A cage for the Coding Agent

Fri, 21 Aug 2026 18:00:00 +0200

Pretty much regardless of harness, running a coding agent (by general convention) means approving or whitelisting commands one by one - or skipping all that with something like Claude Code’s --dangerously-skip-permissions and living in danger-land.

I’ve scratched this itch recently with a Sandbox for Agents for a personal AI assistant, over MCP. The reasoning is the same here: let the agent run pretty much anything inside a sandbox while reducing the attack surface, and allow for project-specific host resources to be exposed when needed.

Sandbox on Johan Eliasson

A cage for the Coding Agent