Bubblewrap Python Packages

kartikeya

Kartikeya — standalone bwrap-sandboxed task queue + worker (the Willow fleet's Kart engine, extracted). Backend-agnostic: SQLite or Postgres.

cageforge

Rust sandbox for AI agents and untrusted code, inspired by OpenAI Codex. OS-enforced isolation on Linux, Windows, and macOS.

fronta

Task queue on PostgreSQL for Python: asyncio handlers and bubblewrap-sandboxed processes, with a REST/MCP server

mcp-python-exec-sandbox

MCP server for sandboxed Python execution — bubblewrap on Linux, Docker on macOS. PEP 723 inline deps, multi-version Python, ephemeral environments.

sandwine

:wine_glass: Command-line tool to run Windows apps with Wine and bwrap/bubblewrap isolation on Linux

keepout

Files AI agents can't touch — kernel-enforced no-read, read-only and append-only rules for Claude Code, Codex and any agent. macOS + Linux.

bubblewrap-cli

🧼 A Python library that makes beautiful text bubbles in your terminal using NerdFont icons

dev-link-mcp

Turn ChatGPT Web Chat, Grok, Claude Code, Codex, Cursor or VS Code into a coding agent for one folder on your machine, sandboxed and logged on a live dashboard. MCP server.

aisan

Coding agent sandbox. Everything in the box: zero network, zero credentials. Bubblewrap confinement plus credential-injecting egress proxies for Claude Code, Codex, and opencode.

bubble-agent

Run your coding agent in a bubble.

retie

A coding agent that plans the undo before it acts. Consequence-aware gate, bubblewrap sandbox, tamper-evident ledger. Runs on hosted open models.

csc-runner

Bounded shell and CLI execution for AI agents: structured contracts, policy-gated execution, hardened Linux runtime enforcement, and signed receipts.

agentfense

Least-privilege filesystem sandbox & context guardrails for AI agents

sandbox-rls

Least-privilege filesystem sandbox & context guardrails for AI agents