nolabs-ai/nono

agent runtime security - zero trust, zero setup, zero latency agent sandboxing

nono – Secure Runtime for AI Agents

What it is

  • A lightweight, single‑binary runtime that sandboxes AI agents (Claude, Copilot, LangChain‑based bots, etc.) and the tools they invoke.
  • Provides kernel‑enforced isolation, credential injection, network allow‑lists, supply‑chain attestation, audit logs, and rollback.
  • Works on macOS, Linux and Windows (WSL2) without needing root privileges.

Key capabilities

Area How nono helps
Tool sandbox Each external command runs in an ephemeral container with explicit file, network, env‑var and credential permissions.
Credential injection API keys are kept outside the agent sandbox; a proxy injects them only to approved tools, optionally using “phantom tokens”.
Network control Domain filtering and L7 HTTP method/path rules let you restrict where an agent can talk.
Supply‑chain trust Uses Sigstore to verify the provenance of skill files, hooks and other assets before they are executed.
Audit & rollback Tamper‑evident logs of every session, with optional signing; file changes can be reverted to verified snapshots.
Policy‑as‑code Policies live in composable JSON profiles, separate from the agent, and can be layered (e.g., pi‑local extends nolabs‑ai/pi).

Typical workflow

  1. Install – one‑line script, Homebrew, or Nix flake (pre‑built or built from source).
  2. Pick an agent – nono search pi, nono pull … pulls a packaged agent profile from the registry.
  3. Run – nono run --profile <profile> -- <agent‑cmd> launches the agent inside the sandbox, showing the exact permissions that will be applied.
  4. Customize – nono profile init … creates an editable JSON profile to tweak filesystem, network, or credential rules.
  5. Publish – developers can package and share their own agent profiles via the registry.

Who might use it

  • Developers building LLM‑powered assistants who need to protect secrets and prevent malicious tool execution.
  • Ops / security teams wanting to run AI agents in CI/CD pipelines, containers, or micro‑VMs with zero‑trust guarantees.
  • Enterprises that require audit trails and supply‑chain verification for AI‑driven automation.

Language support

  • Core runtime is written in Rust.
  • Provides FFI bindings for Rust and Python, with a separate nono-py repository for Python integration.

Where to learn more

  • Full documentation: https://nono.sh/docs
  • Quick install guide in the README (curl script, Homebrew, Nix, Debian/Ubuntu, Fedora, Arch, RHEL, openSUSE, WSL2).
  • Community chat: Discord link in the badge.

License

  • Apache‑2.0, allowing commercial use and modification.

In short, nono is not an AI model itself but a security‑focused runtime that lets you run existing LLM agents safely, with fine‑grained sandboxing, credential handling, network policies, and audit capabilities.

Related

  • Project
    opensandbox-group/OpenSandbox

    OpenSandbox provides isolated, secure environments on your own infrastructure for AI agents to execute code, run commands, and operate browsers or desktops.

  • Project
    getkern/kern

    A daemonless, rootless container runtime designed to securely execute AI-generated code and agent tool calls in isolated, kernel-enforced environments.

  • Project
    nikvdp/cco

    cco is a sandboxing wrapper for AI coding agents (Claude Code, Codex, etc.) that runs them in an isolated environment to protect your system from prompt injections and accidental damage, while preserving a seamless terminal experience.

  • Project
    hezo-ai/hezo

    An open-source server and web app for running teams of AI agents organized like a company, featuring sandboxed execution and secure secret management.

  • Dispatch
    Securing AI Agents with Isolated Docker Sandboxes

    An exploration of agent-sandbox, a tool designed to run AI coding agents within isolated Docker containers to prevent unauthorized system access and ensure execution safety.