cplt

Kernel-enforced sandbox for AI coding agents. cplt wraps GitHub Copilot CLI, OpenCode, Gemini CLI, Antigravity CLI, Pi, Claude Code, goose, DeepSeek Harness, or any shell, so the agent can write code but cannot steal credentials, push to main, merge PRs, or exfiltrate secrets.

• macOS: Apple Seatbelt/SBPL via sandbox-exec
• Linux: Landlock LSM + seccomp-BPF + optional Bubblewrap namespace isolation (kernel 5.13+, full network filtering on 6.7+)
• Windows: no native support. There is no Windows sandbox backend. Run cplt inside WSL2, where it is an ordinary Linux install and the Microsoft kernel ships Landlock. See Windows (WSL2) setup.

Why cplt?

AI agents execute arbitrary code. A compromised agent, whether through prompt injection, a supply chain attack, or a malicious MCP server, can read ~/.ssh, push to main, merge PRs, or exfiltrate your code, unless the OS itself says no.

cplt gives you kernel-level enforcement with team-configurable policy:

• Per-repo policy in .cplt.toml, committed to version control, so it is tamper-proof and auditable
• Deny by default for credentials, secrets, and sensitive files
• Command-level git and gh interception: pushes to the default branch, force pushes, merges, and releases are blocked, feature branches stay open
• Outbound network filtering with an audit log
• No Docker, no VMs. One binary that runs on a locked-down laptop
• Zero-config start for developers, with escape hatches when a build genuinely needs one

Table of contents

• Quick start
• What it blocks
• How cplt compares
• Install
• Usage
• Configuration
• Architecture
• Security
• Network and proxy
• Command guards
• Known impacts
• Limitations
• Contributing
• References

Detailed docs: Configuration · Proxy & domain filtering · gh command guard · git command guard · Known impacts · Security details · Security model

Quick start

brew install navikt/tap/cplt   # macOS. On Debian or Ubuntu, see apt below
cplt --shell-install        # make 'copilot' run sandboxed (persistent)
                            # --agent opencode for any other agent
cplt doctor                 # check your environment
cplt -- -p "fix the tests"  # run Copilot in sandbox

Other agents and sandbox commands:

cplt --agent opencode                       # OpenCode (Copilot subscription)
cplt --agent opencode --pass-env ANTHROPIC_API_KEY  # third-party provider
cplt --agent shell                          # interactive sandboxed shell (no AI)
cplt exec -- npm install                    # sandbox any command directly
cplt exec -c "npm install && npm test"      # compound commands in sandbox
alias npm="cplt exec -- npm"               # sandboxed npm for every invocation

Team rollout

# 1. Generate per-repo policy
cplt init --write

# 2. Developers approve on first run
cplt trust accept --all

# 3. Tune the command guards (both block by default)
cplt config set git_guard.protect_default_branch_only false # block every push, not just main
cplt config set git_guard.mode warn                         # observe instead of blocking

What it blocks

The sandbox blocks access to credentials and secrets in the kernel. Command guards block destructive operations. Every restriction applies to the agent and to every process it spawns.