Your LLM agent doesn't need to see your ~/.ssh

What it does

Agent Safehouse is a hardening layer for macOS that locks down LLM coding agents inside sandbox-exec policies. It starts from a deny-all stance and assembles composable profiles so an agent can read and write only explicitly permitted paths. The tool ships with built-in profiles for major agents and auto-detects Git worktrees to keep cross-repository inspection working without handing over your entire home directory.

The interesting bit

The README is admirably honest that this is “a hardening layer, not a perfect security boundary,” which is a refreshing change from security tools that pretend they’re magic. It also handles macOS’s symlink maze intelligently—built-in read rules for paths like /etc automatically resolve to their /private/etc targets without broadening access to the entire parent directory.

Key highlights

• Deny-first model with composable policy profiles for major coding agents
• Narrow default home access: stat "$HOME" works, but ls "$HOME" and cat ~/secret.txt fail without explicit rules
• Built-in macOS symlink resolution for system paths like /private/etc/resolv.conf
• Machine-local override profiles via --append-profile so shared repo configs stay clean
• Auto-detection of Git worktrees for shared metadata access across linked trees

Caveats

• macOS only, relying on Apple’s sandbox-exec
• Explicitly not a perfect security boundary against a determined attacker
• Symlink auto-resolution is currently limited to built-in absolute read grants; user-provided paths and writable rules normalize separately

Verdict

If you run agents on macOS and want to shrink your blast radius without breaking workflows, this is a pragmatic fit. If you need cross-platform support or a guaranteed security boundary, it won’t help.