r/codex • u/schuay • 5h ago

Showcase Zero credentials, zero network, permissions bypassed: a sandbox for Claude Code, Codex and opencode

I always run Codex and other AI harnesses with bypassed permissions, and I suspect most people reading this do too. While this works great, there's always a chance that harnesses expose sensitive data or do something they shouldn't. There's one way to make this safe by construction: put everything inside a sandbox: the harness (including all its tool calls), and all stdio mcp servers.

The idea is one sentence: the entire execution goes in the box, the harness, its state, its tools, and your repo. The box has no network route and holds no credential.

Try it now: cd your/src/folder && uv tool install aisan && aisan codex

.. with network access (but without credentials): aisan codex --net

.. and with userbinds:

aisan codex --binds aisan-userbinds.toml

How model calls still work: The client inside sees a placeholder token and a loopback address. A proxy on the host checks each request against an allowlist, throws the placeholder away, and attaches the real credential to traffic the box never sees. So the box can talk to Codex and to nothing else, and the token is never inside it to steal in the first place. Same for Claude and opencode; there is also a vertexai backend for unattended API jobs.

What that looks like from inside:

  • cat ~/.claude/.credentials.json : "no such file". Never mounted.
  • ls ~/.ssh gives you "no such file". $HOME is a tmpfs.
  • curl https://anything does not even resolve. The box gets its own network namespace with no route off the machine, so there is no resolver to ask.
  • Codex answers you anyway, with permissions bypassed, because that is the only mode it runs in here.

Honest limits:

  • Linux only for now, with bubblewrap and user namespaces underneath.
  • Pre-1.0. The API will move.

MIT, uv tool install aisan, repo: https://github.com/schuay/aisan

Happy to answer anything about the bind model or the proxies.

0 Upvotes

33% Upvoted

3 comments sorted by

•

u/dexterthebot 5h ago

You might want to consider listing your project on the weekly Show-Us-What-You-Built post. Watch for it on Wednesdays. Highest commented project wins a week promotion on r/Codex. See what that looks like below with last week's winner.

Last week's winner was u/Ollie__Oxenfree with the Tubular Daily Care project by MediTracer which is a tube-feeding care app built by a tube-feeding family to keep feeds, meds, symptoms, and caregiver handoffs in one shared timeline. MediTracer is an Oley Foundation Emerging Innovator Partner. Contact: hello@meditracer.com

1

u/zazizazizu 4h ago

Use approve for me / auto approve

1

u/schuay 4h ago

It prevents neither accidental information disclosure nor 100% protection against harmful commands. I agree though, it's a reasonable way to run attended sessions.