agentjail

agentjail is policy guardrails software for coding agents. It blocks dangerous tool calls before they run, with examples on the site including destructive shell commands and risky actions such as force-pushes and publishes. The service is described as offline and open source, and it is presented as something that runs on the user’s machine.

Its core flow is built around intercepting each tool call, evaluating it against Rego policies through a local OPA daemon, and returning a deny decision before the shell executes. The site says blocked actions are checked in under 5 ms, and it highlights a default-deny model with an auditable decision log. Out of the box, it includes protected policies for sensitive files such as .ssh, .aws, .gnupg, .env and .pem, plus command policies that block 14 dangerous patterns. Optional library rules extend coverage to shell initialization files, application binaries, shell history, browser cookies, and shell evaluation patterns.

agentjail also includes MCP-related controls, with granular tool-level policies for MCP servers and a full inventory of server configurations. The page describes defense in depth through a kernel sandbox and network proxy, which can block file and network access if hooks are bypassed. It also says agents cannot disable their own hooks, daemon, or policy files. Additional shipped features include a web UI, a live dashboard, full-screen session replay, automatic daemon updates, per-project policy with session tracking, and a Cobra CLI. The roadmap section mentions a Firecracker/libkrun microVM spike, protocol-aware proxying for HTTP, MCP, and LSP traffic, a macOS app, cost tracking and session budgets, and eBPF LSM/system extension work.

The site says it works with Claude Code, Codex CLI, and Cursor. Installation is shown as a shell command using curl, and the page lists Apache-2.0 in its metadata.