Quickstart

Get Agent Safehouse running in 5 minutes

This guide gets you from zero to a sandboxed agent in about 5 minutes. We’ll install the CLI, generate your first policy, and run a sandboxed coding agent.

Prerequisites

• macOS (Monterey 12.0 or later recommended)
• Terminal access with bash or zsh
• An LLM coding agent installed (Claude, Cursor, Aider, etc.)

Assuming you’ve already installed the safehouse CLI. If not, run:

mkdir -p ~/.local/bin
curl -fsSL https://raw.githubusercontent.com/eugene1g/agent-safehouse/main/dist/safehouse.sh \
  -o ~/.local/bin/safehouse
chmod +x ~/.local/bin/safehouse

Your First Sandboxed Agent

1. Navigate to a project directory

   Safehouse automatically detects your working directory and grants access to it.

   cd ~/myproject
   
2. Run your agent

   Run your agent inside the sandbox:

   safehouse -- claude --dangerously-skip-permissions
   

   The agent can read and write files in your project, use toolchains, and access the network, but cannot touch SSH keys or shell startup files.

3. Verify protection works

   Test that sensitive files are blocked:

   safehouse -- cat ~/.ssh/id_rsa
   

   This should fail with Operation not permitted.

Common Workflows

Grant Additional Directories

safehouse --add-dirs-ro=~/shared-libs -- claude --dangerously-skip-permissions

Enable Docker

safehouse --enable=docker -- claude --dangerously-skip-permissions

Pass Environment Variables

safehouse --env-pass=OPENAI_API_KEY,ANTHROPIC_API_KEY -- aider

Next Steps

Core Concepts

Understand the sandbox model

CLI Options

Explore all available flags

Agent Compatibility

Check setup guides for 14+ agents

Policy Architecture

Deep dive into policy assembly