> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox Your AI Coding Agent

> Run Claude Code, Codex, or Pi in the PMG sandbox to block credential reads and limit the hosts the agent can reach.

A coding agent runs many commands in a session, and each command can read your credentials or send data out. `pmg sandbox exec` runs the agent and every process it starts under one sandbox policy.

The sandbox:

* Blocks reads and writes of credential files in the repository and in your home directory.
* Removes secret variables, model API keys included, from the agent environment.
* Makes the agent hook configuration read-only, so the agent cannot remove a hook such as [Gryph](/ai-security/gryph-overview).
* Lets the agent write only in the repository, temporary directories, tool caches, and the state directory of its preset.
* Sends every outbound connection through a PMG proxy that applies a network policy.

[PMG Sandbox Network Policy for Coding Agents](https://www.youtube.com/embed/rwlIeKNVVnw)

> [!NOTE]
>
> `pmg sandbox exec` is experimental. It runs on macOS and on Linux with the Landlock driver. It does not run with Bubblewrap or on Windows. This page needs PMG v0.33.0 or later. Install PMG with the [PMG quickstart](/package-security/pmg/quickstart).

## Run the agent in the sandbox

Each agent has a preset that adds its state directory, its own API key, and its own hosts.

**Claude Code**

```bash theme={null}
pmg sandbox exec --sandbox-allow preset=claude -- claude
```

**Codex**

```bash theme={null}
pmg sandbox exec --sandbox-allow preset=codex -- codex
```

**Pi**

```bash theme={null}
pmg sandbox exec --sandbox-allow preset=pi -- pi
```

To apply the preset on every run in this repository, save it once:

```bash theme={null}
pmg sandbox allow preset=claude
pmg sandbox exec -- claude
```

## Limit the hosts the agent can reach

By default the agent can reach every host, and PMG records each destination. Build a network policy from a session, then enforce it.

**1. Run a normal session**

```bash theme={null}
pmg sandbox exec --sandbox-allow preset=claude -- claude
```

Do the work that the agent usually does in this repository.

**2. Propose a profile**

```bash theme={null}
pmg sandbox profile propose --last --new agent
```

PMG writes the user profile `agent` in the PMG config directory, outside the repository, where the agent cannot change it. The profile allows each host that the session reached and denies every other destination. Open it with `pmg sandbox profile edit agent` and remove each host that the agent does not need.

**3. Run the agent under the profile**

```bash theme={null}
pmg sandbox exec --sandbox-profile agent --network-mode enforce \
  --sandbox-allow preset=claude -- claude
```

The preset keeps the agent hosts open, such as its model API and sign-in. The profile keeps the hosts that the repository needs.

When the proxy refuses a destination, PMG prints the destination and the rule after the agent exits:

```text theme={null}
⊘ Network policy denied pastebin.com:443  rule *:*
  Allow it with pmg sandbox allow net-connect=pastebin.com:443.
```

## Fix a denied operation

The agent sees a permission error. After the session, find the cause and the command that allows it:

```bash theme={null}
pmg sandbox explain --last
```

Git over SSH fails, because the sandbox blocks the SSH agent socket. Use an HTTPS remote.

## Next steps

For the exec profile, custom profiles, the network flags, and the limits, see the [sandbox exec documentation](https://github.com/safedep/pmg/blob/main/docs/sandbox-exec.md) in the PMG repository. Read the hosts that a preset allows with `pmg sandbox preset show claude`.

> **[Gryph](/ai-security/gryph-overview)**
>
> Record every file and command your coding agent touches.

> **[Stop Install Scripts from Reading Your Secrets](/package-security/pmg/sandbox)**
>
> Run package installs in the PMG sandbox.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.