Agent Sandbox Linter

Paste the two allowlists your agent actually runs behind. Get what they permit that you did not intend.

Read this before you read a result. This tool can prove an allowlist insufficient by exhibiting a permitted escape. It can never prove one sufficient.

A clean result means nothing in a finite, dated catalogue matched your entries. It is not a verdict on your sandbox. The catalogue below is a snapshot of documented behaviour in long-lived programs, not an exhaustive bypass corpus, and it is deliberately not a corpus of product-specific matcher bypasses.

Inputs

One entry per line, or paste a JSON array or a settings object and the parser will pull the strings out of it. Lines starting with # are ignored. Wrapper forms such as Bash(git log:*) are unwrapped to the program name.

Permitted commands

Examples: git, git log *, docker run *, npm run build.

The tool reads the program name only. It never guesses what your matcher does with the rest of the line.

Permitted hosts

Examples: api.example.com, *.githubusercontent.com, *.

Schemes, ports, paths and userinfo are stripped. No request is made to any host, ever.

Results

Command allowlist

Host allowlist

How the ranking works

Every command row has exactly two columns, and they come from different places on purpose.

Column A is computed by this tool and is runtime independent. It asks one question: does your entry name a program that is documented to take a command on its own argv? That answer does not change with your agent product, your matcher, or your shell. It comes from the manual of the program.
Column B is declared by you. One choice per entry: does your matcher constrain arguments, or does it only match the program name? This tool does not know, does not probe, and does not guess. Whatever the row says about column B, the row also says that you asserted it.
The ranking is A and not B. A catalogued program plus a matcher you declared to be name only is a permitted escape. A catalogued program plus a matcher you declared to constrain arguments is not cleared, it is unknown to this tool, and the row says so.

Host rows have no column B. A wildcard is a property of the string you typed, so the whole row is computed.

What this tool refuses to do

It does not decide whether git log * admits a dangerous flag. That answer depends on one specific product's matcher in one specific release, and a repository full of those goes stale in a release cycle. The escapes here are documented behaviour of programs that have shipped for decades.
It does not classify hosts as egress or ingestion. Whether a host serves content an attacker authored is a judgement about your deployment, and a tool that asked you and then printed your answer back as a finding would be relabelling an input. The only thing computable from a host string with zero requests is scope, so scope is all this half computes.
It does not catalogue the obvious. sh, bash, python3, node, perl and ruby are absent because nobody is surprised that an interpreter runs code from argv. The catalogue collects programs that get allowlisted as version control, archive, search or transport tools and still run argv supplied code.
It makes no network request. Not to the hosts you paste, not to a source URL, not to anything. Every quote below was fetched by hand while the catalogue was written and then frozen into this file.

Catalogue

SnapshotExternal material, frozen on 2026-08-11.

Everything in this section was copied from the URL beside it on that date. It is quoted, not paraphrased. Keep it mentally separate from the ranking above: the ranking depends only on whether your entry names a catalogued program or base, so a quote going stale here can change a citation without making the logic above wrong. Verify any row that matters to you by opening its link.

Programs documented to run a command from their own argv

Program	Documented flag	Primary source	Quoted sentence

Base domains where a subdomain is provisioned by whoever asks

Base	Who gets a subdomain	Primary source	Quoted sentence

Where this sits

Three repositories in this neighbourhood, told apart by what you feed them:

This one eats an allowlist config and looks forward at what it could permit.
agent-blast-radius eats a session transcript and looks backward at what already happened.
ai-agent-guardrails-reference is prose, with no input at all.