Sandboxing GitHub Repositories (2026) · Open Source Tools

Agent Substrate: the core system

Run agents like Hermes, LangChain Deep Agents, and OpenClaw more securely inside NVIDIA OpenShell with managed inference

A secure Python sandbox, written in Rust, for code written by AI.

🛠️ The meta-harness for AI agents — scaffold your own focused, branded agent harness with its own npx CLI, MCP server, memory, learning loop, and witness-signed releases. Works with Claude Code, Codex, pi.dev, Hermes, OpenClaw, and RVM (hardware-isolated sandbox).

Brig: run coding agents in a microVM sandbox - the Go cli (brig) and session daemon (brigd)

Rebuild software from behavior, not source code. An MCP-powered toolkit for black-box observation, clean-room reimplementation, and behavioral verification.

AI agent builder with a VM at its heart. Every agent gets its own microVM sandbox to install software, run code and use the GPU in. Python, Node.js and Rust.

Alter Ego: run Linux desktop applications under a different local user

Run Windows and Linux programs on Windows, Linux and Android. A user-mode NT and Linux kernel emulator with WHP/KVM acceleration.

The lightest sandbox. A process-based sandbox for Linux, no container, no VM, no privilege, no prompt injection

Run AI agents in a sandbox that restricts what they can execute, read, write, and reach on the network. Box combines OS isolation with default-deny Dogwood policies and credential injection that keeps secrets outside the agent. Written in Rust. Supports macOS on Apple silicon, with Linux support planned.

Generate sandboxes for C/C++ libraries automatically