agentsh | Agent Shell Security for AI Agents

agentsh ("agent shell") is a policy-enforced execution gateway that intercepts file, network, and process activity at runtime—no matter what the prompt, tool output, or user says.
Models are probabilistic. Execution must be deterministic. agentsh enforces policy at the syscall level.
These sandboxes run your agent. AgentSH secures what happens inside.
Prompt injection, jailbreaks, and plain old mistakes all look the same at the execution layer. agentsh evaluates every action at the moment it happens—allow, deny, approve, or steer—independent of prompt compliance.
Prompts can drift. Policies don’t. Enforcement happens at the system call level—where files open, sockets connect, and processes spawn.
Every file, network, and process operation is captured—including subprocess trees—so you can understand what really happened.
Risky operations pause for explicit confirmation. Agents can request, but humans (or CI policy) decide.
agentsh doesn't trust intent. It enforces policy where intent becomes reality.
Place agentsh under your agent or harness. It intercepts syscalls, applies your policy, and emits structured events you can route anywhere.
ARM64, Windows, and full asset list on the releases page.
The best way to use agentsh in development is to run your coding agent as a child process. All shell commands the agent spawns will be intercepted and policy-checked automatically.
Containers limit where an agent can cause damage—but inside the container, it's still a free-for-all. The agent can read any file, access your env vars and secrets, hit any endpoint, and delete your workspace. agentsh adds the missing layer: control over what the agent can actually do.
Install a lightweight shell shim in your container. The agent thinks it's calling /bin/bash—but every command routes through agentsh and gets policy-checked.
Harnesses like Claude Code or Cursor include built-in tools that bypass the shell—file edits, execution, and network requests. Run the harness itself under agentsh to govern everything end-to-end.
The gotcha: When a harness writes a file via an internal tool (e.g., str_replace), no shell is spawned. If you only shimmed bash, you’d miss it.
Define what's allowed, what needs approval, what gets steered, and what's blocked—using simple YAML you can version, review, and ship.
Great default for local work. Workspace access, env/secrets/SSH denied, and a tight network allowlist.
Designed for CI runners. Deny outside workspace and restrict network to registries and required endpoints.
For running unknown code. Default deny, explicit allowlists, approvals, and soft-delete quarantine.
A deny often triggers “try harder.” Different flags, different paths, Base64 encoding, creative workarounds. You’ve seen it: dozens of retries, wasted tokens, and the task still doesn’t complete.
Steering keeps work moving. The agent sees success and proceeds. You decide where writes land, which endpoints get hit, and what command is truly executed—without breaking the flow.
Open source — get the code on GitHub. For enterprise rollout, security questions, or anything else, drop us a line.
We read everything. Replies usually within one business day.
Prefer another channel? Send the form and we will route it.
Open source. Practical by default. Built for real agent runs—where mistakes are expensive.
Need fleet-wide policy, SIEM export, or a kill switch? Explore Watchtower →
Built by Canyon Road