nd7 is a small open-source tool that runs AI coding agents inside a sandbox enforced by the operating system, and writes down everything they do in an audit log that cannot be changed without leaving a trace. The sandbox decides what the agent may read, write and connect to. The audit log shows, after the fact, what the agent said it would do and what actually happened on your machine. It works with Claude Code and OpenAI Codex CLI today.
cargo install --locked --git https://github.com/nd7-dev/nd7-coreThen cd your-project && nd7 run claude. macOS with a Rust toolchain. Quick start · Documentation · Source
Coding agents run shell commands, edit files and talk to servers on their own. One wrong command, or a malicious instruction hidden in a file the agent reads, can delete a project, leak a key or push to the wrong branch. A permission prompt only helps if a person reads it carefully every time. A sandbox helps whether anyone is watching or not: the operating system refuses anything outside the rules, and the agent cannot talk its way around it.
An AI sandbox is a restricted space in which an AI agent's commands run with limited access to files, the network and credentials, so a wrong or hijacked action cannot damage the machine it runs on. Cloud sandboxes provide this with containers or small virtual machines on a provider's servers. nd7 provides it on your own computer, using the sandboxing built into the operating system kernel. The agent works on your real project with your real tools, and still cannot step outside the rules you set.
What we find when we look closely at how coding agents use your machine. First: coding agents and your GPG key. An agent that signs your commits talks to the gpg-agent that holds your key, and so can every command it runs. Through gpg-agent's main socket that means guessing your passphrase with no dialog and exporting your secret key. We measured it, and show how nd7 lets an agent sign without either.
nd7 run claude and nd7 run codex start the agent, and every program it launches, inside one sandbox. The rules: the agent may write only inside your project, the temporary folder and its own state directory, ~/.claude or ~/.codex. It may read everywhere except your keys and credentials. It may make HTTPS connections and nothing else. The operating system enforces these rules, so neither the model nor a compromised package can loosen them from inside.
Run nd7 allow ~/data in another terminal and the next command the agent runs may write there. nd7 deny ~/data takes it back. No restart, no edit to a config file. When the sandbox blocks something, the agent learns that nd7 blocked it and what to ask you for, so it asks instead of failing quietly.
nd7 plugs into the hook system of both agents — nd7 init registers it once with each — and records one entry per event: every prompt, every command the agent intends to run, every result. Each session gets its own log that only grows. Every entry carries a cryptographic fingerprint of the entry before it, so nd7 verify can prove the log has not been edited and point to the first entry that does not match. nd7 can encrypt logs on your machine and send them to a vault server you run.
Open source under the MIT license, and pre-alpha. The sandbox is tested on macOS 26 with Claude Code 2.1.x, and the Codex work was measured against Codex CLI 0.155.1. The audit log records what the agent said it did, not yet what the kernel saw. To get started, read the quick start; to understand the design, read how sandboxing works, the architecture and the design decisions. Every page is listed in the documentation index and in the footer below. Updated 23 September 2026.