use cases, for security leads
Know whatevery agent did.
Keys stay outside the sandbox, every network allow and deny lands in one log, and an advisory gets an answer: which laptops reached that host. Your code and your keys never reach our cloud.
curl -fsSL https://fenzi.dev/install.sh | sh
Linux, Apple Silicon, WSL 2. Free at work too.
See how it worksMissions6
BriefingThe failures you have seenPlayer The security lead
ordinary problems
Engineering answers to problems you have already had.
Each card opens the mission that answers it.
the key
A key in plain sight.
The agent runs with the keys in your environment and your home folder within reach.
the quiet yes
Who opened that host?
Someone allowed it on their own machine, and nobody else saw it happen.
Mission 1Credentials outsidePlan Free
nothing to leak
The agent uses your API keys. It never holds them.
Your home folder is never copied in. A project file that looks like a secret is named before anything starts, and it goes in only if you say yes.
The agent sees a placeholder. The real key is added only to requests for the endpoints that key is bound to in the policy. A Claude subscription sign-in is the exception: that token sits inside the sandbox.
Your code and your keys never reach our cloud. The model vendor still receives what the agent sends it: the files it read, command output and your instructions, as it does without Fenzi.
| Inside the sandbox | What is there |
|---|---|
| Your home folder | Nothing. It was never copied. |
| A secret file in the project | Only if you said yes when fenzi run named it. |
| The model key | A placeholder. The proxy adds the real key on model calls. |
| An MCP token | A placeholder. The real one goes only to that server. |
Mission 2One log for the teamPlan Team
the record
Every allow and deny, from every laptop, in one place.
Each machine forwards its decisions, always outbound. The console filters them by machine, sandbox, destination or action, keeps them for 90 days by default, and marks a gap where part of a stream was lost.
The same records export as JSONL for your own tools.
time machine action destination process
10:42:07 dana-mbp deny paste.example.net:443 curl
10:42:31 dana-mbp allow GET pypi.org/simple/... python3.12
10:44:02 li-x1 deny POST api.github.com/... gh
Mission 3Which laptops reached a hostPlan Team
the incident question
Which laptops reached that host?
When an advisory names a host, URL or package path, paste it into Exposure. It shows which machines, sandboxes and programs reached it in the last 90 days, allowed or denied, and whether the policy in force still lists it. Nothing you paste is stored.
If the policy lists it, an admin drafts the policy without it, checks it with the prover and publishes. Running sandboxes drop the host at their next pass.
| Search: paste.example.net | |||
|---|---|---|---|
| Machine | Sandbox | Program | Action |
| dana-mbp | fenzi-web-4f2a | curl | deny |
| The policy in force does not list it. | |||
Mission 4The team boundaryPlan Team
the outer fence
One fence around every policy.
An admin saves a team boundary, written like a policy file: the most any policy of the team may allow. A publish outside it is refused with the prover's example. An approval for a host and port it does not hold is refused too, in the console and on the machine.
Mission 5DriftPlan Team
the honest part
A laptop drifts. Team writes it down.
A developer owns their laptop. For sandboxes Fenzi started, Team records one started without the team policy, a gateway that approves on its own, an approval made on the machine with no console review, and a machine that stopped reporting.
A record, not a lock.
Enforcement the laptop's owner cannot change is the License plan, on your cluster. It is planned and not built yet.
Mission 6When our cloud is downPlan Team
fails closed
Our cloud goes down. The last policy holds.
Sandboxes keep enforcing the policy they loaded, and new ones start from the last signed revision the machine verified. The agent keeps working on what the policy already allows. Requests wait, and decision records wait on the machine.
| Down | New sandboxes |
|---|---|
| Our control plane | Start from the last signed policy the machine verified. |
| A machine that never got a policy | Refused. An enrolled machine does not fall back to the Free default. |
| The policy prover | Refused. fenzi run exits with code 2. |
| The sandbox runtime | Refused. fenzi run exits with code 3 and fenzi doctor says what is missing. |
Level selectThe other use cases
same walls, other seats
The same sandbox, seen from another seat.
One policy and one setup for the whole team.
All use cases and every feature with its docs page.
PlansFree and TeamSandbox hours Not billed
price
You pay for the fleet, not for sandbox hours.
$0 Per machine. No account.
Fine at work, on each developer's own laptop.
$20 Per developer a month, billed yearly.
$25 billed monthly, two developers at least. One policy, one log and one approval queue across every laptop. Machines and sandbox hours are not counted.
Price has every plan side by side.
One line to install. One command to run.
curl -fsSL https://fenzi.dev/install.sh | sh
Free per machine. No account. The model does not get a vote on its own limits.