Daemon-less kernel sandbox for local AI coding agents
vetto, created by Shleder, is a daemon-less sandbox that confines AI coding agents and prevents unintended code execution on a developer machine. The tool enforces kernel-level isolation around agent activity and exposes policy-driven controls for filesystem, network, and resource access. It targets software developers, security researchers, and organizations running autonomous coding agents who need a local security layer to reduce risks from prompt injection and uncontrolled execution.
What tasks can you actually use it for?
The tool is built to contain agentic workflows that interact with the host, specifically command-line agents that follow the Model Context Protocol (MCP) or similar interfaces. Use cases include running code-generation agents, automated refactoring tools, and scripted assistants while preventing unintended writes, secret exfiltration, or unsolicited network calls. Vetto fits into the stage of development where generated code executes on the local machine and requires a safety boundary.
How dependable are the kernel-level protections in practice?
Vetto enforces policies with operating-system primitives: on Linux it uses Landlock, namespaces, and seccomp-BPF; on macOS it integrates with Seatbelt. The design emphasizes a fail-closed enforcement model and low runtime overhead by applying restrictions at kernel-level instead of relying on a long-running container daemon. Windows support is described as experimental and maps to an AppContainer-style mechanism.
What policy controls and inputs does it accept?
Policy configuration is file-based and declarative, using TOML for granular rules. The policy language covers filesystem roots, deny-paths for sensitive data, domain-specific network allowlisting or full network disablement, and execution constraints such as timeouts and process limits. These inputs let teams constrain I/O, block secret locations, and limit an agent's runtime privileges before the agent executes.
Is it practical to add to a developer workflow?
The tool installs through standard developer channels, for example an npm global package or a Homebrew tap on macOS, and does not require Docker or root privileges to run. That reduces infrastructure changes for local development. Adopting it requires writing and testing TOML policies and some familiarity with OS sandbox primitives, making it most suitable for teams comfortable with command-line tooling and policy authoring.
Who should adopt it, and what to watch for?
The tool is a pragmatic option for developers and organizations running agentic tools such as Claude Code, Cursor, and Aider, and it is recognized within the AI developer community for addressing agent risk. Practical advice: test policy files on non-sensitive projects first and keep manual code review for high-risk or production runs to catch behavior the sandbox does not cover.
