eugene1g/agent-safehouse

Sandbox your local AI agents so they can read/write only what they need

What it solves

It provides a security layer for LLM coding agents running on macOS, preventing them from accessing sensitive files or system integrations they don't need. It addresses the risk of agents accidentally or intentionally accessing private data outside their designated workspace.

How it works

Safehouse uses sandbox-exec to implement a "deny-first" security model. It employs composable policy profiles that start by blocking all access and then explicitly allow only the necessary paths and permissions. It also handles macOS-specific path resolution (like symlinks in /etc) and can auto-detect Git worktrees to ensure agents have the required metadata access without compromising the system.

Who it’s for

Developers using LLM-based coding agents on macOS who want to restrict the agent's environment to a least-privilege model to reduce security risks.

Highlights

  • Deny-first approach: Starts with a total block and allows only specific, required access.
  • Composable profiles: Includes pre-built profiles for popular coding agents and app-hosted workflows.
  • macOS integration: Specifically designed for macOS using sandbox-exec and handles system path resolution.
  • Flexible overrides: Supports machine-specific local overrides and the ability to add read-only directories via command-line flags.