navikt

Cplt — AI skill for Claude Code

AI community

Sandbox for AI coding agents.

How to install Cplt

This entry records only its repository, not the path inside it, so there is no exact command to give. Open navikt/cplt and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Cplt does

Sandbox for AI coding agents. Runs Copilot CLI, Claude Code, OpenCode, Gemini CLI, Antigravity, Pi, goose or a plain shell inside a kernel-level sandbox, with git and gh guards and sandbox policy committed to the repository.

Alternatives in AI

Coding Agent Template — Multi-agent AI coding platform powered by Vercel Sandbox and AI Gateway 1.8k ★
Adopt AI Properly — Workflow recipe — the org-side AI adoption arc, policy to proof, by chaining 4 skills 1.3k ★
Agenvoy — Self-hosted AI agent harness in a single Go binary — writes, sandbox-tests and repairs its own tools, and lets 474 ★

README

cplt

[![CI](https://github.com/navikt/cplt/actions/workflows/ci.yaml/badge.svg)](https://github.com/navikt/cplt/actions/workflows/ci.yaml) [![Release](https://github.com/navikt/cplt/actions/workflows/release.yaml/badge.svg)](https://github.com/navikt/cplt/actions/workflows/release.yaml) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) ![macOS](https://img.shields.io/badge/platform-macOS-lightgrey) ![Linux](https://img.shields.io/badge/platform-Linux-lightgrey)

**Kernel-enforced sandbox for AI coding agents.** cplt wraps GitHub Copilot CLI, OpenCode, Gemini CLI, Antigravity CLI, Pi, Claude Code, goose, or any shell, so the agent can write code but cannot steal credentials, push to main, merge PRs, or exfiltrate secrets.

macOS: Apple Seatbelt/SBPL via sandbox-exec
Linux: Landlock LSM + seccomp-BPF + optional Bubblewrap namespace isolation (kernel 5.13+, full network filtering on 6.7+)
Windows: no native support. There is no Windows sandbox backend. Run cplt inside WSL2, where it is an ordinary Linux install and the Microsoft kernel ships Landlock. See Windows (WSL2) setup.

![cplt banner](./assets/cplt.png)

Why cplt?

AI agents execute arbitrary code. A compromised agent, whether through prompt injection, a supply chain attack, or a malicious MCP server, can read `~/.ssh`, push to main, merge PRs, or exfiltrate your code, unless the OS itself says no.

cplt gives you kernel-level enforcement with team-configurable policy:

Per-repo policy in .cplt.toml, committed to version control, so it is tamper-proof and auditable
Deny by default for credentials, secrets, and sensitive files
Command-level git and gh interception: pushes to the default branch, force pushes, merges, and releases are blocked, feature branches stay open
Outbound network filtering with an audit log
No Docker, no VMs. One binary that runs on a locked-down laptop
Zero-config start for developers, with escape hatches