lite-sandbox gives AI coding agents a bash tool to use instead of their built-in shell, so they can run commands without a permission prompt for each one. Rather than matching commands with regexps or asking an LLM to judge them, it parses every command into an AST and checks the programs, flags, and paths it finds.
curl -fsSL https://github.com/gartnera/lite-sandbox/raw/main/install.sh | shTry it for one session first. This doesn't touch your agent configuration:
lite-sandbox launch claudeIf you like it, configure your agents permanently:
lite-sandbox installThis sets up every supported agent it finds. Run lite-sandbox install --help for options.
All agents share one sandbox config file, so you can switch agents without reconfiguring anything.
The default is strict: only allowlisted commands run, and toolchains like Go, Rust, and uv are opt-in. To start looser and tighten over time, see incremental adoption.
| Claude Code | Codex CLI | opencode v1 | opencode v2 | Crush | Grok Build | pi | |
|---|---|---|---|---|---|---|---|
Sandboxed bash tool, built-in shell blocked |
✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Built-in file tools confined to sandbox paths | --with-tool-hook |
--with-tool-hook |
✅ | ✅ | |||
AST-check the built-in shell (--bash-ast-hook-mode) |
✅ | ✅ | ✅ | ✅ | |||
| Config requests | ✅ | ✅ | |||||
lite-sandbox launch |
✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
- Incremental adoption: enforcement modes, audit reports
- Installation: updating, manual setup, per-agent caveats, hook modes
- Configuration: config file, readable/writable paths, git
- Toolchain profiles: built-in Python, Go, pnpm, Rust, Deno, Flutter, Xcode, uv,
gh, agent-browser - AWS & Docker: brokered AWS credentials, filtering Docker proxy
- SSH: ssh to the hosts you list, filtered ssh agent
- Background processes: long-running commands
- Interactive shell:
lite-sandbox shell, a shell for you that follows the same rules - Security model: validation layers, OS sandbox, known limitations
- Development: building, testing, releases