sx - macOS Sandbox CLI for Secure Development

A lightweight Rust CLI that wraps shell commands in macOS Seatbelt sandboxes. That npm package you just installed? It can't read your ~/.ssh keys or ~/.aws credentials. Can't steal what you can't see.

Supply chain attacks are everywhere. A single compromised dependency tries to exfiltrate your secrets? It can't—filesystem is deny-by-default. Your credentials aren't readable, even with network enabled. No containers, no VMs, just native macOS sandboxing.

Quick Start

brew tap agentic-dev3o/sx
brew install sx

# That's it. Now run untrusted code:
sx -- npm run build
sx -- cargo test
sx -- ./build.sh

# Or start an interactive sandboxed shell
sx

Your secrets stay secret. Malicious postinstall scripts get nothing.

Profiles

Profiles stack. Combine them: sx online rust -- cargo build

Examples

# Bun
sx bun -- bun install           # Offline, from cache
sx bun online -- bun install    # Download deps

# Rust
sx rust -- cargo test           # Offline tests
sx rust online -- cargo build   # Download crates

# Claude Code - the whole point
sx claude -- claude --dangerously-skip-permissions --continue

# Interactive shell with network
sx online

Claude Code Integration

Claude Code has a built-in sandbox mode. Sounds great, except it allows read-only access to your entire filesystem. A compromised dependency can still read your ~/.ssh keys, ~/.aws credentials, and exfiltrate them.

sx is deny-by-default. Sensitive paths are blocked from reading, not just writing. Malicious code can't steal what it can't see.

sx claude -- claude --dangerously-skip-permissions --continue

Claude runs agentic, no permission prompts. Supply chain attacks in dependencies? They get sandboxed too. That's the setup I use.

Installation

Homebrew

brew tap agentic-dev3o/sx
brew install sx

From Source

git clone https://github.com/agentic-dev3o/sandbox-shell.git
cd sandbox-shell
cargo install --path .

Requires macOS and Rust 1.70+.

Configuration

Global Config (~/.config/sx/config.toml)

Your personal paths go here. Terminal, shell prompt, directory jumper…

[filesystem]
allow_read = [
    # Shell prompt
    "~/.config/starship.toml",
    "~/.cache/starship/",

    # zoxide
    "~/.local/share/zoxide/",

    # Ghostty users - you need this or terminal breaks in sandbox
    "/Applications/Ghostty.app/Contents/Resources/terminfo",

    # Claude Code plugins
    # "~/projects/my-plugins/",
]

allow_write = [
    "~/.local/share/zoxide/",
    "~/Library/Application Support/zoxide/",
    "~/.cache/",
]

Ghostty users: add that terminfo path or you'll get display issues.

Project Config (.sandbox.toml)

Per-project overrides:

sx --init

[sandbox]
profiles = ["rust"]

[filesystem]
allow_write = ["/tmp/build"]

[shell]
pass_env = ["NODE_ENV", "DEBUG"]

Custom profiles go in ~/.config/sx/profiles/name.toml. They support filesystem paths, env vars, exec sugid, and raw seatbelt rules for advanced sandbox operations. See docs/PROFILES.md.

Usage

sx [OPTIONS] [PROFILES]... [-- <COMMAND>...]

# Offline (default)
sx -- npm run build
sx -- ./scripts/setup.sh

# Localhost only - for dev servers
sx localhost -- npm start

# Online
sx online rust -- cargo audit
sx bun online -- bun install

# Debug what's blocked
sx --trace -- cargo build       # Real-time violation log
sx --explain rust               # Show allowed/denied
sx --dry-run rust               # Preview seatbelt profile

Options

| --trace shows violations from all sandboxed processes on the system, not just yours. macOS limitation.

Security Model

Always Denied (even if you allow ~)

These paths are explicitly blocked. Even if your config allows the home directory, these stay protected:

Everything else (~/.config/gh, ~/.netrc, ~/.gnupg…) is blocked by deny-by-default. Use profiles like gpg to allow specific paths when needed.

Network Modes

How It Works

Reads: denied by default. Only /usr, /bin, /Library, /System.

Writes: denied by default. Only working directory and /tmp.

Network: blocked by default.

Use Cases

Supply chain attacks are the main threat. That one compromised package in your dependency tree running a postinstall script, exfiltrating ~/.aws to some random server. Or worse, dropping malware.

sx makes npm/bun/yarn safe. Also: untrusted repos, random build scripts, CI/CD isolation locally, Claude Code agentic loops, security research…

Shell Integration

Prompt indicators, tab completion, aliases.

Zsh (~/.zshrc):

source $(brew --prefix)/share/sx/sx.zsh

Bash (~/.bashrc):

source $(brew --prefix)/share/sx/sx.bash

Fish:

cp $(brew --prefix)/share/sx/sx.fish ~/.config/fish/conf.d/

Prompt Colors

• [sx:offline] red - network blocked
• [sx:localhost] yellow - localhost only
• [sx:online] green - full network

Aliases

Comparison

Development

cargo fmt
cargo test
cargo build
cargo run -- --help

License

MIT

Contributing

PRs welcome. Read the security model before touching sandbox behavior.