Security
Mandatory sandbox
Policy wrapper for tools — allow, deny, require-sandbox, validators.
import { createMandatorySandbox } from '@agentskit/tools'
import { shell } from '@agentskit/tools'
const guarded = createMandatorySandbox(shell(), {
allow: ['ls', 'cat', 'grep'],
deny: ['rm', 'sudo', 'curl', 'wget'],
requireSandbox: true,
validators: [
(args) => args.cmd.length < 256 || 'command too long',
],
})Modes
| Rule | Effect |
|---|---|
allow: string[] | only listed cmds pass |
deny: string[] | listed cmds rejected |
requireSandbox: true | execute via @agentskit/sandbox |
validators: Fn[] | return string to reject with message |
Sandbox backends
E2B (default) · WebContainer · Deno worker — see sandbox package.