nikvdp/cco

What it solves

cco provides a secure, sandboxed environment for running AI coding agents like Claude Code and OpenAI's Codex. It eliminates the trade-off between productivity (using autonomous modes that skip permission prompts) and security (preventing agents from accessing sensitive system files or executing dangerous commands via prompt injection).

How it works

cco acts as a wrapper that automatically selects the most efficient sandboxing method available on the host system:

• Native Sandboxing: Uses sandbox-exec on macOS and bubblewrap on Linux for lightweight, fast isolation.
• Docker Sandboxing: Falls back to Docker containers when native tools are unavailable, providing stronger filesystem isolation.

It manages project files, Git worktrees, and network access so the agent can function normally, while restricting access to the rest of the host system. It also handles credential management (e.g., macOS Keychain) and terminal signal forwarding (SIGWINCH) to ensure the interactive experience feels native.

Who it’s for

Developers who use terminal-based AI coding agents and want to run them in autonomous mode without compromising their machine's security.

Highlights

• Zero Configuration: Works as a drop-in replacement for the claude command.
• Multi-Backend Support: Automatically switches between native OS sandboxing and Docker.
• IDE Independent: Works in any terminal without requiring VS Code or devcontainers.
• Granular Access Control: Supports --allow-readonly, --deny-path, and --add-dir to precisely control what the agent can see and modify.
• Credential Integration: Seamlessly extracts credentials from the macOS Keychain.
• Versatile Wrapper: Can be used to sandbox any arbitrary CLI tool via the --command flag.