Alternatives
Products that do what tethered does
Your app's network firewall — in one function call.
- 1
- 2SP
2023 · github.com
- 3
- 4
- 5
- 6OS
2024 · defguard.net
- 7FS
Hi HN! Fence wraps any command in a sandbox that blocks network by default and restricts filesystem writes. Useful for running semi-trusted code (package installs, build scripts, unfamiliar repos) with controlled side effects, or even just blocking tools that phone home. > fence curl https://example.com # -> blocked > fence -t code -- npm install # -> template with registries allowed > fence -m -- npm install # -> monitor mode: see what gets blocked One use-case is to use it with AI coding agents to reduce the risk of running agents with fewer interactive permission prompts: >…
Jan 2026 · github.com
- 8OA
2021 · github.com
- 9LF
2024 · github.com
- 10PA
2025 · github.com
- 11SI
Tach is a pip package that lets you define module boundaries, automatically detect all cross-module dependencies, and then validate and enforce those dependencies. It also supports strict interfaces for modules by overloading `__all__`. The core static analysis is done in Rust, so all Tach commands run quickly. The goal of Tach is to help eng teams maintain velocity while scaling quickly, something we've seen break down a number of times. Give it a try!
2024 · github.com
- 12
- 13DP
2020 · github.com
- 14TY
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
2024 · probe.sh
- 15BA
I found hping3 and nmap's nping to be far too slow in terms of sending individual, bare-minimum (40-byte) TCP SYN packets; other than inefficient socket I/O, they were also attempting to do far too much unnecessary processing in what should have otherwise been a tight execution loop. Furthermore, none of them were able to handle CIDR notations (i.e., a range of IP addresses) as their source IP parameter. Being intended for embedded devices (e.g., low-power MIPS/Arm-based routers), Blitzping only depends on standard POSIX headers and C11's libc (whether musl or gnu). To that end,…
2024 · github.com
- 16FE
2019 · apps.apple.com
- 17AT
2021 · zmedley.com
- 18OS
May 2026 · warpgate.io
- 19AO
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
Oct 2025 · github.com
- 20PR
2024 · github.com
- 21PI
People seem to be blindly hooking up their OpenClaw’s to their personal data. So, I built runtime controls to prevent at the least, very simple prompt injection attacks. Once installed, it hooks to Node.js child_process module in the gateway process and listens to tool calls and their response streams. And a fetch hook to monitor user prompts (both could’ve been through fetch, happy to discuss why this whole layer couldn’t just be a proxy). There are two layers of protection: First: Whenever there is a read-only tool call whose response an attacker can modify, we extract that part of the…
Feb 2026 · github.com
- 22RE
2016 · radiosilenceapp.com
- 23WH
With internet censorship and surveillance on the rise, ie; UK Online Safety Bill (July 2025) and Australia's social media legislation (Dec 2025) introducing mandatory age verification (read: initial step on the pathway to social credit), I wanted a privacy-first solution that protects browsing history from ISPs and third-party verification services, but not one that requires you to be an Einstein to deploy. This stack turns a Raspberry Pi (or any OpenWrt-compatible device) into a network-wide VPN gateway. Key features: - Firewall kill switch: VPN down = no internet (not a software rule that…
Nov 2025 · github.com
- 24
The only way to go fast is full YOLO mode in your coding agent. I've got the local sandbox figured out (pro tip: Incus VMs work great) but I wanted to keep my agents from doing things like inadvertently blowing up my cloud services or chasing a prompt to POST to some random website. I struggle most with this on my side projects where my permission model isn't quite as robust as it is at the office. I started with a firewall on the Incus container but every time the agent needed access to something new, I was poking more holes in it - and it didn't differentiate between HTTP verbs. I've been…
Jul 2026 · trollbridge.dev
Ranked by how close each launch is in meaning, then by votes. Refine with a description →