AI · alternatives · 2026

24 alternatives to Fence – Sandbox CLI commands with network/filesystem restrictions

Hi HN! Fence wraps any command in a sandbox that blocks network by default and restricts filesystem writes. Useful for running semi-trusted code (package installs, build scripts, unfamiliar repos) with controlled side effects, or even just blocking tools that phone home. > fence curl https://example.com # -> blocked > fence -t code -- npm install # -> template with registries allowed > fence -m -- npm install # -> monitor mode: see what gets blocked One use-case is to use it with AI coding agents to reduce the risk of running agents with fewer interactive permission prompts: >…

Fence is a command-line sandbox tool that restricts network access and filesystem writes when executing commands. It blocks all network traffic by default and prevents unintended file modifications, making it useful… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.

1
Fence▲87
AI powered security helping keep users safe online.
2022 · its alternatives →
2
Zerobox – Sandbox any command with file, network, credential controls▲141
I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds additional functionalities like secret injection, SDK, etc. Watch the demo: https://www.youtube.com/watch?v=wZiPm9BOPCg Zerobox follows the same sandboxing policy as Deno which is deny by default. The only operation that the command can run is reading files, all writes and network I/O are blocked by default. No VMs, no Docker, no remote servers. Want to block reads to /etc? zerobox…
Mar 2026 · github.com · its alternatives →
3
A context-aware permission guard for Claude Code▲127
We needed something like --dangerously-skip-permissions that doesn’t nuke your untracked files, exfiltrate your keys, or install malware. Claude Code's permission system is allow-or-deny per tool, but that doesn’t really scale. Deleting some files is fine sometimes. And git checkout is sometimes not fine. Even when you curate permissions, 200 IQ Opus can find a way around it. Maintaining a deny list is a fool's errand. nah is a PreToolUse hook that classifies every tool call by what it actually does, using a deterministic classifier that runs in milliseconds. It maps commands to action types…
Mar 2026 · github.com · its alternatives →
4
Tunnelling TCP through a file▲180
This program can be used to tunnel TCP connections through a file. People have used it for interesting things: - Bridging connections which would otherwise be blocked by a firewall - Tunneling through RDP (similar to an SSH tunnel) - Exposing a localhost web server to others Key features I put effort into: 1. The shared file is restarted every 10 MB, so it doesn't grow indefinitely. 2. Optimisations for latency & bandwidth. (800 Mbps on a Gigabit LAN. 108 Mbps if file tunneling through RDP) 3. Synchronisation between two sides (each side can be started and restarted in any order) I'd love to…
2024 · github.com · its alternatives →
5
Fortress – a stealth Chromium so your agents stop getting blocked▲43
Stealth Chromium engine that stops scrapers and browser agents from getting blocked, with one line of code change. - tiliondev/fortress
Jul 2026 · github.com · its alternatives →
6
I built a Rust crate for running unsafe code safely▲113
A Rust crate for containing memory leaks and fragmentation - brannondorsey/mem-isolate
2025 · github.com · its alternatives →
7
Onetun – Access your WireGuard network from anywhere▲92
User space WireGuard port-forward in Rust. Contribute to aramperes/onetun development by creating an account on GitHub.
2021 · github.com · its alternatives →
8
Claw Patrol, a security firewall for agents▲112
At Deno we've been using OpenClaw and other agents increasingly for addressing production problems in Deno Deploy - when a PagerDuty alert fires, the agent starts researching the cause and making fixes. In order to do this, the agent needs access to real production systems - postgres, kubernetes, gcp, clickhouse, github, etc. But this is dangerous to say the least - we want destructive actions to be reviewed by other LLMs, approved by humans, and logged appropriately. Claw Patrol terminates TCP connections over WireGuard or Tailscale, then parses application protocols (eg http, postgres,…
Jun 2026 · github.com · its alternatives →
9
Context Fence▲8
Runtime firewall for AI coding agents.
Aug 2026 · contextfence.dev · its alternatives →
10
Local Privacy Firewall-blocks PII and secrets before ChatGPT sees them▲111
OP here. I built this because I recently caught myself almost pasting a block of logs containing AWS keys into Claude. The Problem: I need the reasoning capabilities of cloud models (GPT/Claude/Gemini), but I can't trust myself not to accidentally leak PII or secrets. The Solution: A Chrome extension that acts as a local middleware. It intercepts the prompt and runs a local BERT model (via a Python FastAPI backend) to scrub names, emails, and keys before the request leaves the browser. A few notes up front (to set expectations clearly): Everything runs 100% locally. Regex detection…
Dec 2025 · github.com · its alternatives →
11
Greywall▲10
Prefix any AI coding agent with `greywall --` for a live feed of every read, write, and connection. Allow by default; ask mode and deny rules opt-in via config. Linux and macOS.
Mar 2026 · greywall.io · its alternatives →
12
Sandy – A tiny Sandbox to run untrusted code ️▲64
A tiny "sandbox" to run untrusted code 🏖️. Contribute to craigmulligan/sandy development by creating an account on GitHub.
2020 · github.com · its alternatives →
13
CargoWall – eBPF Firewall for GitHub Actions▲14
We just open-sourced CargoWall - a lightweight eBPF firewall for GitHub Actions. We originally built it to stop LLM agents from connecting to untrusted domains. After recent GitHub Actions supply chain compromises like the Trivy attack, we realized it'd work well for blocking untrusted connections from CI runners too. It uses iptables DNAT to redirect all outbound port 53 traffic to a local DNS proxy, which checks each query against a hostname allowlist before forwarding. Resolved IPs from allowed responses are inserted into eBPF LPM trie maps, and a TC egress classifier attached to the…
Mar 2026 · github.com · its alternatives →
14
A Claude Code plugin that catch destructive Git and filesystem commands▲61
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code
Dec 2025 · github.com · its alternatives →
15
Netfence – Like Envoy for eBPF Filters▲58
To power the firewalling for our agents so that they couldn't contact arbitrary services, I build netfence. It's like Envoy but for eBPF filters. It allows you to define different DNS-based rules that are resolved in a local daemon to IPs, then pushed to the eBPF filter to allow traffic. By doing it this way, we can still allow DNS-defined rules, but prevent contacting random IPs. There's also no network performance penalty, since it's just DNS lookups and eBPF filters referencing memory. It also means you don't have to tamper with the base image, which the agent could potentially manipulate…
Jan 2026 · github.com · its alternatives →
16
layer▲88
I built a small CLI called layer. It manages .git/info/exclude so you can keep local-only files in a repo without adding them to the shared .gitignore. This came from a normal team repo problem. People keep their own local files in a repo: API_SPEC.md, BACKEND_GUIDE.md, ARCHITECTURE_NOTES.md, CLAUDE.md, prompt files, scratch notes, temporary investigation docs, and other markdown files with custom names that are useful for one developer but should not be committed. The usual answer is “just put it in .gitignore”, but that gets messy fast because these files are different for each…
Mar 2026 · crates.io · its alternatives →
17
Strict interfaces and dep management for Python, written in Rust▲68
Tach is a pip package that lets you define module boundaries, automatically detect all cross-module dependencies, and then validate and enforce those dependencies. It also supports strict interfaces for modules by overloading `__all__`. The core static analysis is done in Rust, so all Tach commands run quickly. The goal of Tach is to help eng teams maintain velocity while scaling quickly, something we've seen break down a number of times. Give it a try!
2024 · github.com · its alternatives →
18
Dsnet, a simple command to manage a centralised WireGuard VPN▲69
FAST command to manage a centralised wireguard VPN. Think wg-quick but quicker: key generation + address allocation. - naggie/dsnet
2020 · github.com · its alternatives →
19
Sandboxing untrusted code using WebAssembly▲76
Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator:…
Feb 2026 · github.com · its alternatives →
20
Desktop Sandbox for Secure Cloud Computer Use▲50
E2B Desktop Sandbox for LLMs. E2B Sandbox with desktop graphical environment that you can connect to any LLM for secure computer use. - e2b-dev/desktop
2024 · github.com · its alternatives →
21
Terminal, a sandboxed command-line interface for iOS▲62
OpenTerm, a sandboxed command line interface for iOS - louisdh/openterm
2018 · github.com · its alternatives →
22
HeimWall▲34
Signal, not surveillance. See how your engineers use Cursor, Claude Code, and Copilot: catch leaked secrets, PII, and confidential data, without blocking them or reading their prompts.
Jul 2026 · heimwall.ai · its alternatives →
23TY
Test your WireGuard connectivity and see global stats, no client needed▲43
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
2024 · probe.sh · its alternatives →
24
DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs▲40
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com · its alternatives →

Also compare

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →