Warning
BlastShield is still in beta and may contain bugs. Validate it in a non-production environment before depending on it for safety-critical workflows.
Sandbox AI coding agents with kernel-level protection against destructive cloud CLI commands.
Uses macOS sandbox-exec (Apple Seatbelt) to enforce filesystem restrictions that prevent AI agents from executing destructive operations — terraform destroy, gcloud compute instances delete, aws s3 rb, az group delete, kubectl delete namespace — even when running with --dangerously-skip-permissions or equivalent unrestricted modes.
brew install cdrxyz/tap/blastshieldgit clone https://github.com/cdrxyz/blastshield.git
cd blastshield
export PATH="$PWD:$PATH"# Run Claude Code sandboxed
blastshield claude --dangerously-skip-permissions
# Run Codex sandboxed
blastshield codex --full-auto
# Run OpenCode sandboxed
blastshield opencode
# Run Grok Build sandboxed
blastshield grok --always-approve
# Run Conductor sandboxed
blastshield -p gui-app open /Applications/Conductor.appFull documentation is available at cdrxyz.github.io/blastshield:
- Getting Started — installation, first run, configuration
- Conductor — supported Conductor launch workflow and workspace policy
- Architecture — two-layer defense model, how sandbox-exec and guard work together
- Profiles — built-in and custom SBPL profiles, auto-detection
- Guard — command-argument filtering, Touch ID prompts, install/uninstall
- Layering — composing BlastShield with sandvault, safehouse, and other tools
- Whitepaper — formal write-up with PDF download
- Changelog — recent releases and fixes
- FAQ — common questions, caveats, and troubleshooting
Read Shrink the Blast Radius — why BlastShield exists and why your AI agent has no chill.
Apache License 2.0