wardcell

A coding agent runs as you — your SSH keys, your cloud credentials, every .env you have ever checked out, and the whole internet. wardcell takes that away and gives back only what you granted, enforced by the OS itself.

wardcell run -- claude

The sandbox that doesn’t break your agent

Most sandboxes fail the same way: they block something the tool needed, the agent errors out, and you turn the sandbox off. A sandbox you disable protects nothing. wardcell’s answer is composable policy — access assembled from small, reusable fragments, one per tool.

True least privilege

require the tools you use and the agent gets the exact union of what they need — not a broad “developer” grant that defeats the point. Each tool’s permissions are drafted once and reused.

Tools just work

Open a project with no policy and wardcell detects what it is — a Java build, a Go module — and offers the matching fragments in a terminal picker. selects_on then hands each command its policy at runtime, so the tool runs instead of breaking, and the community keeps adding fragments.

Your project, one file

A .wardcell.sbx in your repo adds only the extra reach that project needs on top of the tool fragments. It can add; it can never weaken the base policy.

What a policy looks like

fragment "my-agent" {
  selects_on = { commands = ["claude"] }  # picked automatically when you run claude
  requires   = ["toolchains/node", "integrations-core/git"]  # reuse, don't rewrite

  fs {
    allow_read  ["$WORKDIR"]          # the project, and nothing above it
    allow_write ["$WORKDIR"]
  }

  net {
    allow_http "api.anthropic.com" {  # the API, and only these requests
      allow_requests ["POST /v1/messages"]
    }
  }
}

~/.ssh is not denied here — it was never granted. That is the default, and removing a line can never grant more.

Why wardcell

Best on macOS, by a distance

The only agent sandbox with full native macOS network support out of the box — traffic is captured transparently by a system extension, so even a client that ignores proxy variables is gated. No VM, macOS 13+.

Runs in your real environment

The agent runs on your machine, as you, unprivileged — no VM, no container, no root, no daemon, nothing to stand up before it works.

Rules that see names, not just IPs

A local proxy gates on hostnames, HTTP methods and paths, and single GraphQL mutations — decisions a kernel address filter cannot make.

Bring your own identity and approvals

One plugin connects wardcell to any secrets or approval system — Vault, Okta, Slack, SPIFFE. A zone can authenticate a request (the agent never holds the secret) or require a human to approve it, or allow only pre-approved commands.

Discover a policy; don’t guess it

You never work out which 40 paths cargo touches or which hosts gh calls. policy draft watches a real run and writes a fragment from what the tool actually reached — reviewed by a person, never auto-promoted.

wardcell policy draft -- my-tool

One policy, every backend

Write your policy once and wardcell projects it onto whatever enforces it — Seatbelt and Bubblewrap today, Windows and cloud sandboxes next. The same .sbx means the same thing everywhere. See how wardcell compares with OpenShell, Strands Box and MXC.

Start here

• Installation — Homebrew or apt, no root, no daemon
• Quick Start — first sandboxed command in five minutes
• How It Works — the architecture, end to end
• Policy Model — the five rules everything else follows from
• Writing Plugins — the one program wardcell asks, and what it is asked