Agentsh
agentsh enforces syscall-level policy for AI coding agents — file, network, and process control that holds no matter what the prompt says.
If your agent has write access and a network connection, prompt-level guardrails are theater — agentsh is one of the few open-source tools that enforces at the layer where intent becomes reality. The wrap command is a five-minute test drive, and the JSON audit trail is the artifact your security reviewer will actually ask for. Just know the tradeoff up front: you get YAML policies and kernel-dependent coverage, not a polished console.
Verified 2d ago · liveness 76/100 · cite: rightaichoice.com/tools/agentsh
- Security engineers who need runtime policy enforcement that survives prompt injection and jailbreaks
- Developers running autonomous coding agents in CI or on shared dev hosts with write and network access
- Teams on sandbox platforms (E2B, Vercel, Modal, Daytona) who want governance inside the sandbox
- Organizations that need audit-grade JSON logs proving what an agent actually did
- Teams that need a hosted control plane, SSO, or a central dashboard out of the box
- Non-technical builders who want a point-and-click agent security UI
- Homogeneous-kernel environments you can't verify — protection dips to roughly 80% Landlock-only or ~50% on minimal kernels
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip agentsh if you need a hosted control plane with a dashboard, SSO, and point-and-click policy editing rather than self-hosted YAML policies and JSON audit events.
There's no license fee, but the real cost is engineer time: writing YAML policies, choosing a security mode, and wiring JSON audit events into your own logging stack is on you.
agentsh is Apache 2.0 and free to self-host — you pay in engineering hours rather than licence fees. That places it well below commercial agent-security and sandbox-governance platforms, and roughly on par with rolling your own seccomp/Landlock policy layer, but with the policy engine and audit-event plumbing already built. The tradeoff: no hosted control plane, no support contract, and no SLAs.
In short
Agentsh — agentsh enforces syscall-level policy for AI coding agents — file, network, and process control that holds no matter what the prompt says. Best for Security engineers who need runtime policy enforcement that survives prompt injection and jailbreaks, Developers running autonomous coding agents in CI or on shared dev hosts with write and network access, Teams on sandbox platforms (E2B, Vercel, Modal, Daytona) who want governance inside the sandbox. Free to use.
What's new in Agentsh
Checked todayAcross the latest 1 update: 1 changelog entry.
What people actually say about Agentsh — is it worth it?
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
15 mentions across 4 sources (Hacker News, Bluesky, GitHub, Lemmy) · researched Jul 6, 2026.
Average across the 4 sources that answered — each source counts once, not each post.
- +Prompt-proof enforcement at the syscall level, resilient to jailbreaks.
- +Captures subprocess trees including pip installs and npm scripts.
- +Full audit log with approval gates for risky operations.
- +Drop-in deploy: no code changes, works with any agent harness.
- +Cross-platform: macOS Homebrew, multiple Linux package formats.
- −Regression bugs in recent releases break specific environments.
- −Network domain denies bypassed by subprocesses without proxy env.
- −Cannot enforce database query restrictions at execution layer.
- −JSON output mode leaks non-JSON warnings in v0.19.1.
- −seccomp filter install fails on Runloop devboxes in v0.19.1.
- • Time cost: debugging regressions on non-standard platforms.
- • No commercial support tier; self-support required.
- • Potential need for separate database or API gateway for deeper control.
Viability Score
How well maintained and how widely used is Agentsh? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →Key Features
- Syscall-level policy enforcement for file, network, and process activity
- Six deterministic decisions: allow, deny, approve, redirect, audit, soft_delete
- Harness wrapping via agentsh wrap for Claude Code, Cursor, and OpenAI Codex CLI
- Full harness governance that catches built-in file and network tools, not just shell commands
- Shell shim that replaces /bin/bash and /bin/sh inside containers
- Structured JSON audit events routable to external logging and SIEM systems
- Subprocess tree visibility into pip installs, npm scripts, and makefile-spawned work
- Approval gates that pause risky operations for human or CI confirmation
- LLM proxy that intercepts API requests and tracks token usage
- DLP redaction of PII from prompts or responses
- Database proxy enforcing connection and statement policy on Postgres-family databases
- Checkpoints that snapshot workspace state and roll back destructive operations
- Redirect and soft_delete actions that swap to a safe alternative or quarantine with restore
- agentsh detect protection scoring (0-100) with auto-detection of seccomp, eBPF, FUSE, and Landlock
- CLI sessions via agentsh session create, agentsh exec, and agentsh wrap
About Agentsh
agentsh (short for "agent shell") is an open-source, Apache 2.0 execution gateway for teams running AI coding agents that touch real files, real sockets, and real shells. It sits underneath the agent or harness and intercepts activity at the syscall boundary — where files open, sockets connect, and processes spawn — then applies a deterministic rule: allow, deny, approve, redirect, audit, or soft_delete. The pitch is blunt and correct: models are probabilistic, execution should not be. Setup is deliberately low-ceremony. You run the agent as a child process with `agentsh wrap --root . --policy agent-default -- claude`, and every shell command it spawns gets policy-checked automatically. Harnesses like Claude Code, Cursor, and OpenAI Codex CLI ship built-in file and network tools that never touch bash — wrapping the harness itself catches those too, so one run produces one complete audit trail. For containers, a shell shim swaps /bin/bash and /bin/sh so the agent never knows it's being governed. Beyond the gateway there's an LLM proxy with DLP redaction for scrubbing PII out of prompts and responses, a Postgres-family database proxy that applies connection and statement policy, and checkpoints that snapshot workspace state so a destructive run can be rolled back. Structured JSON audit events route into external logging or SIEM. An `agentsh detect` protection score (0-100) reports which Linux primitives — seccomp, eBPF, FUSE, Landlock — are actually available and weights coverage by domain. It pairs with E2B, Vercel, Modal, Daytona, and Cloudflare rather than replacing them: the sandbox limits where damage can land, agentsh decides what the agent is allowed to do once it's inside. Version 0.20.5 installs via Homebrew, .deb, .rpm, Arch, and Alpine/musl packages for amd64 and arm64. Alternatives like hosted agent-firewall SaaS give you a dashboard and SSO; agentsh gives you the enforcement primitives and the raw event stream, and expects you to bring your own ops.
Behind the Verdict
Reach for agentsh when an autonomous agent already has write or network access in an environment you care about, and you need a decision record you can hand to a reviewer. The strongest fit is a team running Claude Code, Cursor, or Codex CLI in CI or on a shared dev box where a bad `rm -rf` or a leaked .env file is a real incident, not a hypothetical. The detail that wins us over is harness wrapping. Shim bash alone and you miss the moment a harness writes a file through its internal str_replace tool — no shell spawns, no policy check. Running the harness itself under agentsh closes that gap and folds the built-in file and network tools into the same log. Where it bites: coverage is not uniform across machines. The protection score tells the truth — full seccomp plus eBPF plus FUSE lands near 100%, a Landlock-only kernel sits around 80%, and a minimal kernel closer to 50%. If your hosts are heterogeneous, test per host before you claim a control. The AGENTS.md path is advisory only and can be bypassed by a model that ignores instructions; treat it as documentation, not enforcement. Pass if you need a hosted control plane or SSO. There's no central dashboard to click through, policies are YAML, and setup assumes comfort with containers and kernel primitives. A non-technical team will bounce off it. Compared with hosted agent-security services that sell a console and a policy wizard, agentsh sells the enforcement substrate — you get the syscall interception, the six decision verbs, checkpoints, and structured events, and you wire up the rest. That's a feature if you already run observability, and friction if you don't. The pragmatic move most teams make: keep your sandbox (E2B, Modal, Vercel) for blast-radius containment, add agentsh inside it for governance, and
Researching Agentsh? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas Agentsh actually fits — and what changes day-one when you adopt it.
Wrap the agents with `agentsh wrap --root . --policy agent-default -- claude` in the CI job, route JSON audit events to the existing log stack, and add an approve rule on writes outside the workspace directory.
Outcome: Destructive writes pause for CI-side confirmation, every subprocess (npm ci, make test) lands in the audit log, and reviewers can replay exactly what an agent did during a failed build.
Install the shell shim into the container image so /bin/bash and /bin/sh route through agentsh, then use the Postgres proxy and LLM DLP proxy to cover database calls and prompt traffic.
Outcome: Both sandbox vendors get the same policy decisions inside the container, secret reads from .env and mounted credentials are denied by default, and PII is redacted before prompts leave the network.
Run `agentsh detect` to confirm the host was in full vs. degraded mode, then pull the structured JSON events for the session to reconstruct which file and process operations were allowed, denied, or soft-deleted.
Outcome: A concrete timeline of syscall-level decisions replaces guesswork, and any soft_delete'd files can be restored from quarantine checkpoints.
Use Cases
- Stop an AI coding agent from deleting critical workspace files even when a jailbreak or injected tool output tries to steer it.
- Automatically approve read-only file operations while pausing destructive writes for human or CI confirmation.
- Log every subprocess an agent spawns (npm install, pip, make) as structured events for security audit.
- Steer rm -rf and other destructive commands to a quarantine directory with restore instead of executing them.
- Block an agent from reading environment variables, .env files, or mounted credentials containing API keys.
- Redact PII from prompts and responses with the built-in LLM proxy and DLP before they leave your network.
- Enforce connection and statement policy on agent-triggered Postgres activity via the database proxy.
- Add governance inside containers running agents on E2B, Vercel, Modal, or Cloudflare sandboxes via the shim.
Limitations
- Requires command-line expertise: policies are defined in YAML and audit events are consumed as structured JSON.
- There is no managed cloud console or graphical dashboard — you self-host, define your own policies, and monitor output yourself.
- Kernel-dependent security modes mean protection varies by platform: full seccomp + eBPF + FUSE features need a recent Linux kernel, Landlock network restrictions need kernel 6.7+ / Landlock ABI v4, and macOS, Windows, and older kernels fall back to weaker modes (Landlock-only ~80%, minimal ~50%).
- Subprocess blind spot detection only governs code that actually runs under agentsh — an agent invoked outside `agentsh wrap` or the shell shim is not intercepted.
- The AGENTS.md/CLAUDE.md instruction path is explicitly advisory and bypassable; the vendor says to use it only when you can't run the agent under agentsh.
- The sandbox SDKs (npm, pip) shim agentsh into E2B, Vercel, Modal, and similar platforms but do not replace those platforms' isolation — you still need them for containment.
as of 2026-10-09
Verification history
We have re-verified Agentsh 7 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-checked, vendor evidence unchanged
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Showing the 6 most recent of 7 verification passes.
Free to cite with attribution — this page re-verifies continuously.
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Plans compared
For each published Agentsh tier: who it actually fits, and what it adds vs. the previous tier. Cross-reference the cost calculator above for projected annual outlay.
Open Source
$0/mo
Ideal for
Engineering and security teams running autonomous coding agents in production who are comfortable self-hosting and writing YAML policies.
What this tier adds
Starting tier and only tier: Apache 2.0, $0/mo, self-hosted, no managed control plane or support contract.
Where the pricing makes sense
The company stage and team size where Agentsh's pricing actually pencils out — and where peers do it cheaper.
agentsh is Apache 2.0 and free to self-host — you pay in engineering hours rather than licence fees. That places it well below commercial agent-security and sandbox-governance platforms, and roughly on par with rolling your own seccomp/Landlock policy layer, but with the policy engine and audit-event plumbing already built. The tradeoff: no hosted control plane, no support contract, and no SLAs.
Setup time & first value
How long it actually takes to get something useful out of Agentsh — broken out by persona, not the marketing-page minute.
Single developer wrapping one agent locally: under a minute if you just run `agentsh wrap --root . --policy agent-default -- claude` with the default policy. Teams wiring agentsh into CI or container images: half a day to a day — install via Homebrew/.deb/.rpm/Arch/Alpine, decide the security mode with `agentsh detect`, write the first real YAML policy, and route JSON events to your log stack.
Switching to or from Agentsh
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From prompt-only guardrails (system prompts, AGENTS.md instructions): install agentsh, run your agent under `agentsh wrap`, and let policy decisions replace 'please don't do that' instructions — the AGENTS.md path is
- →From plain container isolation (no runtime policy): add the agentsh shell shim to the image so /bin/bash and /bin/sh route through policy inside the container.
- →From homegrown seccomp/Landlock wrappers: replace the hand-rolled layer with `agentsh wrap --policy agent-default` and import existing rules into the YAML policy format.
- ↗To a commercial agent-security platform with a hosted console: if you need SSO, dashboards, and vendor support, there is no agentsh-managed equivalent — you'd move to a SaaS control plane and accept its opinionated
- ↗To sandbox platforms alone (E2B, Vercel, Modal): if you only need containment rather than per-operation governance, drop agentsh and rely on the sandbox's own isolation.
Integrations
Resources & Guides
Tutorials & Learning
YouTube returned 6 videos for “Agentsh”, and we withheld 6: 6 could not be judged, because “Agentsh” is a single word that other videos use for other things. We are showing none, because we could not prove any of them are about Agentsh.
Official links
Featured Head-to-Head Comparisons
Agentsh vs Push Security
Choose Push Security if your priority is stopping browser-based attacks (AiTM phishing, session hijacking) and controlling employee AI tool usage across Chrome, Firefox, etc. Choose Agentsh if you're building autonomous AI agents and need runtime syscall-level policy enforcement that even prompt injections can't bypass. They solve different problems: browser vs. execution layer.
Agentsh vs Sublime Security
For runtime security of autonomous AI agents, Agentsh is a mandatory, open-source shim with syscall-level enforcement and zero cost—ideal for developers. If your threat landscape is email-based BEC/VEC attacks in a large enterprise, Sublime Security delivers AI-powered detection with low false positives but requires paid, contact-only pricing. Choose based on your attack surface: agent execution vs. email inbox.
Agentsh vs Audioeye
Agentsh and AudioEye serve completely different needs. Choose Agentsh if you develop autonomous AI agents and need runtime security against prompt injection and subprocess blind spots — it's free and requires technical expertise. Choose AudioEye if you need enterprise-grade web accessibility compliance with automated scanning, human audits, and legal documentation. They are not direct competitors.
Popular in AI Governance & Guardrails
Mindgard
Mindgard automates AI red teaming — agent-native reconnaissance, exploit validation, and continuous AI security testing for production AI
Poolside AI
Poolside builds open-weight agentic coding models — Laguna XS 2.1 (33B) and Laguna S 2.1 (118B) — for code that stays inside your security
Olas Network
Co-own autonomous AI agents on-chain: stake OLAS, run agents that trade, hire each other and settle payments.
Frequently Asked Questions
Categories
Used Agentsh? Help shape our editorial sentiment research.