Open-source OS firewall shims intercept AI agent commands
Key insights
- Binary shims silently replace rm, git, docker, kubectl, and mysql, forcing every destructive call through a configurable allow/deny policy before OS execution.
- A paired MCP proxy layer intercepts tool calls at the protocol level, directly countering prompt-injection attacks that exploit agent shell privileges.
- Community review identified coverage gaps for less-common destructive binaries and flagged the absence of network-level controls as an unresolved limitation.
Why this matters
Most AI coding agent frameworks and IDEs grant shell access with no native OS-level sandboxing, meaning a single misrouted command or successful prompt-injection attack can cause irreversible damage to codebases, infrastructure, or databases. This project demonstrates that a containment layer can be built independently of framework vendors and that the MCP tool-call surface is an actively exploitable attack vector requiring explicit defense. For teams running autonomous agents in development or staging environments today, the lack of command-level audit logs and allow/deny policies is an operational security gap with real incident potential, not a theoretical edge case.
Summary
A developer open-sourced a two-layer shell containment system for local AI coding agents, targeting both accidental destruction and prompt-injection exploitation.
Binary shims replace rm, git, docker, kubectl, and mysql, intercepting every destructive call to apply a gate, a log, and a configurable allow/deny policy before anything reaches the OS. A paired MCP proxy layer sits between the agent and any MCP server, inspecting and optionally blocking tool calls at the protocol level before they execute.
Essentially: one developer shipped the OS-level guardrails major IDE vendors and agent frameworks have not.
- Shims cover the most-used destructive binaries; community review flagged gaps for less-common commands not yet shimmed
- The MCP proxy directly targets prompt-injection attacks that trick agents into calling destructive tools
- Both layers produce audit logs, giving operators a record of what the agent attempted
As coding agents gain broader shell access across development environments, native containment from vendors remains largely absent.
Potential risks and opportunities
Risks
- Teams treating shim coverage as a complete defense remain exposed when agents call unshimmed destructive binaries like shred, dd, or truncate, which are absent from the current list.
- A prompt-injection attack targeting the shim configuration files directly could disable the firewall layer in environments that removed other safeguards, leaving no containment fallback.
- Compliance frameworks requiring complete command-level audit trails (SOC 2, ISO 27001) may reject logs with known binary coverage gaps as insufficient evidence of adequate agent access controls.
Opportunities
- IDE vendors (Cursor, VS Code, JetBrains) could integrate native shim-based containment as a differentiating feature as enterprise buyers increasingly require auditable, sandboxed agent deployments.
- MCP framework maintainers and spec stewards (Anthropic, LangChain, CrewAI) could standardize proxy-layer inspection in the protocol, reducing the need for per-deployment OS-level workarounds.
- Security tooling companies (Snyk, Wiz, Chainguard) could productize agent-shell firewall capabilities with full binary coverage guarantees and managed policy templates targeting the enterprise developer tooling market.
What we don't know yet
- Binary coverage gaps for less-common destructive commands (shred, dd, truncate, mkfs) remain unaddressed; no timeline for additions has been published.
- Performance overhead of shim interception on high-frequency agent command loops is uncharacterized; no benchmarks were released alongside the code.
- Whether the MCP proxy layer correctly handles streaming or batched tool calls without introducing latency that breaks agent task execution in practice.
Originally reported by reddit.com
Read the original article →Original headline: r/AI_Agents: Developer Ships OS-Level Firewall for Local Coding Agents — Binary Shims for rm/git/kubectl/mysql Plus MCP Proxy Layer