Cplt — AI skill for Claude Code
Sandbox for AI coding agents.
How to install Cplt
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open navikt/cplt and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Cplt does
Sandbox for AI coding agents. Runs Copilot CLI, Claude Code, OpenCode, Gemini CLI, Antigravity, Pi, goose or a plain shell inside a kernel-level sandbox, with git and gh guards and sandbox policy committed to the repository.
Alternatives in AI
- Pilotfish — Multi-model orchestration layer for Claude Code — the frontier model plans, cheaper models execute, verificati 688 ★
- Gensee Crate — Run AI harnesses like Claude Code, Codex, Copilot, Antigravity, and Omnigent in disposable workspace forks 123 ★
- Token Ninja — token-ninja routes deterministic shell commands locally — zero LLM calls, ~19µs latency 38 ★
README
cplt
[](https://github.com/navikt/cplt/actions/workflows/ci.yaml) [](https://github.com/navikt/cplt/actions/workflows/release.yaml) [](LICENSE)  
**Kernel-enforced sandbox for AI coding agents.** cplt wraps GitHub Copilot CLI, OpenCode, Gemini CLI, Antigravity CLI, Pi, Claude Code, goose, or any shell, so the agent can write code but cannot steal credentials, push to main, merge PRs, or exfiltrate secrets.
- macOS: Apple Seatbelt/SBPL via
sandbox-exec - Linux: Landlock LSM + seccomp-BPF + optional Bubblewrap namespace isolation (kernel 5.13+, full network filtering on 6.7+)
- Windows: no native support. There is no Windows sandbox backend. Run cplt inside WSL2, where it is an ordinary Linux install and the Microsoft kernel ships Landlock. See Windows (WSL2) setup.
Why cplt?
AI agents execute arbitrary code. A compromised agent, whether through prompt injection, a supply chain attack, or a malicious MCP server, can read `~/.ssh`, push to main, merge PRs, or exfiltrate your code, unless the OS itself says no.
cplt gives you kernel-level enforcement with team-configurable policy:
- Per-repo policy in
.cplt.toml, committed to version control, so it is tamper-proof and auditable - Deny by default for credentials, secrets, and sensitive files
- Command-level git and gh interception: pushes to the default branch, force pushes, merges, and releases are blocked, feature branches stay open
- Outbound network filtering with an audit log
- No Docker, no VMs. One binary that runs on a locked-down laptop
- Zero-config start for developers, with escape hatches
Related Skills
Client
Run Previously locally — an AI agent that remembers by when, not by chat thread. One npm package: the same ker
Git Worktree Isolation Skills
Git/Worktree Isolation + AI Safety Git Guards + Worktree Creation Tools (Multi-CLI) — Synced skill catalog ent
Git Episodic Memory
Zero-LLM episodic memory for coding agents: every turn as a hidden Git commit, with function-level blame and b
Provio
A safety floor your AI agents can't get under: one policy for Claude Code, Codex, Gemini CLI, Cursor, Windsurf
Agentacl
Access control and sandboxing for AI coding agents on macOS. Stop Claude Code, Codex, Gemini CLI, Copilot CLI
Code Context Control
Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path
Related Agents
Paf Reviewer
Runs one phone-a-friend relay or review command in the background and reports back a receipt plus the findings
Developer Overview
code-container (container) creates isolated Docker environments for AI coding harnesses (Claude Code, OpenCode
Consult Agent
Execute cross-tool AI consultations via Task spawning. Use when agents or workflows need a second opinion from
