Back to packageRELEASE DETAILS

0.13.0

PyPI

agent-leash

Isolated sandbox for AI coding agents

Published28 Jun 2026

Direct dependencies6

Transitive dependenciesNot calculated

README

Version 0.13.0 documentation

agent-leash

Sandbox runner for AI coding agents:

Restricts filesystem access to the current directory
Custom allow-list to expose more directories as read-only or read-write
Intercepts all network traffic with interactive per-domain approval
Controls access to host services (podman, docker, ssh-agent, etc.)

$ pipx install agent-leash
$ aleash claude
Sandbox UI available on http://localhost:7612/

aleash demo

How it works

Filesystem — bubblewrap restricts the agent to the current working directory. The rest of the filesystem is read-only or hidden.
Network — mitmproxy intercepts all outbound HTTPS. Each new domain triggers a browser popup (and desktop notification). You choose: always allow, allow once, always block, or block once.
Web UI — Vue 3 + xterm.js frontend served on localhost:7612. Shows live terminal output, domain decisions

Requirements

Tool	Install
`bwrap` (bubblewrap)	`dnf install bubblewrap` / `apt install bubblewrap`
`xdg-dbus-proxy`	`dnf install xdg-dbus-proxy` / `apt install xdg-dbus-proxy`
Python ≥ 3.11	system or pyenv

mitmproxy is installed automatically as a Python dependency.

Usage

Pass arguments

aleash claude -- --dangerously-skip-permissions
aleash run python script.py --some-flag

Terminal size

By default the local terminal controls the PTY size. The browser shows the fixed-size terminal with scrollbars. Use --browser-master to invert this (browser FitAddon resizes the PTY):

aleash --browser-master claude

Profile override

aleash --profile generic claude   # run claude with the generic profile

Profiles

Profile	What it binds
`claude`	`~/.claude`, `~/.claude.json`, `~/.gitconfig`, `~/.local/share/claude`
`opencode`	`~/.opencode`, `~/.gitconfig`, and opencode config/cache dirs
`generic`	nothing extra

claude and opencode are auto-detected by binary name. Use --profile to override.

Data

All state lives in CWD/.aleash/:

Path	Content
`CWD/.aleash/data.db`	SQLite: sessions, terminal logs, domain decisions
`~/.mitmproxy/`	mitmproxy CA cert (auto-generated on first run)

Delete CWD/.aleash/data.db to reset all history.

Contributing

See CONTRIBUTING.md.

License

MIT — see LICENSE.

Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Declared dependencies 6

Native requirements

6 direct targetsNot calculated transitive count

Package / target	Requirement	Relationship
aiosqlite Environment { "extras": "", "marker": null, "requires_python": ">=3.11", "evaluation": "NOT_EVALUATED" }	`aiosqlite>=0.20`	runtime
click Environment { "extras": "", "marker": null, "requires_python": ">=3.11", "evaluation": "NOT_EVALUATED" }	`click>=8.1`	runtime
fastapi Environment { "extras": "", "marker": null, "requires_python": ">=3.11", "evaluation": "NOT_EVALUATED" }	`fastapi>=0.111`	runtime
httpx Environment { "extras": "", "marker": null, "requires_python": ">=3.11", "evaluation": "NOT_EVALUATED" }	`httpx>=0.27`	runtime
mitmproxy Environment { "extras": "", "marker": null, "requires_python": ">=3.11", "evaluation": "NOT_EVALUATED" }	`mitmproxy>=10.3`	runtime
uvicorn Environment { "extras": "standard", "marker": null, "requires_python": ">=3.11", "evaluation": "NOT_EVALUATED" }	`uvicorn[standard]>=0.29`	runtime