Free · Open Source · MIT

Three fences.
Total containment.

NockLock is the open-source CLI that sandboxes AI agents with filesystem, network, and secret fencing. Watch a real agent try (and fail) to leak. Every blocked action logged. Every fence configurable.

Install NockLock View on GitHub ↗

$ brew install nocktechnologies/tap/nocklock

The fences

Three boundaries.
Zero exceptions.

Each fence is independently configurable, scriptable via TOML, and audited to a local SQLite log every time an agent crosses it.

Filesystem 01 · fs

Allowlist the directories your agent can touch. Everything else returns ENOENT. Symlink escape attempts are logged and blocked.

[fence.filesystem]
allow = ["~/Dev/project", "~/.claude"]
deny  = ["~/.ssh", "~/.aws"]
mode  = "strict"

Network 02 · net

Default-deny outbound. Allowlist exactly the hosts your agent needs. DNS resolution and TLS SNI are both inspected.

[fence.network]
allow = ["api.anthropic.com"]
deny  = ["*"]
on_block = "log_and_abort"

Secrets 03 · secret

Scan env, scan files, redact on read. The moment an AWS key or .pem touches the agent's context, the session aborts.

[fence.secrets]
scan_env   = true
deny_files = [".env*", "*.pem"]
on_block   = "log_and_abort"

How it works

Wrap any agent.
In four steps.

NockLock is a single binary. No daemon, no kernel module. It wraps your existing agent CLI in a fenced sandbox and logs everything to SQLite.

Define your fences in TOML

One file per agent. Filesystem allowlist, network allowlist, secret rules. Commit it to your repo so your fleet ships with policy baked in.

Wrap your agent command

nocklock run claude-code "fix bug" runs the agent inside the sandbox. Works with Claude Code, Codex, Cursor agents, anything you can run from a shell.

Every action is checked, then logged

System calls and network requests are intercepted in user-space. Allowed actions pass through. Blocked actions are denied and written to ~/.nocklock/audit.db.

Review the audit trail anytime

SQLite, so query it however you want. Pipe it into Nock Command for fleet-wide visibility, or just sqlite3 it from the terminal.

Install

One line. No accounts. No telemetry.

# homebrew (macOS, Linux)
$ brew install nocktechnologies/tap/nocklock

# or from source
$ cargo install nocklock

# initialize in your project
$ nocklock init

# wrap any agent command
$ nocklock run claude-code "fix login bug"
[ok] 3 fences armed · agent sandboxed