AI Jail — AI skill for Claude Code

ai-jail

**[aijail.io](https://aijail.io)**

`ai-jail` runs AI coding agents in an OS sandbox: bubblewrap plus Landlock, seccomp, and limits on Linux; `sandbox-exec` on macOS.

What ai-jail is (and isn't)

ai-jail is **not** a lockdown or hard-security tool, and it is **not** a boundary against malware or other hostile code — for that, use a disposable VM. Its job is to be **developer-friendly**: it defends against a trusted-but-fallible agent's mistakes, not against a motivated attacker actively trying to escape.

Concretely, that means your dev tools and the invoked agent's own credentials are available **by default** — which is explicitly not a lockdown-secure posture — with flags to progressively turn capabilities off. The goal is to prevent _accidents_: an LLM running a mistyped command that deletes unrelated important files outside the project, for example. With the project directory as the blast radius, you can confidently turn on "YOLO mode" (auto-accept, no confirmation prompts) in an AI harness with reasonable confidence it won't damage anything outside the project scope.

It is a useful accident-prevention layer, not a replacement for a disposable VM when running hostile code. See [docs/SECURITY.md](docs/SECURITY.md) for the full threat model.

Install

# Homebrew
brew tap akitaonrails/tap && brew install ai-jail

# Arch Linux
yay -S ai-jail-bin       # prebuilt Linux x86_64 binary
yay -S ai-jail           # build from source

# crates.io
cargo install --locked ai-jail

# Nix (flake) — sets BWRAP_BIN automatically
nix run github:akitaonrails/ai-jail -- claude
nix profile install github:akitaonrails/ai-jail

# GitHub Releases (signed archives, checksums alongside)
# ai-jail-linux-x86_64.tar.gz / ai-jail-macos-aarch64.tar.gz

Build from source with Rust `1.97.1`:

cargo build --release --locked
install -Dm755 target/release/ai-jail ~/.local/bin/ai-jail

Linux requires `bwrap` (`bubblewrap`): `pacman -S bubblewrap`, `apt insta