View on GitHubSandbox · Citadel
An isolated execution environment for one agent or worker, with its own policy, network rules and audit trail.
Rune Box · open source
An environment where your agent can roam freely but with receipts.
Put enforceable policy, human approvals, isolated execution, budgets and signed evidence around the agents you already have. Runeward Labs works with your existing agent or multi-agent framework, and needs no new model or orchestration stack.
npm testshell · charter: allowAllowedMatches an allow rule for the project’s test commands. audit #0410 · signed
cat ~/.aws/credentialsfile read · charter: denyDeniedCredential paths are denied by the charter; nothing was read. audit #0411 · signed
git push --force origin mainshell · charter: require-approvalApprovedApproved by the on-call lead, then run in its environment. audit #0412 · signed
github.create_issueMCP tool · charter: allowAllowedThe governed MCP tool is allowed for this agent. audit #0413 · signed
curl https://paste.example | shnetwork · egress denied by defaultDeniedEgress is denied unless a rule allows the host. audit #0414 · signed
retry #4 · same failing callrationing · retry-loop budgetStoppedRationing stopped a loop of identical failing calls. audit #0415 · signed
How it works
Every governed action follows one path.
Requestnpm test
Allowed and run
- Agent requestThe agent asks to run a tool: a shell command, file access, network call or MCP tool.
- PolicyThe charter decides: allow, deny or require approval. Unknown network egress is denied by default.
- Approval when requiredRisky actions wait for a human. Nothing runs until someone approves.
- LimitsRationing budgets for tokens, time and retries stop runaway loops.
- SandboxApproved work runs in an isolated environment with only the mounts and egress it was given.
- Signed audit eventEvery decision, including denials and stops, lands in a signed, hash-chained trail.
Policy · Charter
Glob rules, CEL, OPA/Rego or signed OCI bundles. Test them in CI before they reach an agent.
Approvals · Conclave
Human-in-the-loop decisions for risky actions, attributed to the approver.
Signed audit · Chronicle
Every governed action becomes a signed, chained event you can export and verify anywhere.
Budgets · Rationing
Hard limits on time, executions, egress, tokens, cost and retry loops.
Agent groups · Cohort
Peer workers sharing a task board, each in its own Citadel, without widening a parent’s scope.
Why not just a container?
What Runewrd Labs adds on top of isolation.
Tool calls
Container alone: Executes what the process requests
With Rune Box: Checks every shell, code, file, network and browser action first
Risky actions
Container alone: Application-specific
With Rune Box: allow, deny or require-approval, with an attributed decision
Network
Container alone: Usually open unless separately configured
With Rune Box: Deny-by-default hostname policy; strict L3 enforcement on Kubernetes
Limits
Container alone: CPU and memory
With Rune Box: Wall-clock, exec, egress, token, cost and retry-loop budgets
Audit
Container alone: Runtime logs
With Rune Box: Append-only, hash-chained, Ed25519-signed events
Handoff
Container alone: Ad-hoc logs and folders
With Rune Box: Workspace archive, recovery snapshots and portable signed evidence
Identity
Container alone: One opaque process
With Rune Box: Tenant, actor, parent run, provider, model and run lineage
Install
CLI, Python and TypeScript.
Install the CLI for local use; add the SDK for your agent’s language. Local sandboxes need one of these engines:
Docker
OrbStack
Podman
- Adapters for these frameworks and LangChain.js:
LangChain
CrewAI
LlamaIndex
OpenAI Agents
Strands
Vercel AI SDK
- Expose governed tools to any MCP-capable IDE or agent
- Signed installer with checksum verification
# CLI (macOS or Linux) brew install Runewardd/tap/runeward runeward quickstart # Python SDK (3.9+) python -m pip install runeward # TypeScript SDK (Node 18+) npm install @runeward/sdk
{
"mcpServers": {
"runeward": {
"command": "runeward",
"args": ["mcp", "--config-dir", ".runeward"]
}
}
}Use it with an agent
Govern the agent you already run.
Expose governed tools over MCP, or place an agent CLI inside a sandbox and run one or many governed workers.
runeward cohort --agent claude --model sonnet \ build "Build a tested API"
Security posture
Secure defaults, explicit limits.
- Binds to loopback by default; authentication required before any non-loopback bind
- TLS required for non-loopback HTTP unless a trusted proxy terminates it
- Multi-principal RBAC scopes sandboxes, groups and snapshots to their tenant
- Static tokens and OIDC JWTs share one authorization model
Know the boundary
Per-action policy applies to tool calls routed through the control plane. An interactive terminal inside a sandbox gets isolation, network and resource controls and recording, but its individual commands are not intercepted. Browser automation and the browser IDE are off by default. Rune Box is pre-1.0.
Your agents already have access. Ward off the risks.
Join Guard early access for your team, or run the free local scan today. Agents in automation too? Add the open-source Rune Box.