agent-safehouse

Why we included this project

Locally run LLM coding agents come with a real hazard: they hold a shell that can touch everything on your machine, and one bad tool call can destroy work you spent days building. Agent Safehouse answers that on macOS by using the system's sandbox-exec with deny-first profiles, so an agent like Claude Code or Codex can only reach the files and integrations you explicitly allow. Because it builds on native OS machinery instead of a custom runtime, it stays close to the normal dev flow while keeping runaway behavior contained. That makes it a good fit for people running agents on their everyday Mac rather than in a throwaway VM. The project also frames itself honestly, as a hardening layer and not a perfect boundary, which is a reasonable place to start for a least-privilege setup around local agents.