Free to do
- Install tools, packages, and skills
- Run code and write files in its own home
- Browse and call the public web, every connection logged
- Keep working in the background
Local agents. Room to work.
Let your agents work.
Keep your computer yours.
Each runtime gets a sandbox of its own. Inside, your agents install tools, run code, and browse the web without asking at every step. Your files stay unchanged, your keys and local network stay out of reach, and one CLI shows what runs where.
Early development · Hermes on macOS today · more runtimes and Linux planned
YOUR COMPUTERA place for everything.
SSH keysRead blocked
Your filesWrites blocked*
Other sandboxesRead blocked
Sandbox labTHE BOUNDARY
Agent runtimeIts own install. Its own home.
main agent
scout agent
Tools & memory stored here~/
Sandbox proxy checks & logs connections
✓ Public web, logged× Your computer and local network
assistant policy. *Host reads are broad, except sensitive paths; writes stay in the sandbox’s own home.One place to manage your agents.
Clear boundaries for every sandbox.
01 / Room to work
Fewer questions.
The same walls.
An agent that asks before every step is slow. One with your whole computer is a risk. In a sandbox, it gets on with the work, inside limits you can read.
Out of reach
- Writing to your files
- Reading SSH keys, credentials, browser data, and mail
- Your local network, your computer’s own services, and cloud metadata
- Opening apps, sending Apple Events, or signaling other processes
Your call
- Other ports and private addresses, when you allow them
- Allowlist mode: your sites, plus what the runtime needs to run
- What to allow after a refusal, without a restart
Worth knowing: the agent can still send what it can read to a public website. For sensitive work, allowlist mode keeps it to the sites you choose and the ones its runtime needs.
02 / One place
More agents.
Less to keep track of.
As you add agents, it gets harder to remember where they live, what’s running, and what they can access. enclos brings the agents in its sandboxes into one local workflow, with a central overview and a policy around each sandbox.
Your agents, in one place
Run enclos status to see your sandboxes and agents, service state, disk usage, and useful next steps. Add or remove agents and start or stop sandboxes through the same CLI.
A home of its own
The agent can install tools and write files in its sandbox home. By default, it cannot write to your other files, and sensitive paths such as SSH keys, browser data, and cloud credentials are blocked from reads.
A say in where it connects
Every connection goes through the sandbox’s own proxy and is logged. The agent can browse the public web; your computer’s own services, your local network and cloud metadata addresses stay out of reach. Prefer a short list? Allowlist mode keeps it to the sites you choose, plus what its runtime needs, and you can allow more as you go—without restarting the agent.
A record you can inspect
Inspect connection metadata, active policy, and recorded sessions. Commands that change enclos state leave a hash-chained audit record, so you can check what changed.
03 / Boundaries, made concrete
What happens when
your agent tries to…
Explore a few everyday actions.
These are illustrations, not live activity.
ILLUSTRATED OUTCOMEAllowed inside its home
The tool gets a home.
Your computer keeps its boundaries.
Tools, dependencies, and skills can live inside the sandbox’s own home and run under the same policy. Downloads go through its proxy and are logged.
Inspect what this sandbox may do
enclos policy show labOne policy per sandbox
Each sandbox’s limits live in one small, readable file. Give an agent a folder to write, hide more of your files, or switch it to allowlist mode. enclos policy allow applies your edits after showing them to you, and enclos policy show lab shows what is in force.
Every change becomes a new version, recorded in the audit log, and the same policy is meant for every kind of sandbox enclos will support, each stating how well it enforces each rule. Whatever the file says, your keys and credentials, other sandboxes, and enclos’s own records stay out of reach.
POLICY.TOML
# ~/.enclos/sandboxes/lab/policy.toml [filesystem]# a folder it may writewrite_add = ["~/Documents/notes"]# more of your files to hideread_deny_add = ["~/work"] [network]# your sites, plus what the runtime needsmode = "allowlist"allow_add = ["api.telegram.org"]The sandbox is the boundary. Agents inside it share the runtime, policy, proxy, and login. Use separate sandboxes when those need to differ.
04 / Fits the way you work
From first setup
to everyday
management.
enclos brings sandbox creation, agent management, service controls, and status into one CLI. The runtime still handles the conversation, models, memory, and skills. You keep the runtime’s own commands, with a policy around them.
Explore the architectureA GOOD FIT FOR
Developers and early adopters running local AI agents who want one overview, a consistent way to manage them, and explicit limits on their access.
Make space for the work
Create a named sandbox. It gets its own home, policy, and proxy.
enclos sandbox create labBring in the runtime
Install an agent runtime inside it, such as Hermes, and sign in with your model provider.
enclos runtime install hermes --sandbox labKeep the whole setup in view
See your sandboxes and agents together: service state, disk usage, recent activity, and suggestions for what needs attention.
enclos statusInstall via terminal
Latest releasemacOS Apple silicon · 15+No Rust required · ~/.local/bin
curl -fsSL https://enclos.dev/install.sh | bashAlways installs the latest release, after checking its SHA-256 checksum and version. If none is published yet, it says so and installs nothing.
No sudo · no changes to your shell files · no sandbox created
05 / Take it for a spin
Install once.
Meet your sandbox.
The installer downloads the latest release and checks it before replacing anything. Then a few commands give you a sandbox with a runtime in it, here Hermes, ready for you to sign in with your model provider.
- An Apple silicon Mac running macOS 15 or later
- No Rust compiler needed
- An account with a model provider the runtime supports
- About 2.5 GB of free space per sandbox for Hermes
Run these commands one at a time: the login and the conversation are interactive. When the login shows a URL, open it in your browser.
AFTER INSTALLATION
# Create enclos stateenclos init # A sandbox, then a runtimeenclos sandbox create labenclos runtime install hermes --sandbox labenclos connect lab -- hermes -p default setup # Add an agent and check known escape routesenclos agent add lab/mainenclos policy test lab # Start services and talk to your agentenclos sandbox start labenclos connect lab -- hermes -p main # After the conversation, inspect connectionsenclos net log labenclos status06 / A few useful answers
Know what
you’re getting.
Clear boundaries also mean being clear about the limits.
Read the threat modelIs enclos an AI agent?
enclos creates and manages sandboxes for agent runtimes. The runtime installed in a sandbox provides the agents, conversations, and tools: Hermes today, with Claude Code and Codex planned. You use your own supported model-provider account.
Can I manage all my agents in one place?
enclos gives you one CLI to manage and see the agents in the sandboxes it creates on your computer. Run enclos status for an overview, then use the agent and sandbox commands to add or remove agents, start or stop services, and clean up unused sandboxes. Hermes is supported today; agents installed elsewhere and other machines are outside this overview.
Can it read the rest of my files?
Host reads are broad by default, with a deny list for sensitive paths such as SSH keys, cloud credentials, browser data, mail, and other agents’ configuration. Other sandboxes and enclos’s own protected files are also blocked. Writes are limited to the sandbox’s own home by default. This is not a policy that hides every file on your computer.
How strong is the protection?
enclos is designed to reduce accidental damage from buggy or misled agents you mostly trust. It builds each sandbox on your operating system’s own isolation, Seatbelt on macOS today, and probes known escape routes. Seatbelt shares your computer’s kernel, which keeps it light; it is not a defense against deliberately malicious code exploiting the kernel. A passing probe does not prove every possible route is closed.
Does it need a virtual machine or Docker?
No. enclos builds on your operating system’s own isolation, Seatbelt on macOS today, so a sandbox starts at once and adds little beyond the agent itself and its small proxy. Most of the disk space a sandbox uses is its runtime’s own install, such as Hermes’s. Containers, and micro virtual machines with a kernel of their own, are planned for agents that run untrusted code, with the same policy.
Can the agent send my data anywhere on the web?
By default it can reach public websites on ports 80 and 443, so anything it can read could be sent to one; that is why sensitive paths are denied and every connection is logged. For HTTPS the proxy records where it connected, not the encrypted content, and a remote service may fetch other sites on the agent’s behalf. For a tighter limit, allowlist mode keeps a sandbox to the sites you choose and the ones its runtime needs.
Can I have agents with different access?
Yes—put them in separate sandboxes. Agents in one sandbox share its runtime, policy, proxy, and login. Agents created with the runtime’s own commands inside a sandbox are reported by enclos; enclos agent add lab/scout explicitly tracks an existing agent without recreating it.
What works today, and what’s still coming?
Today’s milestone runs Hermes on macOS with sandbox homes, network policies, connection logs, background services, agent discovery, a status overview, escape probes, and the command audit log. Chromium browser tools do not work inside the sandbox yet. Linux, other runtimes, messaging integrations, and managed secrets are future work.
Does it change my existing agents?
enclos manages only sandboxes it creates. Each sandbox has its own runtime install and login; it does not adopt your existing host installation. You can inspect sandbox services with enclos sandbox show lab and stop them with enclos sandbox stop lab.
Your agents, together.
Their access, under control.
One local overview. A home for each sandbox. Limits you can inspect.