Secure, kernel-enforced sandbox CLI and SDKs for AI agents
...Unlike container-based approaches, the tool is intentionally lightweight and can wrap any command-line process without requiring images, VMs, or complex infrastructure. The system emphasizes capability-based security, where processes are granted only the exact filesystem paths and network access they need, and nothing more.