Three fences.
Limits on the label.
NockLock applies filesystem, network, and environment rules to your agent. Linux uses Landlock for filesystem access; macOS uses Seatbelt to limit writes. Network enforcement depends on the platform and setup. NockLock records events it observes in a local audit log. The limits below vary by platform.
macOS Homebrew · Linux and source setup →
Illustrative policy example, not a live session or audit transcript: blocked environment variables are removed before launch; the agent can work on project files, while configured SSH-key reads and unapproved network hosts are denied. Enforcement and event coverage vary by platform.
Three boundaries.
What each one stops.
A single TOML file sets the policy. NockLock records observed events in a signed, hash-chained SQLite log. The cards below explain what each platform enforces.
Confine the agent to your project root. Credential paths like ~/.ssh and ~/.aws are denied for reads and writes on both platforms.
Linux · Landlock allows the project and required runtime paths. Other file access is blocked, including for static binaries.
macOS · Seatbelt limits writes. Reads outside the root are not confined.
[filesystem] root = "." mode = "read-write" deny = ["~/.ssh/", "~/.aws/", "~/.gnupg/"]
The proxy permits only allowlisted hosts; HTTP clients routed through it get a 403 on blocked domains. HTTPS is checked by hostname only. Nothing is decrypted.
Linux · default CONFINED mode blocks direct IP sockets. Below Landlock ABI 9, other local Unix sockets remain reachable. Optional --net-fence=netns adds a network namespace and a kernel packet filter.
macOS · with a configured filesystem root, Seatbelt allows TCP connections only to the proxy and blocks other outbound connections. Ignoring HTTP_PROXY does not bypass this limit.
[network] allow = ["api.anthropic.com", "github.com"] allow_all = false
NockLock removes blocked environment variables before the agent starts. In this example, PATH is allowed and AWS_SECRET_ACCESS_KEY is blocked. An optional scan can stop launch if it finds a key in paths you name.
Linux + macOS · blocked variables are removed before launch. The optional scan checks named paths before launch; it does not redact later file reads.
[secrets] pass = ["HOME", "PATH", "SHELL"] block = ["AWS_*", "*_TOKEN*", "*_SECRET*"] scan_paths = ["src", ".env"]
This generic example blocks tokens, including Claude Code login tokens. Block rules take precedence over the pass list. For Claude Code, use the runtime preset in the setup steps; it preserves the credentials Claude Code needs.
For full platform details, see the README's filesystem limits and network enforcement levels. Run nocklock doctor to check your host. Linux CONFINED reports PARTIAL below Landlock ABI 9 because other Unix sockets remain reachable. Setting network.require_unix_socket_isolation = true makes NockLock refuse to start there. ABI 9 enforcement has not yet run on a real kernel. Without a macOS filesystem root, the proxy is advisory.
Wrap any agent.
In four steps.
NockLock wraps your existing agent CLI. It needs no daemon or kernel module. Linux also needs the filesystem interposer library; optional netns mode needs its privileged helper.
Define your fences in TOML
Run nocklock init --runtime claude-code in your project to create .nock/config.toml for Claude Code, or choose another runtime preset. Existing configs are preserved: use --diff to review a preset before editing your policy.
Wrap your agent command
nocklock wrap -- claude runs the agent inside the fence. Works with Claude Code, Codex, Cursor, Aider, anything you can run from a shell.
Enforce the policy. Record what is observed.
NockLock logs the names of blocked environment variables and requests the proxy denies. Linux file-denial logging depends on the interposer; macOS capture is best effort. Allowed file access and kernel network denials do not get a row for each attempt. Verifying the signed log checks recorded events for changes; it does not prove that every attempt was observed.
Review the audit trail anytime
nocklock log --blocked shows recorded denials; nocklock verify --audit checks the log. The log is SQLite, so you can query it directly or forward it to Nock Command for fleet-wide visibility.
Install on macOS
No NockLock account. No telemetry. Install your agent CLI separately.
Before wrapping Claude Code on macOS, export CLAUDE_CODE_OAUTH_TOKEN from claude setup-token, or use ANTHROPIC_API_KEY. The fence blocks login-keychain access; the Claude Code preset passes these credentials.
# macOS Homebrew $ brew install nocktechnologies/tap/nocklock # from your agent's project directory $ nocklock init --runtime claude-code $ nocklock doctor $ nocklock wrap -- claude
Linux and source installation → includes the required library, binary placement, and optional netns helper. Homebrew alone is not a complete Linux install.
Stop trusting your agent.
Fence it.
The rest of the fleet.
NockLock is the foundation. The rest of the stack runs on top of it: context, orchestration, and the dashboard that ties it all together.
Local memory you review: decisions, directives and corrections your agents recall.
Learn more → FREE · OSS Nock Skills · the playbookOperational patterns: handoff protocols, review pipelines, standing orders.
Learn more → PRIVATE ALPHA Nock Terminal · the cockpitMission control for terminal-native coding agents (Claude Code, Codex CLI, Gemini CLI). Tabs, status, git, command palette. macOS, Windows, Linux. Private alpha.
Learn more → PRIVATE ALPHA · $49/MO AT LAUNCH Nock Command · the dashboardFleet coordination. Sprint planning, /fire dispatch, agent messaging, content pipeline.
Learn more → ← Back to homepage