- Home
- Sandbox Software
- nono
On the recordRead 8 Oct 202624 facts
nono
On the record
- Agent compatibility
- The site lists Claude Code, OpenCode, Codex, Antigravity, Goose, OpenClaw, GitHub Copilot, Qwen Code, Pi, and Hermes.nono.sh · read 4 Oct 2026
- Agent integrations
- The site lists profiles or registry packages for Claude Code, OpenCode, Codex, Antigravity, Goose, OpenClaw, GitHub Copilot, Qwen Code, Pi, and Hermes.nono.sh · read 8 Oct 2026
- Audience
- The maker describes use from individual laptops through fleets of agents and highlights composable policies, per-tool sandboxing, credential protection, and auditable execution.nono.sh · read 8 Oct 2026
- Audit
- Filesystem operations, network attempts, and command executions can be recorded in a SHA-256 Merkle-tree audit trail and exported as JSON.nono.sh · read 8 Oct 2026
- Credential handling
- The site says credentials are injected at the boundary and never exposed to the agent.nono.sh · read 4 Oct 2026
- Credential protection
- With proxy-based credential injection, the agent uses a localhost proxy and does not see the real API key.nono.sh · read 8 Oct 2026
- Developer interfaces
- The documentation lists a CLI, a Rust core library, and Go, TypeScript, and Python SDKs.nono.sh · read 4 Oct 2026
- Execution isolation
- It creates ephemeral, invocation-scoped micro sandboxes for tool calls, with scoped files, network routes, arguments, and credentials.nono.sh · read 4 Oct 2026
- Installation
- The homepage offers a shell installer, Homebrew, and links to Debian, Fedora, Arch, and Nix installation instructions.nono.sh · read 4 Oct 2026
- Instruction verification
- Its Sigstore-based provenance feature verifies whether agent instruction files were signed by trusted identities before execution.nono.sh · read 8 Oct 2026
- Isolation
- It uses Landlock on Linux and WSL2 and Seatbelt on macOS to enforce filesystem allow-lists that cannot be loosened after application.nono.sh · read 8 Oct 2026
- Kernel enforcement
- The OS sandbox uses Landlock on Linux and Windows/WSL2 and Seatbelt on macOS; the page says no root is required.nono.sh · read 4 Oct 2026
- Network control
- The homepage describes proxy-mediated network access where policy can allow or deny requests and route out-of-policy actions for human approval.nono.sh · read 4 Oct 2026
- Network controls
- It can block network access, allow specific domains, filter API endpoints, and route filtered traffic through an upstream proxy.nono.sh · read 8 Oct 2026
- Policy profiles
- JSON profiles define agent access and can be version-controlled alongside code.nono.sh · read 4 Oct 2026
- Pricing
- The maker's site and opened product pages provide no subscription price or paid plan; a maker-authored article describes nono as free and open source.nono.sh · read 8 Oct 2026
- Product
- nono describes itself as agent runtime security with kernel-enforced boundaries for AI agents.nono.sh · read 4 Oct 2026
- Purpose
- nono is a kernel-enforced sandbox CLI and SDK for isolating AI agents, scripts, build tools, and other processes.nono.sh · read 8 Oct 2026
