stonewall-sh

Stonewall

Name: Stonewall
Author: stonewall-sh

AI community

SOURCE https://github.com/stonewall-sh/stonewall

Description

Stonewall is a local sandbox for AI coding agents, drastically limiting access to tools, paths and project files, based on strictly enforced policies.

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

Stonewall

**Force applied security guardrails for coding agents**

[![License: MIT](https://img.shields.io/badge/License-MIT-E4572E.svg?style=flat-square)](https://github.com/stonewall-sh/stonewall/blob/main/LICENSE) [![Build](https://img.shields.io/github/actions/workflow/status/stonewall-sh/stonewall/build.yml?branch=main&style=flat-square&logo=githubactions&logoColor=white&label=build)](https://github.com/stonewall-sh/stonewall/actions/workflows/build.yml) [![Linux](https://img.shields.io/badge/Linux-bubblewrap-FCC624?style=flat-square&logo=linux&logoColor=black)](https://github.com/stonewall-sh/stonewall/releases/latest) [![macOS](https://img.shields.io/badge/macOS-sandbox--exec-000000?style=flat-square&logo=apple&logoColor=white)](https://github.com/stonewall-sh/stonewall/releases/latest)

🧱 What it is

Stonewall is a local sandbox for AI coding agents, drastically limiting access to tools, paths and project files, based on strictly enforced policies.

stonewall claude

Instead of running coding agents as the current user with all its power, stonewall runs the agent in a sandbox with kernel-enforced rules. Coding agents today rely on permission prompts and their own restraint. This is not another prompt, skill or plugin: It's a literal stone wall between the agent and everything that should not be accessed by it.

In highly configurable policies, human maintainers can configure what is accessible by the AI agent beyond blindly trusting an `AGENTS.md` file or system prompts:

Tools and Binaries

Stonewall restricts access to available binaries (including `$PATH`) to whitelisted tools. Stop worrying about your agent workaround-calling a delicate tool like `make`, `git`, `python`, `rm`, etc. It virtually doesn't exist within the sandbox.