Greywall
Greywall is an open-source, deny-by-default command sandbox designed specifically for AI coding agents. It provides robust filesystem isolation and network control through a transparent proxy, ensuring that agents cannot perform unintended or malicious actions. The tool integrates native sandboxing mechanisms such as bubblewrap and Landlock on Linux and Seatbelt on macOS, creating a secure execution environment with minimal overhead. Greywall comes with built-in security profiles for popular AI coding agents like Claude Code and OpenCode, allowing users to get started quickly without manual configuration. A standout feature is its learning mode, which observes agent behavior during a trusted session and automatically generates a profile that permits only the required actions. Profiles can be further customized to allow or deny specific paths and network endpoints. The CLI is designed for simplicity: users can launch their AI agent under Greywall with a single command, optionally granting extra filesystem access via command-line flags. The transparent proxy intercepts outbound connections, enabling fine-grained network policies without modifying the agent's code. This makes Greywall a practical drop-in solution for developers who want to safely integrate AI coding assistants into their workflow. Under the hood, Greywall leverages battle-tested Linux kernel features like Landlock and user namespaces, while on macOS it uses the Seatbelt sandbox. The tool is actively maintained with 161 commits, multiple contributors, and growing community interest. It is particularly suited for security-conscious software teams and individual developers who experiment with autonomous coding agents.
- Category
- AI Agents
- Pricing
- Open Source
Problem solved
AI coding agents like Claude Code and OpenCode often require the ability to execute arbitrary shell commands, which poses significant security risks such as accidental file deletion, data exfiltration, or unauthorized network access. Developers and teams adopting these agents face the dilemma of enabling powerful automation while safeguarding their systems. Greywall solves this by wrapping agent processes in a deny-by-default sandbox that strictly controls filesystem and network operations. It bridges the gap between utility and security, providing a transparent isolation layer that is easy to deploy and configured through either pre-built or learned profiles.
Use cases
- Sandboxing Claude Code to restrict accidental writes to system directories while allowing safe project edits
- Automatically generating a security profile in learning mode by recording an agent's necessary file accesses during a trusted session
- Running OpenCode securely in a corporate environment where outbound network calls must be audited and restricted
- Integrating Greywall into CI/CD pipelines to safely execute AI-generated patch scripts without exposing the build server
- Isolating experimental AI agents that fetch and execute code from the internet, preventing lateral movement
Audience
- Developers
- ML Engineers
Pros
- Deny-by-default approach ensures maximum security by only granting essential permissions
- Built-in profiles for popular agents reduce setup time and complexity
- Learning mode automatically generates profiles from observed behavior, minimizing manual tuning
- Supports Linux and macOS with native sandboxing technologies for strong, OS-level isolation
- Transparent network proxy allows fine-grained control without modifying agent code
Cons
- Project is still young with limited documentation and a small community, which may affect troubleshooting
- May not cover all edge cases of complex agent behaviors, requiring manual profile adjustments
- Requires users to understand sandboxing concepts when creating custom profiles or debugging denials
Official website: https://github.com/GreyhavenHQ/greywall
Canonical LambdaBase page: https://www.lambdabase.com/tools/greywall