# nd7

> A kernel sandbox and secure audit log for AI coding agents. nd7 runs Claude Code inside a sandbox enforced by the operating system (macOS Seatbelt today, Linux Landlock next), lets you widen the rules while the agent works, and records what the agent intended and what actually happened in one append-only, hash-chained log. Open source (MIT), written in Rust, pre-alpha. Codex and other agents are planned.

Install on macOS: `cargo install --locked --git https://github.com/nd7-dev/nd7-core`, then `nd7 run claude` inside a project.

## Docs

- [nd7 documentation](https://nd7.dev/docs/index.md): What nd7 is, what it does today, what is planned, and where each part is documented.
- [Install nd7 on macOS](https://nd7.dev/docs/install.md): What you need, the one command that installs both binaries, why they must sit next to each other, and how to remove them.
- [Quick start](https://nd7.dev/docs/quickstart.md): Install nd7, run Claude Code inside the sandbox, and turn on recording, in five minutes.
- [A session, start to finish](https://nd7.dev/docs/session-walkthrough.md): What nd7 run claude starts, what it passes to Claude Code, what you see, and what to do at the first denial.
- [How sandboxing works](https://nd7.dev/docs/how-sandboxing-works.md): What a sandbox is, the layers of isolation from a process sandbox to a microVM, how kernel sandboxing works mechanically, and why nd7 sits where it does.
- [How the macOS sandbox works](https://nd7.dev/docs/sandbox.md): Seatbelt, the exact rules nd7 applies, why nothing inside can loosen them, how nd7-exec routes Bash commands, and the known limits.
- [Change the rules while the agent works: nd7 allow and nd7 deny](https://nd7.dev/docs/allow-deny.md): What a grant is, how nd7 finds the session, when a change takes effect, and what each command prints.
- [What happens when a command is denied](https://nd7.dev/docs/denials.md): What the kernel does, what nd7-exec reports, what the model is told, and how to respond.
- [How the audit log works](https://nd7.dev/docs/audit-log.md): One entry per hook event, where the files live, the per-session lock, the hash chain, and what nd7 verify does and does not prove.
- [The log format](https://nd7.dev/docs/log-format.md): The fields every entry shares, the body of each kind, the BLAKE3 chain, an example entry, and the rules for reading, appending and versioning.
- [Set up nd7 as a Claude Code hook](https://nd7.dev/docs/claude-code-hooks.md): The settings.json snippet, which hook events are recorded, what nd7 run installs by itself, and how this interacts with Claude Code's own sandbox setting.
- [Ship sessions to a vault you run](https://nd7.dev/docs/vault.md): What nd7 ship does, how sessions are encrypted before they leave the machine, what the vault can and cannot read, and how to deploy one.
- [Architecture](https://nd7.dev/docs/architecture.md): The parts of nd7, how its processes fit together, how data flows through them, and what each part has to trust.
- [Benchmarks](https://nd7.dev/docs/benchmarks.md): What recording and verifying a session cost, measured, with the method and how to reproduce the numbers.
- [Design decisions (ADRs)](https://nd7.dev/docs/decisions.md): A plain summary of each architecture decision record in nd7-core, with what was decided and why.
- [Roadmap: what is built and what comes next](https://nd7.dev/docs/roadmap.md): The four phases, what works today, what is explicitly not being built yet, and the limits worth knowing before you rely on it.
- [How nd7 compares to other ways of sandboxing a coding agent](https://nd7.dev/docs/compare.md): What each of the other approaches is missing, sourced from its own documentation, with an honest note on where each one has an edge over nd7.
- [When sandboxes failed: incidents and what they teach](https://nd7.dev/docs/incidents.md): Four sourced cases where a sandbox or a permission prompt did not hold, and what a kernel boundary plus an audit log would and would not have changed.
- [How nd7 compares to nono](https://nd7.dev/docs/compare-nono.md): A neutral comparison of documented behaviour between nd7 and nono, from nd7's competitive notes of 17 September 2026.
- [Frequently asked questions](https://nd7.dev/docs/faq.md): Short answers about sandboxing coding agents, containers, Claude Code's own sandbox, other agents, Linux, and what nd7 does not protect against.

## Pages

- [nd7 — kernel sandbox and secure audit log for AI coding agents](https://nd7.dev/index.md): nd7 runs Claude Code inside a sandbox enforced by the operating system and keeps a secure audit log of what the agent did. Open source, macOS today.
- [About nd7](https://nd7.dev/about.md): Who builds nd7, why it exists, and how to reach us.

## Source

- [Repository](https://github.com/nd7-dev/nd7-core): code, README with hook settings, full sandbox policy and known limits
- [README](https://raw.githubusercontent.com/nd7-dev/nd7-core/main/README.md)
- [Architecture](https://raw.githubusercontent.com/nd7-dev/nd7-core/main/docs/ARCHITECTURE.md)
- [Log schema](https://raw.githubusercontent.com/nd7-dev/nd7-core/main/docs/SCHEMA.md)
- [Decisions (ADRs)](https://raw.githubusercontent.com/nd7-dev/nd7-core/main/docs/DECISIONS.md)