schnitzel312

Bulbi — Security skill for Claude Code

Security community

Security-first sandbox for autonomous AI coding agents.

How to install Bulbi

This entry records only its repository, not the path inside it, so there is no exact command to give. Open schnitzel312/bulbi and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Bulbi does

Security-first sandbox for autonomous AI coding agents. Run Claude Code, Codex and other AI CLIs in full-auto mode inside an isolated sandbox: file access, network egress, and secrets are all controlled by one bulbi.toml.

Alternatives in Security

Mcp-scan (Invariant Labs) — MCP security scanner with proxy mode for real-time scanning without infrastructure changes 1.9k ★
Maestro Odyssey — Long-running iterative cycle — one entry, seven modes (debug improve planex review security defensive ui) 530 ★
OpenTag — Open-source, channel-native agent gateway for Slack 499 ★

README

Bulbi

**Let AI coding agents run fully autonomously without trusting them with your machine.**

Bulbi runs Claude Code, Codex and other AI CLIs in full-auto mode (`--dangerously-skip-permissions`, `--full-auto`) inside an isolated Docker box. One `bulbi.toml` decides which files the agent can see and change, where it can connect on the network, and which secrets it gets. Nothing else is reachable.

$ bulbi init     # generate a bulbi.toml for this project
$ bulbi check    # see exactly what the box will be allowed to do
$ bulbi run      # start Claude Code inside the box, no permission prompts

Why

Autonomous agents are most useful when you stop approving every command, which is also when they're most dangerous. A prompt injection in a README, an issue or a web page can turn "fix this test" into "upload `~/.ssh` somewhere".

Bulbi moves the trust boundary from the agent to the box:

Files: only the paths you mount are visible. Secrets like .env can be masked, and mounts can be read-only.
Network: every connection goes through a firewall you configure, for any protocol (HTTP, gRPC, Postgres, AMQP, SSH…). Your machine, your LAN and other containers are unreachable unless you explicitly allow them.
Secrets: you declare exactly which credentials enter the box, and bulbi check lists them.
No limits on how the agent works: tools need no proxy settings. If the policy allows a destination, it just works, using its real hostname.

How it works

 your machine                        Docker
 ────────────                        ──────────────────────────────────────────────────────
                                      ┌────────────── shared network namespace ──────────┐
 bulbi run ──docker exec──────────────┼─▶ box (agent)               gateway              │
 bulbi run (2nd terminal) ────────────┼─▶   no capabilities,        nftables firewall    │
                                      │     can't change rules      DNS re