Greywall

Greywall solves a real, growing problem: AI coding agents blindly read your .env files and call production APIs. The tool drops into your workflow with a single `brew install` or curl command, then just prefix your agent command. No container, no config. The live activity feed is the killer feature — you see every file read and outbound call as it happens, in a dashboard. The default is 'allow' (watch mode), so the agent keeps moving; you can switch to ask or deny mid-session. Deny rules for paths, networks, and commands are straightforward. The tool layers multiple kernel mechanisms (Bubblewrap, Landlock, Seccomp, eBPF, TUN) with graceful degradation — it checks what your kernel supports. Network capture uses a TUN device plus SOCKS5 proxy, catching even binaries that ignore env vars. Command blocking works across pipes and nested shells. A learning mode can auto-generate rules from strace traces. The v0.3.1 release improves macOS Endpoint Security integration. Where it falls short: no Windows support, and it's not a full VM — if you need complete isolation from the host OS, use a container or VM instead. The managed governance layer and plugins (smart escalation, model council, token-saving MITM) are still in development, so large teams may want to wait or roll their own policy layer. Compared to open-source alternatives like SafeCoder (container-based) or commercial offerings, Greywall is lighter, agent-agnostic, and observability-first. We'd recommend it to any individual developer or small team running local coding agents — it's free, open-source, and works today.