syllago sandbox

Sandbox wraps AI CLI tools in bubblewrap to restrict filesystem access, network egress, and environment variables.

Linux only: requires bubblewrap >= 0.4.0 and socat >= 1.7.0.

Subcommands

Command	Description
allow-domain	Add a domain to the sandbox allowlist
allow-env	Add an env var to the sandbox allowlist
allow-port	Add a localhost port to the sandbox allowlist
check	Verify bubblewrap, socat, and optionally a provider
deny-domain	Remove a domain from the sandbox allowlist
deny-env	Remove an env var from the sandbox allowlist
deny-port	Remove a localhost port from the sandbox allowlist
domains	List allowed domains
env	Add an env var to the sandbox allowlist
info	Show effective sandbox configuration
ports	List allowed localhost ports
run	Run a provider in a sandbox

Global Options

Flag	Type	Default	Required	Description
--json	bool	—	No	Output in JSON format
--no-color	bool	—	No	Disable color output
-q, --quiet	bool	—	No	Suppress non-essential output
-v, --verbose	bool	—	No	Verbose output

---

Source