Fenzi
Request access

Run the agent. Keep it in bounds.

Give AI coding agents the run of your machines, inside a boundary they cannot move.

curl -fsSL https://fenzi.dev/install.sh | sh

Linux, Apple Silicon, WSL 2. Free per machine. No account.

On a Mac? The app puts your requests, approvals and log in one window, connected to your team's console.

See a command get blocked
Level 0General notesOpinionOctober 2026

AI is not going to kill us all.

It is also not a careful employee. A note for the people who build or approve software and are tired of the speech.

By FenziOne-minute read

You have heard that AI will end the world. You have also heard that a system prompt is a security control. Both sound like marketing. Meanwhile the work is real, and your team already runs agents on real machines. So skip the prophecy and ask the practical question: what can this process touch?

Start with what an agent does on an ordinary afternoon at work. It opens the wrong file. It pushes to the wrong branch. It follows a bad instruction if that instruction is sitting in a README it just read.

You can write "do not touch production" in the prompt. The next sentence can undo it.

Revision 1: a prompt is not a wall.

So stop asking the model to be good.

Run the process inside a boundary it does not control. Pick the directories. Pick the hosts. Keep the real credentials outside. When it calls a host anyway, the machine says no, and you get a log line instead of a story.

That is a secure way to run an agent. A contained process, with rules that live outside the model, so a jailbreak or a confused plan does not move them.

Whatever model you point at it, the boundary is the same. Codex today, Claude Code tomorrow, the next one after that.

Fenzi, October 2026.What it does
Level 1What it doesAccount None needed
what it does

Your agent, inside a sandbox on your own machine.

Fenzi starts it there and you write the policy: the files it can touch, the hosts it can call, and whether it ever sees a real credential. The sandbox enforces it, and the agent cannot argue with it.

  1. allowGETregistry.npmjs.org/react
  2. denyPOSTapi.github.com/repos/acme/web/pulls
not a prompt

The usual answer is a longer system prompt. We put the limit where the prompt cannot reach it.

A rule the model can rewrite is not a rule. Fenzi's rules sit in the operating system's own access controls, outside the model, so a jailbreak, a bad README or a confused plan does not move them.

three steps

Install, run, read the log.

Free per machine, no account. Same Claude Code or Codex you already use, with an API key: signing in with a Claude, ChatGPT or Grok subscription is not supported yet. The first run takes longest, because setup installs the sandbox runtime if it is missing and the agent's image is built on your machine.

How to playthree steps
  1. 01

    Install. curl -fsSL https://fenzi.dev/install.sh | sh

  2. 02

    Run. fenzi run claude

  3. 03

    Read the log. Ask it to open a pull request with the GitHub API. Watch the deny land.

Our values

Our valuesThree things we believe
our values

Three things we believe.

we are not scared of agents

We like agents. We run them.

We just do not let them pick their own limits. A wrong file or a wrong host is a software problem, with an engineering answer.

two seats, one log

The developer runs the agent. The security lead reads the same log.

When the agent needs a host nobody listed, a person says yes or no, and the answer reaches the sandbox within seconds. Nobody files a ticket, and nobody finds out a week later.

the uncomfortable part

We do not trust the model. That is why the rules are not inside it.

A prompt is a wish. A sandbox is a rule.

How it works

Level 2How it worksPlayer The agent
how it works

You are the agent. The room is the sandbox.

Walls are files and processes. Doors are hosts, drawn here as gates on the street, and one gate waits for a person.

walls

Files and processes. Set when the sandbox starts.

Change them and you get a new sandbox. We say so, because a wall that moves while the agent runs would be a lie.

doors

Hosts. Changed while the agent runs.

Add a host, remove a host, approve a request. No restart: the change reaches the sandbox within seconds.

credentials

The agent sees a placeholder. The proxy holds the key.

The real key is added only to requests for the endpoints that key is bound to in the policy. A leaked prompt leaks a placeholder.

the log

One line per network decision.

Every allow and deny the sandbox sees: time, action, process, destination, rule. A blocked file shows as Permission denied in the agent's terminal and is not in the log.

see it

Walk the agent into a wall.

Every line in the log is a gate you walked through or one that refused you. One gate waits for a person, and nothing approves itself.

Allow 00 Deny 00 Policy developer-default
Waiting for a person
connect hooks.example

The agent asked for a host that is not on the list. It does not approve itself. Press Approve or Deny on the panel.

Arrow keys or WASD once the screen has focus. Or the pad. Click the screen, then move.
Decision log time / decision / verb / host or path
  • Wall. ~/.aws and ~/.ssh were never copied in. /etc and /usr/local/bin are read-only.
  • Work tile. The repo is writable; npm test may run.
  • Exit. The one way out, through the proxy.
  • Open gate. A host on the list for reading: a GET to api.github.com or registry.npmjs.org passes. A POST to open a pull request is denied, as in the log at the top of the page.
  • Ask gate. hooks.example is not on the list. A person decides.
  • Barred gate. paste.example is not on the list and nobody asked.
  1. No moves yet. Every line here comes from a move you make.

Walls do not move while the agent runs.

Files and processes are set when the sandbox starts. A change there means a new sandbox. A wall stops the agent without a log line, as the real log records network decisions only.

Only gates change while the agent runs.

Approve a host and that gate opens for this sandbox within seconds. Deny it and the agent sees a failed connection, the log says why, and the agent keeps working.

Level 3Two players
who it is for

Two players. The second one holds the Approve button.

Player 1

The developer running the agent

You keep your agent. It loses the keys.

One command starts the Claude Code or Codex you already run, with its API key, inside the sandbox: repo writable, registries and the model API reachable, ~/.aws and ~/.ssh out of reach. Subscription sign-in is not supported yet.

need a host?

Ask once. When a person approves, the host opens within seconds and you keep working. If our cloud is down, the last policy still holds.

Install it

Player 2

The security lead

One policy on every laptop, and a record when one drifts.

You said yes to the agent pilot. Now push one set of rules to every machine that opted in, see which revision each runs, and read every allow and deny.

Your code and your keys never reach our cloud.

Request access

Level 4Open sourceCode Apache-2.0
open source

The CLI is open source, and free on every machine.

Read the program that starts your agent before you let it near a repo. You pay for the fleet, not for sandbox hours.

Read the source, Apache-2.0

your code

Your code does not have to live in our cloud for you to govern the agent.

The model vendor still receives what the agent sends it: the files it read, command output and your instructions, as it does without Fenzi.

PlansPick a planSandbox hours Not billed
plans

Free is free. You pay when the fleet needs one policy.

Every plan gets the same walls. Sandbox hours are never billed; the agent runs on your machines.

Free

$0 Per machine. No account.

  • Each laptop on its own
  • Open-source CLI
  • Default policy
  • The log on that machine

Each developer runs their agent in bounds on their own laptop, at work too.

Install it
Team

$20 Per developer a month, billed yearly. $25 monthly.

  • Hosted control plane
  • One shared policy
  • One log of every allow and deny
  • One approval queue

The same rules on every laptop, one place to read every decision, a person in the loop when an agent asks for more.

Request access
License

By request Planned, for your own network.

  • Control plane in your VPC
  • SSO
  • SIEM export
  • Code and log stay there

For the company whose log, code and approvals may not leave its own network.

Request access
Operator manualQuestions
questions

Questions people ask before they install it.

01Is this just a system prompt?Open

No. The limit sits in the operating system, outside the model. A prompt can be rewritten by the next prompt; a sandbox cannot.

02Which agents does it work with?Open

Claude Code, Codex, OpenCode and Grok run today; Cursor CLI and Muse are next. Each runs with an API key, and signing in with a Claude, ChatGPT or Grok subscription is not supported yet. A desktop IDE that opens its own terminal on the host is not covered, and custom agents are not supported yet.

03What is the sandbox?Open

OpenShell, the open-source sandbox runtime Fenzi runs on. It decides what the agent process can read, write, run and call. We pin a version and keep the default tight.

04What if the sandbox has a bug?Open

Then we have a software bug, and we say so, even when the fix belongs upstream in the sandbox runtime. The runtime is open source, so you can read it, and we move our pinned version when a fix ships. The default stays tight: workspace open, secrets shut.

05Does my code leave my machine?Open

Your code and your keys never reach our cloud. The model vendor still receives what the agent sends it: the files it read, command output and your instructions, as it does without Fenzi.

06What happens when something is blocked?Open

A host that is not in the policy looks like a failed DNS lookup or a refused connection to the agent, and the log records why. A method or path the policy does not allow on a listed host gets an HTTP 403 that names the rule. A blocked file shows as Permission denied in the agent's terminal and is not in the log.

07What happens when the policy changes?Open

Hosts change while the agent runs: an approved host opens within seconds, with no restart. Files and processes are set when the sandbox starts, so a change there means a new sandbox. We do not pretend otherwise.

08Will this slow the agent down?Open

The agent keeps working on the task. It loses paths and hosts you did not grant. If normal work needs a host, put that host on the list.

09What does it run on?Open

Linux and Apple Silicon Macs, with no special hardware. On Windows it runs through WSL 2, which upstream marks experimental. Install and platforms lists the container runtimes each one uses.

All the questions Read the docs

One line to install. One command to run.

curl -fsSL https://fenzi.dev/install.sh | sh

Free per machine. No account. The model does not get a vote on its own limits.