in “Auto mode is now the default in Claude Code” “use built-in sandboxing to jail Claude (and every other agent) to $CWD so it doesn't read/write anything it shouldn't”
Comment from 18 Feb 2026 in “Claude Sonnet 4.6 System Card” “I made a local sandbox to jail all TUI clunkers to $CWD and run all of them in —-yolo mode”
Comment from 25 Feb 2026 in “Pi – a minimal terminal coding harness” Works with any agent
“use built-in sandboxing to jail Claude (and every other agent) to $CWD so it doesn't read/write anything it shouldn't”
Comment from 18 Feb 2026 in “Claude Sonnet 4.6 System Card” “I wanted something that offers strong guarantees across all agents”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “it works for any agent and has many sane default for developers”
Comment from 28 Mar 2026 in “Don't YOLO your file system” Simple, transparent, few dependencies
“IMO, that's the best part about the project - no dependencies, no fancy tech, no virtualization.”
Comment from 8 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “I implemented this in Bash to avoid having an opaque binary in the way.”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “the transparency of what your thing does is really great”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” Built on native sandbox-exec
“The macOS sandbox approach is smart because it leverages the OS-level enforcement rather than relying on application-layer restrictions”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “You don’t actually need to install anything and can just generate a text file with the security profile for sandbox-exec.”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “Well maintained and is built on existing sandbox-exec so you are not locked in”
Comment from 30 Jun 2026 in “Ask HN: Secure Wrapper for Coding Agents”
Other sandboxing tools people recommend
The four most recommended other sandboxing tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Bubblewrap (bwrap) | 109 | 32 | 77% | 12 | — | Approved |
| Agent SafehouseThis page | 43 | 2 | 96% | 7 | — | Approved |
| nono | 34 | 3 | 92% | 10 | — | Approved |
| Firejail | 30 | 6 | 83% | 12 | — | Approved |
| sandbox-exec | 25 | 7 | 78% | 11 | — | Approved |
What people said
40 of the 63 comments that mention it, newest first. Each links to the original comment.
“wrapping the harness around something like sandbox-exec or agent-safehouse is a must”
“hides and protects your filesystem from the agent CLI - it cannot read/write/delete anything outside of the current folder”
“Looks like a tool easy enough to use and start with the agentic world in a sandboxed and much safer manner.”
“The syntax is a bit archaic, so I built a Bash wrapper around it to dynamically detect which agent you use and from what dir”
“macOS-native sandboxing for local agents. Move fast, break nothing.”
“Well maintained and is built on existing sandbox-exec so you are not locked in”
“Don't give your agent access to content it should not edit, don't give keys it shouldn't use.”
“it works for any agent and has many sane default for developers”
“Containers and VMs are really annoying to work with for these kinds of applications”
“I have significantly more trust in literally any individual dev creating a free generic open-source tool”
“prompt injection doesn't care about your filesystem permissions”
“something like Agent Safehouse makes more sense”
“could be the perfect playground fence around my sandbox”
“this is very cool even (and especially) if it's so simple.”
“Agent Safehouse is a clean solution to problem 1. That's genuinely useful and worth having”
“the transparency of what your thing does is really great”
“I wanted something that offers strong guarantees across all agents”
“The macOS sandbox approach is smart because it leverages the OS-level enforcement rather than relying on application-layer restrictions”
“Your agent can do this in a loop by itself - just feed it the repo as there are many integrations that are not enabled by default that will help it.”
“A wrapper CLI that allows any command to be sandboxed is pretty appealing”
“I think this is the right approach to building sandbox for agents”
“Fantastic! I had been using dockers but this might be better!”
“This is a very nice and clean implementation.”
“That online builder is very cool, well done!”
“You don’t actually need to install anything and can just generate a text file with the security profile for sandbox-exec.”
“I for one am grateful for efforts like these”
“timely as I am playing whackamole with sandboxing right now”
“Also like that it alerts on attempts to read restricted stuff.”
“can use the Policy Builder to generate a static policy file with minimal permissions”
“I implemented this in Bash to avoid having an opaque binary in the way.”
“This looks like a competent wrapper around sandbox-exec.”
“we've been impressed enough with how efficient it is that I decided it deserved a post”
“Safehouse makes that 0%, which is categorically different.”
“I'd still recommend using something like this.”
“But this is much closer to what I actually need.”
“more reliable (and restrictive), as Claude Code has ways to escape its sandbox”
“IMO, that's the best part about the project - no dependencies, no fancy tech, no virtualization.”
“I made a local sandbox to jail all TUI clunkers to $CWD and run all of them in —-yolo mode”
“in the repo have a collection of minimal profiles for sandbox-exec to use”
“use built-in sandboxing to jail Claude (and every other agent) to $CWD so it doesn't read/write anything it shouldn't”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.