canyonroad/agentsh

What it solves

Traditional security controls for AI agents often stop at the tool boundary, meaning they cannot see or control what happens inside a command (like pip install or python script.py) or its subprocesses. agentsh provides a secure execution gateway that intercepts and enforces policies on file, network, process, and signal activity at runtime, ensuring that even hidden work done by subprocesses is governed and audited.

How it works

agentsh acts as a drop-in shell/exec endpoint that sits under an agent's tooling. It intercepts system-level events and passes them through a policy engine that can allow, deny, approve (requiring human intervention), audit (log), soft_delete (quarantine), or redirect (swap a command or path for a safer alternative).

Key technical components include:

• Runtime Enforcement: Uses system-level primitives (like seccomp, Landlock, eBPF, and FUSE) to monitor and control activity.
• I/O Visibility: Tracks file operations, DNS/network connections, PTY activity, and process lifecycles.
• Specialized Proxies: Includes an embedded PostgreSQL proxy for per-statement SQL policy enforcement and an LLM proxy for DLP redaction and usage tracking of API requests.
• Shell Shim: Can be installed into containers to route all shell activity through the policy engine.

Who it’s for

Developers and operators deploying AI agents that need to execute arbitrary code in environments where security, auditability, and strict runtime control are required, particularly in CI/CD pipelines or sandboxed container environments.

Highlights

• Steering via Redirection: Instead of just denying an action, it can redirect an agent to a safer command or workspace path, guiding it toward the correct behavior.
• Deep Visibility: Captures structured audit events for every file, network, and process operation, including those from subprocesses.
• DLP and LLM Proxy: Intercepts LLM API calls to redact PII and track token usage before requests reach the provider.
• Database Governance: Provides granular, per-statement access control for PostgreSQL databases.
• Workspace Checkpoints: Allows creating snapshots of the workspace to recover from destructive agent operations.
• Profile-then-Lock: Can generate restrictive policies automatically by observing a session's behavior and locking future runs to those observed patterns.