nono.sh

nono.sh is a platform for ephemeral micro sandboxes for AI agents with kernel-level isolation. We assess it for secure tool execution in our agent workflows.

Blurb

Ephemeral micro sandboxes for AI agents, with zero setup and zero latency. Kernel isolation for Linux, macOS & Windows with per-tool sandboxing, credential protection, and fully auditable execution.

Summary

What it is: A sandbox platform that provides isolated, scoped execution environments for AI agent tool calls. Each tool invocation runs inside a micro sandbox with only the selected capabilities: read-only workspace, bounded I/O, and proxy-only network access.

When to use: You need secure tool execution with credential protection and audit trails for AI agents in production or sensitive environments.

When to skip: Single-agent development workflows where direct tool execution without sandboxing suffices. You already have a gateway governance product that meets step-level needs, such as Agent Control.

Key features: Kernel-level isolation, per-tool sandboxing with least-privilege capabilities, credential injection at the boundary, cryptographic audit trail, composable JSON profiles, and a TypeScript SDK. MIT licensed.

Enforcement model, from vendor documentation:

Enforcement happens at the kernel rather than in the language runtime, so native addons, N-API modules, and WASM cannot bypass it. Once applied, a sandbox cannot be loosened, not by the agent, not by a child process, and not by nono itself. Restrictions are inherited, so an npm install postinstall script runs under the same allow-list as the agent that started it.

Details

Package: nono CLI, current release 0.62
Source: https://github.com/nolabs-ai/nono
Registry: https://registry.nono.sh

Sandbox providers: OS Sandbox (kernel isolation), Python, Node.js, Go
Integrations: Claude Code, OpenCode, Codex, Antigravity, GitHub Copilot, and registry agents

Architecture: Supervisor to resolve, authorize, spawn, execute, audit, and destroy. Every tool call crosses the supervisor boundary with policy-enforced capabilities.

Security advisory worth reading. CVE-2026-47128, published July 2026 and rated moderate at CVSS 6.1, was a complete sandbox escape on Linux. Landlock and seccomp policies permitted access to local Unix domain sockets, so a sandboxed process could reach the per-user systemd D-Bus socket and spawn an unsandboxed sibling that writes anywhere the invoking user can write. Version 0.55.0 patched it. The advisory names the realistic threat as an agent tricked into invoking systemd-run. Not in the CISA KEV catalog.

Ecosystem adoption. Microsoft documents nono as a sandbox provider in its Agent Governance Toolkit, mapped against OWASP ASI, the LLM and MCP Top 10, NSA MCP guidance, NIST AI RMF, and the EU AI Act. Other projects wrapping it include agent-sandbox for Go and local-only agent setups.