Preview. These maps are our reading of public sources and haven't been checked with the projects' maintainers yet.
Plimsoll
Self-hosted sandbox service for agent-written code across pluggable providers (WASM, gVisor, VMs), with a required isolation tier per request, a credential broker that limits API routes, and hashed, optionally signed run records.
Repo created 2026-09-10; v0.23.0 released 2026-10-24. (checked 2026-10-25)
In Agent guardrails
Where it stands apart
- Does it keep a record of agent actions? yes, tamper-evident (signed or hash-chained) (10% of 20 others)
What it shares with most of the community
- Is it actively maintained? active (81% of 21 others)
- How is the main thing licensed? permissive open source (MIT/Apache/BSD) (67% of 21 others)
- Can it run entirely on your own device or infrastructure, without the maker's servers? yes (76% of 21 others)
- Do you need an account to use it? no account (67% of 21 others)
- Who is it for? developers (90% of 21 others)
- What mainly decides whether an action is allowed? rules, policy, or boundaries written in advance (57% of 21 others)
- If the guard itself breaks, is missing, or cannot decide, what happens by default? fails closed: the action does not run (71% of 17 others)
- Which agents does it work with? any agent or process (not limited to a named list) (71% of 21 others)
- What is the main thing it protects? the developer's machine and files (52% of 21 others)
- What is it mainly for? adding checkpoints, review, or evidence (52% of 21 others)
- Is enforcement kept out of the agent's reach? yes, enforced in code or infrastructure the agent cannot change (95% of 21 others)
Not documented
The public sources we read don't say:
- How is it mainly sustained?
- Does it control the agent's outbound network access?
Nearest neighbors
- Drop 80% of 15 shared answers match
- grith 73% of 15 shared answers match
- cMCP (AgenTrust) 71% of 14 shared answers match
Every answer
| Question | Answer | Source |
|---|---|---|
| Is it actively maintained? | active | source 2026-10-25 |
| How is the main thing licensed? | permissive open source (MIT/Apache/BSD) Apache-2.0 | source 2026-10-25 |
| How is it mainly sustained? | Not documented Org account created Sept 2026 with no named maker, funding or pricing; cannot tell. | source 2026-10-26 |
| Can it run entirely on your own device or infrastructure, without the maker's servers? | yes | source 2026-10-25 |
| Do you need an account to use it? | no account Self-hosted Go service; quickstart needs no credentials or account. | source 2026-10-26 |
| Who is it for? | developers | source 2026-10-25 |
| Which shared standard or format does it mainly build on? | none of these (its own format or interface) Own service over pluggable providers (WASM, gVisor, VMs). | source 2026-10-26 |
| Where does it mainly step in? | at the OS or VM boundary (sandbox, container, syscall supervisor) | source 2026-10-25 |
| What mainly decides whether an action is allowed? | rules, policy, or boundaries written in advance Required isolation tier and per-run API grants set in advance. | source 2026-10-25 |
| If the guard itself breaks, is missing, or cannot decide, what happens by default? | fails closed: the action does not run 'Fail-closed server and factory default: with nothing set, nothing runs.' | source 2026-10-25 |
| Which agents does it work with? | any agent or process (not limited to a named list) | source 2026-10-25 |
| In the default setup, where does the agent's work actually execute? | in a local VM, container, or OS sandbox Runs on whatever server you deploy it to; local by default in the quickstart. | source 2026-10-25 |
| What is the main thing it protects? | the developer's machine and files Also keeps API credentials out of guest code. | source 2026-10-25 |
| Does it keep a record of agent actions? | stands apart yes, tamper-evident (signed or hash-chained) Run records bound by content hashes; signed bundles and receipts. | source 2026-10-25 |
| Does it control the agent's outbound network access? | Not documented API access goes through a broker by grant; raw egress depends on provider. | source 2026-10-25 |
| What is it mainly for? | adding checkpoints, review, or evidence Also aimed at 'check a record of what ran'. | source 2026-10-25 |
| Is enforcement kept out of the agent's reach? | yes, enforced in code or infrastructure the agent cannot change | source 2026-10-25 |
Sources
This page was derived from:
- GitHub · github.com/plimsollmark/plimsoll · read 2026-10-25
- Web page · plimsollmark.github.io/plimsoll/ · read 2026-10-25
Are you a maintainer? Claiming and correcting projects is coming soon.