Preview. These maps are our reading of public sources and haven't been checked with the projects' maintainers yet.
Airlock
Mac app that runs Claude Code or Codex in a VM on a copy of your project, records every process, file and connection, and lets you apply its changes file by file.
airlock.sorrel.systems/Active
Show HN posts 2026-10-12 and 2026-10-22 (Mac App Store release); site live 2026-10-25. (checked 2026-10-25)
In Agent guardrails
Where it stands apart
- How is the main thing licensed? proprietary or closed source (0% of 21 others)
- How is it mainly sustained? individual side project, no revenue (25% of 20 others)
- Can it run entirely on your own device or infrastructure, without the maker's servers? partly (some features need the maker's servers) (14% of 21 others)
- What mainly decides whether an action is allowed? no per-action decision: it isolates, inventories, or records (24% of 21 others)
- Which agents does it work with? only a few named agents (0% of 21 others)
- Does it control the agent's outbound network access? yes, but open by default or optional (25% of 16 others)
What it shares with most of the community
- Is it actively maintained? active (81% of 21 others)
- Do you need an account to use it? no account (67% of 21 others)
- Who is it for? developers (90% of 21 others)
- If the guard itself breaks, is missing, or cannot decide, what happens by default? fails closed: the action does not run (71% of 17 others)
- What is the main thing it protects? the developer's machine and files (52% of 21 others)
- Is enforcement kept out of the agent's reach? yes, enforced in code or infrastructure the agent cannot change (95% of 21 others)
Nearest neighbors
- Drop 65% of 17 shared answers match
- pi pod 63% of 16 shared answers match
- Plimsoll 60% of 15 shared answers match
Every answer
| Question | Answer | Source |
|---|---|---|
| Is it actively maintained? | active | source 2026-10-25 |
| How is the main thing licensed? | stands apart proprietary or closed source No source repository; distributed via Mac App Store and Homebrew cask. | source 2026-10-25 |
| How is it mainly sustained? | stands apart individual side project, no revenue Solo maker Simon Maddox; free on Mac App Store and Homebrew; no pricing or sponsors found. | source 2026-10-26 |
| Can it run entirely on your own device or infrastructure, without the maker's servers? | stands apart partly (some features need the maker's servers) The VM runs locally; the agents use Anthropic/OpenAI hosted models. | source 2026-10-25 |
| Do you need an account to use it? | no account Privacy policy: no account with us. Agents need your own Claude or ChatGPT sign-in, not the maker. | source 2026-10-26 |
| Who is it for? | developers | source 2026-10-25 |
| Which shared standard or format does it mainly build on? | none of these (its own format or interface) Own Mac app around a VM; no shared format named. | source 2026-10-26 |
| Where does it mainly step in? | at the OS or VM boundary (sandbox, container, syscall supervisor) | source 2026-10-25 |
| What mainly decides whether an action is allowed? | stands apart no per-action decision: it isolates, inventories, or records Turns approval prompts off and contains the agent; a person reviews the resulting diff per file. | source 2026-10-25 |
| If the guard itself breaks, is missing, or cannot decide, what happens by default? | fails closed: the action does not run | source 2026-10-25 |
| Which agents does it work with? | stands apart only a few named agents Runs Claude Code or Codex only (airlock run claude / codex). | source 2026-10-26 |
| In the default setup, where does the agent's work actually execute? | in a local VM, container, or OS sandbox | source 2026-10-25 |
| What is the main thing it protects? | the developer's machine and files 'Your real folder is never shared with it.' | source 2026-10-25 |
| Does it keep a record of agent actions? | yes, ordinary logs or a timeline Timeline of processes, files and connections. | source 2026-10-25 |
| Does it control the agent's outbound network access? | stands apart yes, but open by default or optional Unknown hosts are flagged; you can lock a session to a host list. | source 2026-10-25 |
| What is it mainly for? | letting agents run with fewer approvals, safely 'Airlock turns the prompts off.' | source 2026-10-25 |
| Is enforcement kept out of the agent's reach? | yes, enforced in code or infrastructure the agent cannot change | source 2026-10-25 |
Sources
This page was derived from:
- Web page · airlock.sorrel.systems/ · read 2026-10-25
Are you a maintainer? Claiming and correcting projects is coming soon.