webcoyote/sandvault

What it solves

SandVault provides a secure, lightweight way to run AI agents and shell commands on macOS without the overhead of full virtual machines. It prevents AI agents—which often require broad permissions to be useful—from accessing your primary home directory, modifying system files, or accessing mounted drives, thereby reducing the risk of accidental or malicious system changes.

How it works

The tool creates and manages a limited macOS user account and combines this with sandbox-exec to isolate processes. It allows for fast context switching between the host and the sandbox without password prompts. To enable complex interactions, it uses a host-side bridge for headless browser automation (via Chrome DevTools Protocol) and iOS Simulator automation (via an HTTP bridge to xcrun simctl and iosef), allowing sandboxed agents to test web and mobile apps safely.

Who it’s for

Developers and AI researchers who use autonomous coding agents (like Claude Code, OpenAI Codex, or Gemini) and want to execute their commands in a restricted environment to protect their host system.

Highlights

• AI Agent Integration: Built-in support for running Claude Code, OpenAI Codex, OpenCode, Google Gemini, and pi.
• Low Overhead: Uses native macOS user accounts instead of VMs for instant switching.
• Symmetric Workspace: Provides a shared directory (/Users/Shared/sv-$USER) for joint access between the host and sandbox.
• Automation Bridges: Enables sandboxed agents to control Chrome/Lightpanda and the iOS Simulator.
• Flexible Installation: Supports both host-side Homebrew installation and native installation of tools directly inside the sandbox.