Sandcat: sandbox for securely running AI agents in “dangerous” mode

Sandcat is a Docker & dev container setup for securely running AI agents (Claude Code, Cursor CLI, Codex CLI, GitHub Copilot CLI). The environment is sandboxed, with controlled network access and transparent secret substitution — while retaining the convenience of working in an IDE — both VS Code and JetBrains are supported.

All container traffic is routed through a transparent mitmproxy via WireGuard, capturing HTTP/S, DNS, and all other TCP/UDP traffic without per-tool proxy configuration. A straightforward allow/deny-list engine controls which network requests go through, and a secret substitution system injects credentials at the proxy level so the container never sees real values.

Source code: github.com/VirtusLab/sandcat.

Note

Sandcat is part of Visdom, VirtusLab’s AI-native SDLC platform.

Getting started

• Quick start
  • 1. Install the sandcat CLI
  • 2. Initialize the sandbox for your project
  • 3. Add your API keys
  • 4. Start the sandbox

Agents

• Claude Code
  • Authentication
  • Host paths and mounts
  • RTK hook
  • Convenience alias
• Cursor CLI
  • Authentication and CLI configuration
  • Host paths and mounts
  • RTK hook
• Codex CLI
• GitHub Copilot CLI
• RTK — LLM token compression
  • Per-agent setup

IDE integration

• VS Code
  • Opening the sandbox
  • The customizations.vscode block
  • Security hardening
• JetBrains
  • Opening the sandbox
  • Per-stack plugins
  • overrideCommand: false — do not remove
  • Extra capabilities and mounts
  • Network

Installation

• Installation

Configuration

• Settings format
• Applying configuration changes
• Network access rules
  • Network presets
  • Default settings
  • DNS filtering
  • Examples
• DNS resolution
  • Custom upstream DNS — dns_servers
  • Container-to-container DNS
  • Resolving internal hostnames — extra_hosts
• Secret substitution
  • Host patterns
  • Leak detection
  • Basic Auth (git credentials)
  • 1Password integration
  • How it works internally
  • Disabling
  • Agent-specific notes
• Customizing the generated files
• Stack and tool packages via devbox
• Customizing optional volume mounts
• Shared dependency caches
• Gitignore defaults

Architecture

• Architecture
  • Containers and network
  • Volumes
  • Agent container hardening
  • Startup sequence

Reference

• CLI reference
  • Modules and Commands
  • Directory Structure
  • Environment Variables
• Notes
  • Why not wg-quick?
  • TLS and CA certificates
  • Trusting internal CAs upstream

Operations

• Testing the proxy
• Debugging
  • Viewing proxy logs
  • Common issues
• Unit tests

Project

• Inspiration
• Development

Commercial Support

We offer commercial services around AI-assisted software development. Contact us to learn more about our offer!