What is wardcell?
wardcell runs a command with the access you granted it, and nothing else.
You write policy as small .sbx fragments. wardcell merges them into one
resolved policy and compiles that to whatever the host actually enforces —
Seatbelt on macOS, Bubblewrap on Linux — with a local proxy enforcing the
network half on both.
wardcell run -- claudeWhat a policy controls
Section titled “What a policy controls”| Enforced by | |
|---|---|
| Filesystem — which paths can be read and written | the OS sandbox |
| Network — which hosts, ports, HTTP requests and GraphQL mutations | a local proxy |
| Environment — which variables the process starts with | wardcell, at exec time |
Nothing is granted by default. A fragment adds reach; it never takes any away that was already given, and absence never widens a grant.
What it is not
Section titled “What it is not”- Not a VM or a container. The process runs on your machine, as you, with your CPU and your filesystem — just with most of it removed from view.
- Not a defence against the kernel. If Seatbelt or a user namespace has a bug, wardcell has a bug too.
- Not a substitute for reading what you run. It bounds the damage of a mistake or a prompt injection. It does not make an untrusted program safe.
- Why Sandbox an Agent? — what the blast radius actually is
- How It Works — the pipeline, end to end
- Installation — get it running