Preview. These maps are our reading of public sources and haven't been checked with the projects' maintainers yet.
Agent guardrails
Tools that keep AI agents from doing damage: sandboxes, permission gateways, command guards, credential protection, audit trails.
22 projects82% active64% build on a shared standardMapped 2026-10-25
What they agree on
- Is it actively maintained? active (82% of 22)
- Can it run entirely on your own device or infrastructure, without the maker's servers? yes (77% of 22)
- Who is it for? developers (91% of 22)
- If the guard itself breaks, is missing, or cannot decide, what happens by default? fails closed: the action does not run (72% of 18)
- Which agents does it work with? any agent or process (not limited to a named list) (73% of 22)
- Is enforcement kept out of the agent's reach? yes, enforced in code or infrastructure the agent cannot change (95% of 22)
What they argue about
How is the main thing licensed?
How is it mainly sustained?
Do you need an account to use it?
Which shared standard or format does it mainly build on?
Where does it mainly step in?
What mainly decides whether an action is allowed?
In the default setup, where does the agent's work actually execute?
What is the main thing it protects?
Does it keep a record of agent actions?
Does it control the agent's outbound network access?
What is it mainly for?
Projects
| Project | Status | What it is |
|---|---|---|
| Airlock | Active | Mac app that runs Claude Code or Codex in a VM on a copy of your project, records every process, file and connection, and lets you apply it… |
| Canary | Active | YC-backed independent tester for agent-written code: boots the change in a clean sandbox, has its own agent try to break every affected flo… |
| Claude Code sandboxing | Active | Claude Code's built-in OS-level sandbox for shell commands (Seatbelt on macOS, bubblewrap on Linux/WSL2) with filesystem limits and a domai… |
| cMCP (AgenTrust) | Active | Confidential MCP gateway: checks every tool call against Cedar policies, optionally inside a hardware TEE the agent and host admin cannot t… |
| Conduct | Active | Governance control plane for agents: one signed policy decides block/warn/audit/inject for every LLM call, shell tool and MCP call across C… |
| container-use (Dagger) | Maintenance | MCP server and CLI from Dagger that gives each coding agent its own container and git branch, so several agents can work in parallel and yo… |
| Daytona | Changed direction | Cloud sandboxes for running AI-generated code (fast-starting OCI-based sandboxes with SDKs, snapshots and GPUs). Formerly AGPL open source;… |
| Drop | Active | Rootless Linux sandbox modelled on virtualenv: disposable environments that reuse your existing distro, hide your real home and secrets, an… |
| E2B | Active | Cloud sandboxes for agents and AI-generated code: Firecracker microVMs started and driven through Python/JS SDKs, with an open-source runti… |
| Geiger | Active | Read-only command (npx geiger-scan) that inventories every AI agent, MCP server, hook, plugin, skill and AI extension on a machine and labe… |
| grith | Active | Linux syscall-level supervisor for coding agents: every file read, command, network call and process spawn is scored; low scores run, high… |
| Invariant Guardrails | Acquired | Rule-based guardrail layer (Python-like rule language) deployed between an app and its LLM provider or MCP servers via the Invariant Gatewa… |
| JitPass | Active | Mac app and CLI that finds plaintext secrets (.env, ~/.aws, shell history, MCP configs), moves them into a Touch ID vault, leaves decoys, a… |
| Noisegate | Maintenance | Differential-privacy gateway exposed as an MCP server: an untrusted agent can only ask aggregate queries, each answered with calibrated noi… |
| numbat (Perplexity) | Active | Endpoint detection and response for AI agents: collects activity from agent hooks, OTLP logs and on-disk session files, runs CEL detection… |
| OpenAI Codex sandbox | Active | The OS-enforced sandbox plus approval policy in Codex CLI, IDE extension and the ChatGPT desktop app: Seatbelt on macOS, bubblewrap on Linu… |
| OpenAPPA | Active | Deterministic, flow-tracking guardrail (Agentic Permissions Policy Algebra): labels everything an agent reads by audience and trust and che… |
| pi pod | Active | Self-hosted server that runs pi coding-agent sessions in isolated sandboxes ('pods'), driven from a CLI or iOS/Android apps, with templates… |
| Plimsoll | Active | Self-hosted sandbox service for agent-written code across pluggable providers (WASM, gVisor, VMs), with a required isolation tier per reque… |
| Talos | Active | Self-hosted personal agent for terminal and Telegram whose deterministic permission kernel rules on every tool call ('the model proposes, i… |
| Truth Firewall | Active | Local gate that runs Codex on a task and only accepts its 'DONE' when user-defined acceptance checks pass, sending failures back for up to… |
| Vultrino | Active | Self-hosted credential proxy: agents get an alias and an action surface, Vultrino injects the real credential server-side, with policy, sco… |
Where they meet
Not mapped yet.
Follow
RSS for this community: projects added, status changes, and later polls and discussions.
Follow the whole community: OPML of every project's own release feed (where we found one) · OPML of every project's Poll Position feed.
The poll
Every project above was answered against these questions. Core questions are shared by all communities; the rest are this community's own.
- Is it actively maintained? core
active · active, but changed direction (pivot, fork, or rename) · maintenance or slowing · dormant, sunsetting, or archived - How is the main thing licensed? core
permissive open source (MIT/Apache/BSD) · copyleft or source-available with restrictions · open parts around a closed core · proprietary or closed source - How is it mainly sustained? core
individual side project, no revenue · individual with revenue (paid app, tier, ads, or donations) · community, foundation, or research · company with a paid product, tier, or ads · company or startup with a free product (no revenue yet) · big company side project - Can it run entirely on your own device or infrastructure, without the maker's servers? core
yes · yes, but it calls a third-party service you choose (your own API key or account) · partly (some features need the maker's servers) · no, it needs the maker's servers · not applicable - Do you need an account to use it? core
no account · optional account · account required - Who is it for? core
developers · non-developers · both - Is there public evidence it's built with AI coding agents? core
yes, the repo shows it (agent instruction files or agent co-authored commits) · yes, the maker says so · no public evidence - Which shared standard or format does it mainly build on? core
Model Context Protocol (MCP) · OpenAI- or Anthropic-compatible LLM API (base-URL proxy) · coding agents' hook interfaces (Claude Code, Codex, Cursor hooks) · OS sandbox primitives (Seatbelt, bubblewrap, Linux namespaces, seccomp) · OCI / Docker container images · none of these (its own format or interface) · not applicable - Where does it mainly step in? approach
in the agent's hooks or command path, just before a command runs · at the tool-call, MCP, or API layer (proxy or gateway) · at the OS or VM boundary (sandbox, container, syscall supervisor) · outside the action path (inventory, records, or checks afterwards) - What mainly decides whether an action is allowed? value
rules, policy, or boundaries written in advance · a person approving in the moment · a model or classifier judging the action · no per-action decision: it isolates, inventories, or records - If the guard itself breaks, is missing, or cannot decide, what happens by default? value
fails closed: the action does not run · fails open: the action runs unguarded · not applicable: it is not in the action path - Which agents does it work with? approach
one specific agent · only a few named agents · any agent or process (not limited to a named list) - In the default setup, where does the agent's work actually execute? approach
directly on the host machine, as usual · in a local VM, container, or OS sandbox · in a remote or cloud sandbox - What is the main thing it protects? value
the developer's machine and files · secrets and credentials · outside systems and data (APIs, databases, money, private records) · the truth of the record (what the agent did or claimed) - Does it keep a record of agent actions? value
yes, tamper-evident (signed or hash-chained) · yes, ordinary logs or a timeline · no, or not a focus - Does it control the agent's outbound network access? approach
yes, deny by default or allowlist by default · yes, but open by default or optional · no - What is it mainly for? value
letting agents run with fewer approvals, safely · adding checkpoints, review, or evidence - Is enforcement kept out of the agent's reach? value
yes, enforced in code or infrastructure the agent cannot change · partly, some of it depends on prompts or settings the agent can reach
Sources
Show HN posts 2026-07-27 to 2026-10-25 in the guardrail kinds (permission gateways, command guards, sandboxes), plus well-known reference projects.
59 sources across 22 projects, read on 2026-10-25. Each project page lists its own. Poll version: core-v4.