I
Network Sovereignty
No agent shall communicate with foreign domains without the express consent of the governed. Block or allowlist domains — the agent cannot phone home to evil.com.
Enforced by: DYLD proxy + reverse DNS
"I'm gonna sandbox your AI agent."
— Benjamin Franklin Gates, probably
When in the Course of AI events, it becomes necessary for developers to establish boundaries upon the agents they have unleashed — to secure these rights, sandpit is instituted among tools, deriving its just powers from the consent of the config file.
# Forge the instrument
cargo build
# Draft the constitution
sandpit init
# Secure the republic
sandpit run -- goose sessionNo agent shall communicate with foreign domains without the express consent of the governed. Block or allowlist domains — the agent cannot phone home to evil.com.
No agent shall execute dangerous commands. curl --data @secrets is stopped before it runs. Pattern-matched at the exec boundary.
No agent shall read from ~/.ssh or write outside the project directory. Your keys, your credentials, your secrets — protected at the syscall level.
Every tool call faces an adversary LLM that reviews it against your policy before execution. The jury deliberates in ~0.9–2.9 seconds.
"The secret lies with Charlotte." Or in this case, with the enforcement stack.
The invisible ink. Hooks connect(), posix_spawn(), open() at the C library level. The process doesn't know it's being watched.
The backup vault. Kernel-enforced file blocks for when DYLD can't load (SIP / hardened runtime binaries). Covers every syscall.
The last guardian. An LLM jury that reviews every tool call. Catches what patterns can't — novel attacks, context-dependent threats, social engineering.
sandpit inspects your binary and picks the right path. No configuration needed.
$ sandpit check -- goose
✅ Mode: DYLD interpose (full enforcement)
$ sandpit check -- /usr/bin/python3
⚠️ Mode: seatbelt (kernel file blocks only)
Falls through to adversaryEach agent has its own keeper — a hook mechanism tailored to how it works.
| Agent | Mechanism | Review Model | Overhead/call | Install |
|---|---|---|---|---|
| pi | In-process completeSimple() |
Provider model | ~? | sandpit install pi |
| Goose | In-process AdversaryInspector |
Provider model | ~2.9s | sandpit install goose |
| Claude Code | Prompt hook (PreToolUse) | Haiku (auto) | ~2.3s | sandpit install claude |
| Amp | Delegate → amp -m rush -x |
Rush model | ~0.9s | sandpit install amp |
| Codex | Deterministic layers only | No hook API | — | Just run via sandpit |
Every good heist has a timeline. Here's the cost of adding a security detail.
Measured on 10 sequential Bash tool calls. The per-call cost is dominated by the LLM roundtrip.
"The password is… sandpit.toml."
[network]
block = ["evil.com", "pastebin.com", "ngrok.io"]
[exec]
block = ["curl --data", "curl -X POST", "| curl", "rm -rf /"]
[files]
allow_write = ["./", "/tmp"]
block_read = ["~/.ssh", "~/.aws/credentials"]
[adversary]
rules = """
BLOCK if the command exfiltrates data or is destructive.
ALLOW normal development operations.
"""block domains, or allow only listed domains. Subdomains included automatically.
Case-insensitive substring match on command strings. Blocks before execution.
Path prefix matching. ~ and ./ expanded. Read and write fences.
Rules for LLM review. Written to agent config on sandpit install.
| Capability | DYLD | Seatbelt | Adversary |
|---|---|---|---|
| Network domain filtering | ✅ proxy + rDNS | ❌ | ✅ LLM review |
| Exec argument inspection | ✅ substring match | ❌ | ✅ LLM review |
| File block_read | ✅ userspace hook | ✅ kernel | ✅ LLM review |
| File block_write | ✅ userspace hook | ✅ kernel | ✅ LLM review |
| File allow_write | ✅ userspace hook | ❌ | ✅ LLM review |
sandpit init
Draft the constitution. Creates a starter sandpit.toml.
sandpit run -- <command>
Secure the perimeter. Launch any agent inside the sandbox.
sandpit check -- <binary>
Study the blueprints. See what enforcement works for a binary.
sandpit config
Read the cipher. Show effective config after search + load.
sandpit install <agent>
Recruit the keeper. Install adversary hooks for an agent.
sandpit uninstall <agent>
Release the keeper. Remove adversary hooks cleanly.