--- title: nd7 — kernel sandbox and secure audit log for AI coding agents description: nd7 runs Claude Code and OpenAI Codex CLI inside a sandbox enforced by the operating system and keeps a secure audit log of what the agent did. Open source, macOS today. layout: home eyebrow: Open source · MIT · pre-alpha tagline: A kernel sandbox and secure audit log for AI coding agents. install: cargo install --locked --git https://github.com/nd7-dev/nd7-core --- nd7 is a small open-source tool that runs AI coding agents inside a sandbox enforced by the operating system, and writes down everything they do in an audit log that cannot be changed without leaving a trace. The sandbox decides what the agent may read, write and connect to. The audit log shows, after the fact, what the agent said it would do and what actually happened on your machine. It works with Claude Code and OpenAI Codex CLI today. ## Why sandbox a coding agent? Coding agents run shell commands, edit files and talk to servers on their own. One wrong command, or a malicious instruction hidden in a file the agent reads, can delete a project, leak a key or push to the wrong branch. A permission prompt only helps if a person reads it carefully every time. A sandbox helps whether anyone is watching or not: the operating system refuses anything outside the rules, and the agent cannot talk its way around it. ## What is an AI sandbox? An AI sandbox is a restricted space in which an AI agent's commands run with limited access to files, the network and credentials, so a wrong or hijacked action cannot damage the machine it runs on. Cloud sandboxes provide this with containers or small virtual machines on a provider's servers. nd7 provides it on your own computer, using the sandboxing built into the operating system kernel. The agent works on your real project with your real tools, and still cannot step outside the rules you set. ## Problems in the current coding agents What we find when we look closely at how coding agents use your machine. First: [coding agents and your GPG key](/docs/gpg-agent). An agent that signs your commits talks to the gpg-agent that holds your key, and so can every command it runs. Through gpg-agent's main socket that means guessing your passphrase with no dialog and exporting your secret key. We measured it, and show how nd7 lets an agent sign without either. ## What nd7 does today **The sandbox (macOS).** `nd7 run claude` and `nd7 run codex` start the agent, and every program it launches, inside one sandbox. The rules: the agent may write only inside your project, the temporary folder and its own state directory, `~/.claude` or `~/.codex`. It may read everywhere except your keys and credentials. It may make HTTPS connections and nothing else. The operating system enforces these rules, so neither the model nor a compromised package can loosen them from inside. **Changing the rules while the agent works.** Run `nd7 allow ~/data` in another terminal and the next command the agent runs may write there. `nd7 deny ~/data` takes it back. No restart, no edit to a config file. When the sandbox blocks something, the agent learns that nd7 blocked it and what to ask you for, so it asks instead of failing quietly. **The audit log.** nd7 plugs into the hook system of both agents — `nd7 init` registers it once with each — and records one entry per event: every prompt, every command the agent intends to run, every result. Each session gets its own log that only grows. Every entry carries a cryptographic fingerprint of the entry before it, so `nd7 verify` can prove the log has not been edited and point to the first entry that does not match. nd7 can encrypt logs on your machine and send them to a vault server you run. ## What comes next 1. **Recording what actually happened.** Today the log records what the agent said it would do. Next, nd7 will record from the kernel every process, file and network operation the agent caused, and line the two up. 2. **Following the agent to other machines.** When the agent connects to another host over SSH, the session and its log continue there as one timeline. 3. **Rules learned from real sessions.** Allowed commands and network destinations derived from what past sessions actually needed, instead of written by hand. Linux support. 4. **Undo.** Reverting what an agent changed, with an honest account of what cannot be reversed. ## Where things stand Open source under the MIT license, and pre-alpha. The sandbox is tested on macOS 26 with Claude Code 2.1.x, and the Codex work was measured against Codex CLI 0.155.1. The audit log records what the agent said it did, not yet what the kernel saw. To get started, read the [quick start](/docs/quickstart); to understand the design, read [how sandboxing works](/docs/how-sandboxing-works), the [architecture](/docs/architecture) and the [design decisions](/docs/decisions). Every page is listed in the [documentation index](/docs/) and in the footer below. Updated 23 September 2026.