Run Claude Code, Codex, and Cursor unattended with zero credential-leak anxiety.
Enforced directly by Linux Landlock & Seccomp. No Docker, no root, no daemon.
AI coding agents write impressive code, but running them unprompted on your local workstation is terrifying:
a single hallucination, rogue bash loop, or prompt injection can exfiltrate your ~/.ssh keys, wipe your home directory (rm -rf ~), or leak .env secrets.
VETTO wraps Claude Code, Codex, Antigravity, Cursor, and Aider in an OS-level kernel sandbox before the agent process starts:
- Zero Credential Theft:
~/.ssh,~/.aws,~/.gnupg, and.env*are physically unreadable by the agent. - Zero Destructive Writes: Agent file modifications are strictly confined to your project root and
/tmp. - Zero Performance Penalty: ~4ms startup overhead, 0 MB idle RAM, unprivileged execution without Docker.
Choose your preferred installation method:
# Standalone POSIX script (Linux, macOS, WSL2 — zero dependencies)
curl -fsSL https://raw.githubusercontent.com/shleder/vetto/main/install.sh | bash# Via npm (global binary for Node.js environments)
npm install --global @shledery/vetto# Via Cargo (crates.io — compiled from source)
cargo install vetto --locked# Via Homebrew (macOS & Linux)
brew tap shleder/vetto
brew install vetto
# Or directly: brew install shleder/vetto/vetto# Via Arch Linux AUR (Arch, Manjaro, EndeavourOS)
yay -S vetto # Or: yay -S vetto-git
# Or install built package directly with pacman:
sudo pacman -U vetto-0.2.23-1-x86_64.pkg.tar.zst# Via Chocolatey (Windows)
choco install vetto
# Via Scoop (Windows)
scoop install https://github.com/shleder/vetto/releases/download/v0.2.23/vetto.json# Run one-off without installing (npx)
npx @shledery/vetto doctor# In GitHub Actions CI (unattended agent runs, evals, SWE-bench)
- uses: shleder/vetto@v0.2.23Prebuilt standalone archives with SHA256 checksums and CycloneDX SBOMs for all architectures (x86_64, aarch64, Windows .zip, Linux/macOS .tar.gz) are published on GitHub Releases.
Every release archive is signed with minisign (key id 75ECEC9B5080C590, public key: packaging/release.pub). Verify before running:
# one-time: install minisign (cargo install minisign / apt install minisign / brew install minisign)
minisign -V -p packaging/release.pub -m vetto-linux-x86_64.tar.gz
# → "Signature and comment signature verified"Every release binary is additionally attested with SLSA Build Provenance (Level 3) via GitHub Sigstore. Verify provenance (guide):
gh attestation verify vetto-linux-x86_64.tar.gz --owner shleder
# → "Verification succeeded!"Protect your workstation and run any AI coding agent unattended in seconds:
# Wrap any agent of choice (creates transparent zero-overhead shims):
vetto enable opencode # OpenCode CLI
vetto enable claude # Claude Code
vetto enable codex # OpenAI Codex CLI
vetto enable windsurf # Codeium Windsurf
vetto enable goose # Block Goose
vetto enable cursor # Cursor Agent
vetto enable aider # AiderCreates transparent, zero-latency shims in ~/.vetto/shims/ and configures shell PATH priority.
Vetto provides tailored sandbox presets, project marker auto-detection, and zero-config network allowlists for 20 AI coding tools:
opencode(OpenCode) ·claude(Claude Code) ·codex(OpenAI Codex) ·gemini(Google Gemini)antigravity(Google Antigravity /agy) ·cursor(Cursor Agent) ·aider(Aider) ·cline(Cline)copilot(GitHub Copilot CLI) ·windsurf(Codeium Windsurf) ·continue(Continue CLI) ·goose(Block Goose)openhands(All-Hands OpenHands) ·swe-agent(SWE-agent) ·plandex(Plandex) ·mentat(Mentat)gpt-engineer(GPT Engineer) ·devin(Cognition Devin) ·crust(Crust AI) ·amp(Amp AI)
Launch your agent with full autonomy:
# OpenAI Codex
codex exec --full-auto
# Claude Code
claude --dangerously-skip-permissions
# Antigravity CLI
antigravity run --autonomous
# Aider
aider --yes
# Or run any agent directly inside vetto:
vetto -- claude
vetto -- aider
vetto -- cursor
vetto -- <agent> [args...]Files outside the workspace are blocked, host credentials (~/.ssh, ~/.aws, .env) are masked, and network egress is locked down to provider APIs.
To check wrapped status or unwrap at any time:
vetto enable --status # Check all active shims
vetto disable <agent> # Unwrap agent (e.g. vetto disable codex)Containers were designed for packaging backend microservices—not for interactive developer coding loops. Vetto enforces OS-level kernel confinement directly around your host processes:
| Dimension | VETTO | Docker Containers | Why It Matters |
|---|---|---|---|
| Startup Overhead | ~4ms (CI-gated spawn overhead) | 3.5s – 8.0s | Subagents and test loops execute with zero perceptible latency |
| Daemon | None (zero background processes) | dockerd background service |
No background daemon to crash, stall, or consume idle resources |
| RAM Overhead | 0 MB | 1.5 GB+ (VM / daemon engine) | Leaves all workstation RAM free for compilation and local models |
| Permissions | Unprivileged (no root / no sudo) | Root / docker group (root-equivalent) |
Completely eliminates root-escalation attack surface on your host |
| Host File Sync | Native Filesystem (instant) | Volume mounts (slow I/O, UID sync bugs) | Edits, hot-reloading, and git diffs reflect immediately |
| Kernel Barrier | Linux Landlock + Seccomp-BPF | Namespaces + cgroups | In-process confinement applied before execve, strictly fail-closed |
| Network Egress | Per-Domain Allowlist (api.anthropic.com) |
All-or-nothing bridge | Prevents unauthorized data exfiltration without breaking inference |
Security tooling frequently makes misleading cross-platform claims. Vetto rejects snake oil and is architecturally transparent about what each operating system kernel can and cannot enforce unprivileged.
Vetto establishes an immutable 3-tier boundary architecture:
- Tier 1 (Production-Grade): Linux (Native) and Linux (WSL2). Full kernel isolation via Landlock LSM (ABI v1–v6), Seccomp-BPF (
UnixOnly/AgentMin), rlimit ceilings (AS, NPROC, CPU, FSIZE), stickyNO_NEW_PRIVS, dedicated process groups, private Mount/PID/Network namespaces, and full/procnonce tree-sweep. - Tier 1 via VM (Uniform path): macOS → Linux VM (
mac-vm, Virtualization.framework) and Windows → WSL2 (guest vetto + sync-back). Same Tier-1 stack inside the guest; default on macOS/Windows when the VM is configured, fail-closed with an actionable message when it is not. - Tier 2 (Experimental, maximum-achievable): macOS native (Seatbelt). Seatbelt write isolation, network lockdown (
--net off), pgroup host verification, and group-death sweep. Reads stay broad — the SBPL matrix proves only Shape A runs (all fragmented shapes SIGABRT incl. static Go), so narrow read-deny is closed until Apple fixes dyld (#62). For full read isolation, run inside OrbStack or a Linux VM. - Tier 3 (Preview, maximum-achievable): Windows native (AppContainer/LPAC + Job Objects). Job Objects tree containment with kill-on-close (
JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE), AppContainer process and network-off (--net off) boundary, policy-conditional ceilings. No seccomp or BPF on Windows; syscall filtering and exec-root isolation remain unsupported. Use WSL2 for full Tier 1 kernel boundary.
| Platform / Tier | Filesystem Write | Filesystem Read | Network Namespace | Process Reaping | Secret Overlays per OS | Assurance Status |
|---|---|---|---|---|---|---|
| Linux (Native) Tier 1 (Production) |
100% Kernel Deny (Landlock ABI v1–v6 + R/O Mounts) | 100% Scoped Read (Landlock VFS Inode checks, ~/.ssh / .env blocked) |
Yes (CLONE_NEWNET, loopback-only + local TCP/TLS broker) |
100% PID Namespace (CLONE_NEWPID init teardown + PR_SET_PDEATHSIG + full /proc nonce tree sweep) |
Yes (tmpfs mode-000 and /dev/null bind-mounts over secrets) |
Tier 1 (Proven): Complete hardware & kernel isolation (Landlock, seccomp UnixOnly/AgentMin, rlimits, sticky NO_NEW_PRIVS) |
| Linux (WSL2) Tier 1 (Production) |
100% Kernel Deny (Landlock via WSL2 Linux Kernel) | 100% Scoped Read (Landlock VFS Inode checks) | Yes (CLONE_NEWNET inside WSL2 VM) |
100% PID Namespace teardown + /proc sweep |
Yes (tmpfs mount overlays inside WSL2) | Tier 1 (Production): Recommended path for Windows workstations |
| macOS (Darwin) Tier 2 (Experimental) |
100% Locked (Seatbelt SBPL (allow file-write*) to workspace & /tmp) |
Broad Reads (System / read due to dyld bug; tail deny on known secrets) |
No (Unsupported by Darwin; --net=off via SBPL (deny network*)) |
pgroup host sweep (Watchdog kqueue pdeath_watch + group-death SIGKILL sweep) |
No (VFS overlays unavailable unprivileged; SBPL static deny only) | Tier 2 (Experimental): Write confinement and --net=off network lockdown. Unprivileged read-isolation and syscall filtering unsupported (use OrbStack/Linux VM for full read isolation) |
| Windows Native Tier 3 (Preview) |
Workspace Only (AppContainer DACL + LPAC S-1-15-2-2 write grants) |
ACL Fallback (AppContainer default-deny; partial token restriction) | No (Network namespaces unavailable; --net=off via AppContainer caps) |
100% Job Object (JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE terminates process tree) |
No (No unprivileged mount namespaces; fails closed on collision) | Tier 3 (Preview): Process guardrails with kill-on-close and --net off; no seccomp/BPF or exec-root isolation. Use WSL2 for full kernel boundary |
| Windows Sandbox Tier 3 (VM Isolated) |
VM Isolated (Dedicated virtual disk, mapped read-write folders only) | VM Isolated (Host secrets never mapped into .wsb specification) |
Virtual Switch (Hyper-V vSwitch disabled under --net=off) |
VM Teardown (Hyper-V VM instance termination) | Full Isolation (Physically separated filesystem in disposable VM) | Disposable VM: Hardware-virtualized container (requires Hyper-V) |
Vetto strictly enforces a fail-closed contract across all platforms. If a requested security boundary cannot be guaranteed by the current operating system kernel or runtime environment, Vetto exits immediately with code 125 (EXIT_FAIL_CLOSED). Vetto never silently degrades to an unconfined or insecure execution state.
Apple has deprecated SBPL (sandbox-exec) and Darwin kernels impose severe constraints on unprivileged file-read denial:
- Modern versions of Apple's dynamic linker (
dyld) on macOS 13, 14, and 15 crash withSIGABRTwhen SBPL file-read rules are fragmented across multiple discrete path clauses. - Vetto transparently tracks this platform defect via
vetto doctorunder thesbpl-read-fragmentprobe. - Rather than crashing agent workflows or manufacturing illusory read security, Vetto on macOS grants broad system reads while strictly enforcing 100% filesystem write lockouts,
--net=offnetwork isolation, and process supervision (pgroup host verification and group-death sweep). - Recommendation: If your threat model requires 100% hardware-enforced kernel read-denial of host credentials (
~/.ssh,~/.aws,.env) on macOS, execute Vetto inside OrbStack, a lightweight Linux VM, or Docker devcontainers where Linux Landlock and mount namespaces are available.
Native Windows isolation uses Job Objects and Less Privileged AppContainers (LPAC). While Job Objects guarantee 100% child process termination on close (JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE) and AppContainer isolates network egress (--net off):
- Windows kernels do not support unprivileged mount namespaces, seccomp, or BPF. Syscall filtering and exec-root isolation remain unsupported.
- Native Windows is designated Tier 3 (Preview).
- For production-grade Tier 1 protection on Windows workstations, use WSL2 (
wsl -- vetto ...), which provides the native Linux kernel Landlock LSM, seccomp-bpf, and namespace isolation stack.
Issue #26 tracks the honest per-OS matrix. #62 (macOS read-isolation) is closed as maximum-achievable: the SBPL matrix proves Shape A is the only runnable shape. #63 (Windows hardening) is closed as maximum-achievable: AppContainer/LPAC + Job at ceiling, WFP admin-gated, signing status explicit. Vetto permanently repudiates ungrounded claims of cross-platform parity:
- Platform capabilities are strictly tiered (Tier 1 Linux, Tier 2 macOS, Tier 3 Windows).
- All capability claims are continuously verified in CI via automated red-team matrices and diagnostic doctor probes.
- Pull requests or features claiming parity without underlying OS kernel enforcement proofs will be rejected.
Vetto natively integrates with modern AI coding workflows:
| Agent / Tool | Guide & Details | Setup Command |
|---|---|---|
| Claude Code | Claude Code Guide · Unprompted mode, PreToolUse hook, Anthropic API allowlist |
vetto enable claude |
| Cursor | Cursor Guide · Agent & Composer sandboxing, terminal execution, storage masking | vetto enable cursor |
| Cline | Cline Guide · VS Code extension terminal task isolation, zero-config shims | vetto hook install |
| Aider | Aider Guide · Zero-config network allowlists, git protection, automated tests | vetto enable aider |
| OpenCode & Codex | OpenCode Guide · CLI runners, subagent supervision, and model sandboxing | vetto enable codex |
| Claude Desktop & Codex Desktop | Desktop Integration Guide · Native MCP server (vetto mcp), terminal shims, sandboxed subtools |
vetto mcp · vetto enable |
Trust nothing—verify the sandbox boundary and audit past operations:
# Probe running kernel capabilities (Landlock ABI, seccomp, userns)
vetto doctor
# Show concrete OS remediation steps for missing primitives (Seatbelt, Job Objects, Hyper-V)
vetto doctor --fix
# Additionally verify that every denied path is truly unreachable in a throwaway sandbox
vetto doctor --probe
# Run active leak battery (tests secret paths and loopback isolation)
vetto verify
# Inspect effective policy and test path blocks
vetto policy explain
vetto policy explain --why ~/.ssh/id_rsa
# Inspect intercepted security violations and blocked paths from past sessions
vetto audit
vetto audit --latest
# End-of-session security recap (top denied paths, egress split, intent)
# printed automatically after every session; post-hoc on demand:
vetto audit --latest --recapWhen an agent is blocked from accessing a legitimate project path, Vetto prints an immediate grant command:
vetto allow ./vendor # Grant read+write to a folder
vetto allow --read-only /usr/share/doc # Grant read-only access
vetto allow --net registry.npmjs.org # Allow egress to a package registry
vetto deny ~/.aws/credentials # Explicitly mask a secret fileBeyond transparent vetto enable shims, you can run one-off commands or custom agents directly:
# Auto-detect agent in current workspace and run inside sandbox
vetto
# Explicit command supervision
vetto -- claude -p "fix failing tests"
vetto -- aider --model sonnet
vetto -- codex exec "refactor auth module"
# Security presets: balanced (default) | paranoid | yolo
vetto --preset paranoid -- npm test
# Network modes: off (default) | ask | allowlist:<domains> | strict:<host:port>
vetto --net allowlist:api.anthropic.com,github.com -- cargo check
vetto --net strict:github.com:22 --git-ssh -- git fetch origin
# Explicit sandbox backend: auto (default) | process | win-sandbox (Hyper-V disposable VM)
vetto --backend auto -- npm test
# Terminal UI modes: statusline (default) | full (dashboard) | none (headless)
vetto --tui full -- claude
# Non-interactive CI mode (implies --tui=none and emits structured JSON summary)
vetto --ci -- npm test
# Shadow mode: policy layer logs "would deny" during preflight without blocking
# (Note: kernel sandboxes Landlock/Seatbelt cannot be shadowed)
vetto --shadow -- cargo test
# Output detailed HTML / SARIF audit reports
vetto --report html,sarif --jsonl session.jsonl -- cargo testNote on
--tier: Vetto automatically detects and negotiates the highest available sandbox tier based on kernel capabilities (Tier 1 Linux, Tier 2 macOS, Tier 3 Windows).--tieris not a top-level runner flag (use--backendfor backend selection);--tierexists onvetto shell-env --tierfor shell exports. On Linux, test degraded tiers viaVETTO_FORCE_TIER.
Wrap and isolate third-party Model Context Protocol (MCP) servers (e.g. filesystem tools, API connectors):
# Wrap an external MCP server binary:
vetto mcp wrap --allow ./data --allow-read /usr/share --net off -- <server-binary> [args...]- Windows Path Hardening: Automatically resolves and grants read access to canonical
%SystemRoot%(C:\Windows),System32(verified againstcmd.exe/kernel32.dllto prevent ENV-POISON attacks),%ProgramFiles%, and temporary directories. - Platform Network Boundary: Network egress relay requires Linux network namespaces (
CLONE_NEWNET). On non-Linux platforms (macOS and Windows),vetto mcp wraprequires--net off(default); other network modes fail closed.
Run multiple AI coding agents concurrently, each in an independent sandbox with an interactive split-pane dashboard:
# Run multiple agents defined in a TOML manifest:
vetto multi --manifest vetto-agents.toml
# Or specify multiple named agents directly:
vetto multi --agent coder=claude --agent reviewer=codex- Platform Constraint: The multi-agent orchestrator is fully supported on Unix platforms (Linux and macOS). On Windows,
vetto multiis blocked fail-closed withUnsupportedPlatform: multi-agent.
- No background daemon — zero idle CPU, zero RAM consumption, no service to stall or crash.
- No root / sudo — runs completely unprivileged; cannot escalate host permissions.
- No TLS interception — zero MITM, no custom root certificate authority; moves opaque bytes only.
- No telemetry or tracking — completely private by default. No telemetry or project/user data is ever transmitted. The only network calls vetto itself initiates are short, non-blocking version checks against the npm registry and GitHub Releases (24h cache, 2s timeout, silent offline via cache). Self-update never runs unless explicitly opted in, and never in CI (
VETTO_NO_SELF_UPDATE=1disables everything update-related). - No Docker dependency — instant ~4ms startup directly on your native OS kernel.
Deep Architecture & Kernel Enforcement (Click to expand)
Vetto puts the agent process inside an OS-level sandbox before the agent process starts. The foundational guarantee of Vetto is fail-closed execution:
If the requested boundary cannot be established on the current host,
vettoexits immediately instead of starting the agent. There is no fallback to an unconfined process anywhere in the codebase.
- Landlock ABI Negotiation: Automatically negotiates Landlock ABI versions 1 through 6 with the running kernel. Landlock restricts filesystem operations (
open,read,write,unlink,rename) directly in kernel space. - Seccomp-BPF: Enforces fine-grained syscall restrictions before
execve. Disallowed syscalls receiveEPERMorENOSYS. - Secret Masking (
display_only_deny): Because Landlock is a pure allowlist and cannot subtract subpaths from an allowed directory tree, Vetto masks secret files (such as~/.ssh,~/.aws,~/.gnupg,.env, tokens) by mounting an empty tmpfs or/dev/nullover them on the Linuxfulltier, or by carving them out of generated read allowlists. - Path Resolution: Symlinks and globs are expanded to concrete filesystem paths before rules reach the kernel. Patterns never reach the kernel.
- Network Namespaces: When network filtering is enabled (
--net=allowlist:...), Vetto isolates the child process in a dedicated Linux network namespace with only a loopback device. - Broker Relay: Outbound TCP connections route through an in-process local CONNECT/SOCKS broker.
- DNS Validation & Anti-Rebinding: The host broker performs DNS resolution itself and pins addresses per rule. Any DNS response resolving to private IP ranges (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.169.254) is rejected. - Zero TLS MITM: The broker moves opaque bytes. There is no TLS interception, no custom certificate authority, and no MITM proxy.
- When
vetto enable <agent>creates shims in~/.vetto/shims, recursion barriers (VETTO_WRAPPED,VETTO_SANDBOXED,VETTO_SHIM_ACTIVE) guarantee that subagent tool invocations (such as an agent invokinggit,python, or nested compiler toolchains) resolve directly to real host binaries without recursive supervisor overhead or infinite loops. vetto enablerefuses to overwrite non-Vetto binaries without--force.
Policies merge in a deterministic, strict hierarchy where every TOML struct rejects unknown fields:
Host Global (/etc/vetto/config.toml)
└── User Global (~/.vetto/config.toml)
└── Built-in Profile (default, strict, paranoid)
└── Agent Preset (claude, cursor, aider, cline, codex)
└── Project Policy (./vetto.toml + policy.d/)
└── Local Override (./vetto.local.toml)
└── CLI Overrides (--allow, --net, --limits)
Session Rescue & Diagnostics (Click to expand)
Recover interrupted, frozen, or corrupted agent sessions without losing progress:
# Scan recent sessions
vetto rescue --json scan --limit 25
# Diagnose Claude Code or Cursor sessions
vetto rescue --adapter claude diagnose <session-id>
vetto rescue --adapter cursor snapshot <session-id> --output ./recovered.jsonl
# Rollback a failed repair
vetto rescue rollback --receipt <receipt-path>Adapters supported: claude, cursor, codex. Snapshots are verified with SHA-256 and created strictly outside the original state root.
- Architecture & Startup Order
- Docker vs. Vetto Comparison
- Claude Code Integration
- Cursor Integration
- Cline Integration
- Aider Integration
- Claude & Codex Desktop Integration
- Threat Model
- Network Internals
- Platform Backends
- Exit Codes Reference
- Security Policy · Changelog
Apache-2.0 — see LICENSE and THIRD_PARTY_NOTICES.md.