Hazmat

Run AI coding agents inside OS-level containment.
Open-source containment for Claude, Codex, OpenCode, Antigravity, Hermes, Qwen, Cursor Agent, Pi, and shell loops

---

Hazmat lets an agent edit your repo without running as your real system user account.

It shows the session contract first, then launches the agent inside OS-level containment. Your project can be writable. Your real home directory, SSH keys, cloud credentials, and global dev state do not become the agent's default world.

Use it when you want the productive version of Claude Code, Codex, OpenCode, or a custom loop: fewer approval interruptions, more autonomy, and a smaller host blast radius.

The loop is simple: preview what the agent can reach, run it, then inspect what changed.

Try It

Fast path for Claude Code on macOS. The dry run previews setup; it does not launch an agent.

brew install dredozubov/tap/hazmat
hazmat init --dry-run
hazmat init --bootstrap-agent claude
cd your-project
hazmat explain -C .
hazmat claude

Replace the last command for another supported harness:

hazmat codex
hazmat opencode
hazmat antigravity
hazmat exec -- ./my-agent-loop.sh

After a session:

hazmat diff
hazmat snapshots
hazmat restore

Using Hermes, Qwen, Cursor Agent, Pi, or a custom script instead? Start with [docs/harnesses.md](docs/harnesses.md).

What You Get

On the first real run, Hazmat gives you:

• A separate user: the agent runs as agent, not as your login account.
• A readable session contract: project access, integrations, network mode, and service