QASO · agent containment

The boundary decides. The agent does not.

ai-proxy sits on the developer’s computer. A signed boundary allows or blocks the next file, program, or connection. A person sets that boundary.

44capabilities. 31 in this build, 4 partial, 9 named and not in this build.

118escape cases that must be denied, inside a 136-case corpus. 18 are expected allows.

01Yes on the setup page. Then start Claude Code, Gemini CLI, or Codex as you already do.

Install, then press Yes.

Linux installs the sandboxes with the product. Mac and Windows open the same setup page from a double-click.

Linux x86_64, Apple silicon, Intel Mac, or 64-bit Windows. Supervisor, setup page, and the default boundary are in the archive.

Linux: ./install.sh then aiproxy up. Mac and Windows: double-click the launcher. The page is on port 18080.

One click writes the hook. The next tool call from Claude Code, Gemini CLI, or Codex waits for a decision.

Unpack and run ./install.sh. Sandboxes install unless you pass --no-plugins. Then aiproxy up.

Unzip the Apple silicon or Intel package. Double-click Open AiProxy.command. The supervisor and setup page land on the machine.

Unzip and double-click Open AiProxy.bat. Python 3 on PATH, as python, runs the agent hook.

All 44

Workspace work is allowed. SSH keys, cloud credentials, and everything outside the short program and network lists are denied.

Allow and deny are signed on the machine. A missing signature fails closed. The denial shows up in the console.

A wider boundary stays pending until a person approves it, with an expiry. The agent cannot approve itself.

Anthropic, OpenAI, and GitHub stay empty. They are stored only if an agent on that computer must call a model or read a private skill.

Yes covers Claude Code, the Gemini CLI, and Codex. The product does not scan the laptop to guess which app opened.

OpenShell, the Anthropic sandbox runtime, nono, and landrun install with the Linux package. Sentry waits for a BlueField card.