Chopi is an open-source macOS sandbox for running code agents like Claude Code and Codex.

No containers, no VMs — your real machine, your real tools, with the exits guarded.

It sandboxes the process using Agent Safehouse ↗

Filesystem access confined to your workspace, plus exactly the paths you grant — and the only network exit is the local proxies below.

It filters network access using a Smokescreen ↗ proxy

Only allowlisted hosts get through; every other connection is refused, logged, and raised as a macOS notification.

It protects GitHub access using a Caddy ↗ relay

A relay scopes pushes, private repos, and API access to a repo allowlist. Your GitHub token never enters the sandbox.

Get started View on GitHub

Open source · macOS · AGPL-3.0

Guardrails, not a cage

Agents are most useful when they can run with minimal approvals. Inside the fence they work at full speed; a few extra guardrails cover what the layers above don't.

🔒Hardened git internals

Git's data paths stay writable, but config, hooks, and friends are read-only — a sandboxed command can't plant code that would later run unsandboxed on a git operation.

📝Safe write targets

Some files deserve review before they change — shared guidelines, a CLAUDE.md. Name them and the agent proposes patches instead of writing; you review each diff and apply it as your own commit.

🌳Worktree sessions

chopi --worktree NAME spins up a linked worktree on its own branch and runs the agent there — parallel tasks, each isolated in its own workspace, resumable later.

Get started

Two terminals: one for the proxy, one for the agent.

1Install

$ git clone https://github.com/danra/chopi
$ cd chopi && ./install.sh

Then review the configuration: allowed hosts in config/proxy-rules.yaml, pushable repos in config/github-allowlist, and sandbox policy in config/sandbox.sh.

2Start the proxy

$ chopi-proxy    # leave it running; all sessions share it

It runs in the foreground so refused connections are always visible.

3Run your agent

$ cd ~/path/to/your/repo
$ chopi claude                    # or codex, or any command
$ chopi --worktree fix-123 claude # or in a fresh worktree + branch

Running claude? Chopi teaches it about the sandbox via the system prompt, so the agent explains denials and guides you to the right one-line config fix instead of fighting the fence.