Confine an AI coding agent so it can only read and write files inside one project folder
Watch a live feed of every file an agent tries to open while it works
Evaluate a new or untrusted AI agent by seeing what it reaches for outside its project
Review afterward what an unattended agent run tried to access on your machine
| yeet-src/agent-lock | gaearon/create-react-app | agentrhq/webcmd | |
|---|---|---|---|
| Stars | 36 | 36 | 35 |
| Language | JavaScript | JavaScript | JavaScript |
| Last pushed | — | 2019-06-17 | — |
| Maintenance | — | Dormant | — |
| Setup difficulty | hard | easy | easy |
| Complexity | 4/5 | 1/5 | 3/5 |
| Audience | developer | vibe coder | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires a Linux kernel with BPF LSM and BTF enabled, and currently expects the agent binary to be named a specific way.
agent-lock is a security tool for people running AI coding agents, such as Claude Code or Codex, on their own computer. Normally an agent runs with your full user account permissions and decides for itself which files it opens, which means a mistake or a bad instruction could lead it to read something sensitive like your SSH keys or cloud credentials. agent-lock takes that decision away from the agent and hands it to the Linux kernel itself, so the agent and every process it starts can only open files inside one folder you choose, no matter what it tries. It works on Linux using a kernel feature called eBPF LSM, which lets a small program attach directly to the moment the kernel opens a file and either allow it or block it. The same piece of code that enforces the rule also reports every file open, allowed or blocked, to a live dashboard in your terminal, so watching what the agent is doing and stopping it from misbehaving both come from the same source instead of two systems that could fall out of sync. Because the check happens inside the kernel after it has already resolved the real file path, tricks like using dots to climb out of a folder, following a symlink that points elsewhere, or other path games do not work around it. The dashboard shows a live summary of allowed versus blocked file opens, a ranked list of blocked attempts with sensitive targets like credential files flagged, and a running feed of file opens as they happen, all attributed to whichever process caused them. This is meant for developers who want to let an agent work on a real codebase while being confident it cannot wander into their home directory's private files, for anyone evaluating an unfamiliar agent before trusting it, or for anyone who wants to review what an agent reached for after running it unattended. Setup requires a fairly recent Linux kernel with specific BPF features enabled, and currently expects the agent binary to be named a certain way so the tool can recognize it. It is written in JavaScript and released under the GPL-2.0 license.
A Linux security tool that uses the kernel itself to confine an AI coding agent to one folder, while showing every file it tries to open live in your terminal.
Mainly JavaScript. The stack also includes JavaScript, eBPF, Linux.
You can use and modify this freely, but if you distribute it or a modified version, you must also release your changes under the same license and share the source code.
Setup difficulty is rated hard, with roughly 1h+ to a first successful run.
Mainly developer.
This repo across BitVibe Labs
double-check against the repo, no cap.