Main

A practical rollout for Safehouse:

1. Start with a single agent integration and a single repo/workdir.
2. Add only the directories the agent truly needs via CLI options (read-only where possible).
3. Keep machine-specific exceptions in an appended local profile so team repos stay clean.

Safehouse is not a perfect boundary, but it materially reduces blast radius when experimenting with more autonomous modes.

README excerpt (verbatim)

Agent Safehouse

Sandbox your LLM coding agents on macOS so they can only access the files and integrations they actually need.

Agent Safehouse uses sandbox-exec with composable policy profiles and a deny-first model. It includes profiles for major coding agents and app-hosted agent workflows while keeping normal development usage practical.

Install

Homebrew:

brew install eugene1g/safehouse/agent-safehouse

Standalone script:

mkdir -p ~/.local/bin
curl -fsSL https://github.com/eugene1g/agent-safehouse/releases/latest/download/safehouse.sh \
  -o ~/.local/bin/safehouse
chmod +x ~/.local/bin/safehouse

Philosophy

Agent Safehouse is designed around practical least privilege:

• Start from deny-all.
• Allow only what the agent needs to do useful work.
• Keep developer workflows productive.
• Make risk reduction easy by default.

It is a hardening layer, not a perfect security boundary against a determined attacker.

HOME access by default

HOME_DIR is used to render precise home-relative rules in the assembled policy. By itself, it does not grant recursive read access to your home directory.

Default Safehouse behavior is narrower:

• metadata-only traversal on /, the path to $HOME, and $HOME itself so runtimes can probe explicitly allowed home-scoped paths
• directory-root reads for ~/.config and ~/.cache so tools can discover XDG locations
• a few explicit home-scoped files/directories from always-on profiles, such as git/ssh metadata and shared agent instruction folders

In practice, stat "$HOME" can succeed while ls "$HOME" and cat ~/secret.txt still fail unless a more specific rule grants that path.

If you want to remove even the default home exceptions, use --append-profile; appended profiles load last, so their deny rules can narrow earlier defaults.

Built-In System Path Resolution

Safehouse's built-in profiles/* modules may include macOS compatibility paths such as /etc, /private/etc/resolv.conf, or /private/etc/localtime.

FAQ

Q: What does Safehouse sandbox? A: It uses macOS sandbox-exec profiles to restrict what the agent process can access (per README).

Q: Is it deny-first by default? A: Yes—README describes a deny-first model with composable profiles.

Q: How do I install it? A: Use brew install eugene1g/safehouse/agent-safehouse or the standalone script path from the README.