nikvdp/cco

cco is a security wrapper for AI coding agents like Claude Code and OpenAI's Codex. It runs these agents inside a sandbox so you can let them work autonomously (with --dangerously-skip-permissions-style flags) without risking your whole system if they get tricked by a malicious prompt or make a mistake.

Why it matters: AI coding agents often need broad access to your files and shell to be useful. But that also means a prompt injection (e.g., from a malicious webpage they read) could make them delete files, exfiltrate data, or run arbitrary commands. cco puts a barrier between the agent and your real machine.

How it works:

• It automatically picks the best sandboxing method: native OS sandboxing (sandbox-exec on macOS, bubblewrap on Linux) when available, otherwise Docker.
• The agent runs inside that sandbox with only the project directory and explicitly shared paths mounted. The rest of your filesystem is either read-only or hidden.
• Credentials (like Claude's auth from macOS Keychain) are securely injected at runtime, never baked into images.
• It preserves terminal features (resizing, signals) so the agent's UI feels native.

Key features:

• Zero config: Install once, then just type cco instead of claude.
• Multiple agents: Supports Claude Code, OpenAI's Codex, OpenCode, and others.
• Flexible sandboxing: Choose native or Docker, or let it auto-detect.
• Persistent sessions: Optionally reuse a container filesystem across runs (--persist).
• Custom mounts: Share extra directories read-only or read-write, deny specific paths, or create exceptions.
• Generic wrapper: Use cco --command to sandbox any CLI, not just AI agents.

Quick start:

curl -fsSL https://raw.githubusercontent.com/nikvdp/cco/master/install.sh | bash
cco "write a hello world script"

It's designed to be invisible — you get the speed of fully autonomous AI coding, but with a safety net that keeps your system intact.