nono
nono is an open-source tool for agent runtime security that uses kernel-enforced boundaries for AI agents.
What nono is
nono is an open-source tool for agent runtime security that uses kernel-enforced boundaries for AI agents. For tool calls, it creates temporary, invocation-scoped micro sandboxes with scoped files, network routes, arguments, and credentials. Its OS sandbox uses Landlock on Linux and Windows/WSL2 and Seatbelt on macOS, and the product says it does not require root. JSON policy profiles define agent access and can be version-controlled with code. The tool also records filesystem state in SHA-256 content-addressed snapshots before and after sessions, with a described option to restore a session atomically. Its audit trail records operations in a Merkle tree and commits a SHA-256 root at session end for integrity verification. Credentials are injected at the boundary rather than exposed to the agent. Network access can be mediated by a proxy, with policies to allow or deny requests and route out-of-policy actions for human approval. Interfaces include a CLI, Rust core library, and Go, TypeScript, and Python SDKs. It is free and self-hosted, with Linux, macOS, and Windows support; on WSL2, the site reports 84% feature parity and notes limits on capability elevation and per-port network rules.
Good
- Creates invocation-scoped micro sandboxes.
- Uses OS sandbox enforcement without root.
- Records operations in an integrity-verifiable audit trail.
- Injects credentials without exposing them to agents.
- Offers a CLI and three language SDKs.
Watch out
- WSL2 reports 84% feature parity.
- WSL2 limits capability elevation and per-port network rules.
- Community support is via Discord.
Who it suits
nono suits developers who want to define and audit boundaries around AI-agent tool calls on Linux, macOS, or Windows. Its policy profiles and developer interfaces may fit teams that want to manage those controls alongside code.
Verdict
nono offers self-hosted, open-source controls for agent execution, credentials, network access, and audit records. Windows users should account for the stated WSL2 limitations when assessing its fit.
The facts
Each one read from nono's own pages, with the date it was checked.
What it does
- Agent compatibility
- The site lists Claude Code, OpenCode, Codex, Antigravity, Goose, OpenClaw, GitHub Copilot, Qwen Code, Pi, and Hermes.checked 4 Oct 2026
- Agent integrations
- The site lists profiles or registry packages for Claude Code, OpenCode, Codex, Antigravity, Goose, OpenClaw, GitHub Copilot, Qwen Code, Pi, and Hermes.checked 8 Oct 2026
- Audience
- The maker describes use from individual laptops through fleets of agents and highlights composable policies, per-tool sandboxing, credential protection, and auditable execution.checked 8 Oct 2026
- Audit
- Filesystem operations, network attempts, and command executions can be recorded in a SHA-256 Merkle-tree audit trail and exported as JSON.checked 8 Oct 2026
- Credential handling
- The site says credentials are injected at the boundary and never exposed to the agent.checked 4 Oct 2026
- Credential protection
- With proxy-based credential injection, the agent uses a localhost proxy and does not see the real API key.checked 8 Oct 2026
- Developer interfaces
- The documentation lists a CLI, a Rust core library, and Go, TypeScript, and Python SDKs.checked 4 Oct 2026
- Execution isolation
- It creates ephemeral, invocation-scoped micro sandboxes for tool calls, with scoped files, network routes, arguments, and credentials.checked 4 Oct 2026
- Installation
- The homepage offers a shell installer, Homebrew, and links to Debian, Fedora, Arch, and Nix installation instructions.checked 4 Oct 2026
- Instruction verification
- Its Sigstore-based provenance feature verifies whether agent instruction files were signed by trusted identities before execution.checked 8 Oct 2026
- Isolation
- It uses Landlock on Linux and WSL2 and Seatbelt on macOS to enforce filesystem allow-lists that cannot be loosened after application.checked 8 Oct 2026
- Kernel enforcement
- The OS sandbox uses Landlock on Linux and Windows/WSL2 and Seatbelt on macOS; the page says no root is required.checked 4 Oct 2026
- Network control
- The homepage describes proxy-mediated network access where policy can allow or deny requests and route out-of-policy actions for human approval.checked 4 Oct 2026
- Network controls
- It can block network access, allow specific domains, filter API endpoints, and route filtered traffic through an upstream proxy.checked 8 Oct 2026
- Policy profiles
- JSON profiles define agent access and can be version-controlled alongside code.checked 4 Oct 2026
- Pricing
- The maker's site and opened product pages provide no subscription price or paid plan; a maker-authored article describes nono as free and open source.checked 8 Oct 2026
- Product
- nono describes itself as agent runtime security with kernel-enforced boundaries for AI agents.checked 4 Oct 2026
- Purpose
- nono is a kernel-enforced sandbox CLI and SDK for isolating AI agents, scripts, build tools, and other processes.checked 8 Oct 2026
- Rollback
- nono can take SHA-256 content-addressed snapshots before and after a session and restore the original state with a command.checked 8 Oct 2026
- SDKs
- The documentation describes a Rust core library and Go, TypeScript, and Python SDKs for integrating sandboxing into applications.checked 8 Oct 2026
- Support
- The documentation links to GitHub for source code and issues and Discord for community support.checked 8 Oct 2026
- WSL2 limitation
- The site reports 84% feature coverage on WSL2 and notes that some advanced capabilities are unavailable because of kernel limitations.checked 8 Oct 2026
Where it runs
- Supported platforms
- The installation guide lists Linux kernel 5.13+, macOS, and Windows through WSL2 as supported, and says native Windows is not supported.checked 8 Oct 2026
- Windows caveat
- On WSL2, the page reports 84% feature parity and says capability elevation and per-port network rules have limitations.checked 4 Oct 2026
Alternatives to nono
- 1
Context Agent Sandboxes
Free planAndroidiOSWebAPI8.0From $20 a month - 2
E2B
Free planOpen sourceWebAPILinuxmacOS8.0From $150 a month - 3
Northflank
Free planWebAPILinuxmacOS8.0From $2.70 a month - 4
Daytona
Free planWebAPILinuxmacOS7.9Free plan - 5
ANY.RUN
Free planAndroidiOSWebAPI7.5Free plan - 6
Vercel
Free planWebAPI7.0$20 usage-based