Skip to content
agentvfs ★ GitHub

Teams letting an AI agent run shell commands or code

Sandboxing agent code execution

Give an AI agent a place to run code where it touches a vault, not your host filesystem, and every command is classified and returns a structured result.

The problem

An agent that can run arbitrary commands against your real filesystem is a liability. You want it to be productive with real tools — git, npm, python — without giving it your working tree.

How agentvfs helps

agentvfs runs each command through avfs proxy exec against a mounted vault. The PolicyEngine classifies the command first, the vault isolates the workspace, and an ExecutionEnvelope reports exactly what changed.

What that looks like in practice

  • The agent works inside a single-file vault, never your host fs.
  • Every top-level command is classified allow / checkpoint / deny / approve before it runs.
  • Standard CLIs run unchanged because the vault mounts as a real directory.
  • For hostile-code threat models, run agentvfs inside a container or microVM.

Try it on this workflow

See the architecture, more use cases, or the guides.