README.md

September 20, 2026 · View on GitHub

vetto — a kernel wall between the AI agent and your machine

Daemon-less, rootless kernel-level sandbox and policy enforcement runtime for AI coding agents (Claude Code, OpenAI Codex CLI, Cursor, Gemini, Aider). Vetto injects immutable security boundaries directly between fork() and execve() with sub-4ms initialization latency.

Proof Before Promises

Autonomous agents execute non-deterministic code. Untrusted dependency hooks, prompt injections, or hallucinated commands can compromise host credentials (~/.ssh, ~/.aws, .env) or damage the filesystem. Under Vetto, unauthorized system calls are blocked deterministically:

> Reading ~/.ssh/id_rsa...         BLOCKED (secret mask, EACCES)
> Opening raw socket...             BLOCKED (net namespace, EAFNOSUPPORT)
> Spawning detached daemon...       TERMINATED (process tree extinction, exit 125)

Blocked exfiltration attempt under vetto

Fail-Closed Contract (Exit 125)

If an isolation boundary is violated or if required kernel primitives cannot be enforced, execution is terminated immediately with exit code 125. Descendant process trees and orphaned subprocesses are reaped synchronously. Guarantees that the underlying OS cannot enforce are reported as unsupported—security is never silently downgraded.

Quick Start

1. Install

Via package managers:

# npm
npm install -g @shledery/vetto
# Homebrew
brew install shleder/tap/vetto
# Cargo
cargo install vetto

Or download via standalone installer:

curl -fsSL https://raw.githubusercontent.com/shleder/vetto/main/install.sh | sh

2. Transparent Agent Sandboxing

Enable zero-configuration sandboxing for your coding agent once. Vetto installs a non-destructive shim in ~/.vetto/shims with priority in PATH:

vetto enable claude   # supports codex, gemini, cursor, aider, and presets
claude                # runs normally — fully sandboxed at the kernel boundary

3. Direct Execution & MCP Quarantine

Execute standalone scripts under strict default isolation:

vetto run -- python script.py
vetto -- npm test

Quarantine a Model Context Protocol (MCP) server binary with isolated paths and disabled network egress:

vetto mcp wrap --allow ./data --net off -- <mcp-server-binary>

Inspect security events and verify platform enforcement:

vetto audit --latest --recap    # review blocked syscalls and file operations
vetto doctor --fix              # probe kernel LSM support and repair shell hooks

Platform Guarantees

Vetto enforces an immutable three-tier boundary model based on kernel capabilities available to unprivileged userspace:

Platform / Tier	Filesystem Isolation	Network Isolation	Process Lifecycle	Status
Linux (Native) Tier 1	Landlock LSM (ABI 1–6) Inode-level VFS masking over `~/.ssh`, `~/.aws`, `.env`	Network Namespaces (`CLONE_NEWNET`) Loopback isolation + local TCP/TLS broker	PID Namespaces (`CLONE_NEWPID`) Deterministic process tree teardown	Production
Linux (WSL2) Tier 1	Landlock LSM via WSL2 kernel Full inode restriction	Network Namespaces inside VM Isolated broker egress	PID Namespaces + `/proc` sweep Full tree extinction	Production (Recommended for Windows)
macOS (Darwin) Tier 2	Seatbelt (SBPL) Write confinement to `$PROJECT` and `/tmp`	Network Lockdown `--net=off` via `(deny network*)` rules	Process Group Sweeping kqueue watchdog supervision	Standard (Requires Full Disk Access for `~/Documents`)
Windows Native Tier 3	AppContainer & LPAC DACL token restriction	Capability Lockdown Restricted network SIDs	Job Objects `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`	Guardrail (Use WSL2 for Tier 1 kernel namespaces)

Binary Integrity & Attestation

Releases are built via automated GitHub Actions workflows with public cryptographic verification:

SLSA Level 3 Provenance: In-toto build attestations generated for all release binaries.
Minisign Signatures: Published with each release archive under public key 75ECEC9B5080C590.
Cryptographic Checksums: Standalone SHA256 hashes generated and verified during installation.