Project Isolation With Filesystem Based Access Control

via “worktree isolation and filesystem sandboxing”

Bash is all you need - A nano claude code–like 「agent harness」, built from 0 to 1

Unique: Combines path validation (s01) with filesystem-level isolation, creating a complete sandbox where agents can safely modify files without affecting other agents or the host system. This is the culmination of all previous security and isolation patterns.

vs others: More complete than simple path validation because it provides true isolation at the filesystem level. Agents can be run in parallel without coordination, unlike shared-filesystem approaches that require locks or careful ordering.

via “project isolation with filesystem-based access control”

A Model Context Protocol (MCP) server implementation for remote memory bank management, inspired by Cline Memory Bank.

Unique: Implements project isolation through filesystem directory structure rather than application-level access control lists, leveraging OS-level permissions and path validation for enforcement

vs others: Simpler than database-backed access control because it uses filesystem structure, but less flexible because isolation is tied to directory naming and filesystem permissions rather than configurable ACLs

via “configurable-root-directory-isolation”

MCP server for filesystem access

Unique: Implements filesystem sandboxing at the MCP server level with configurable root directories and path normalization, preventing directory traversal without requiring OS-level capabilities or containers

vs others: Simpler to deploy than container-based isolation while providing stronger guarantees than application-level checks alone, with explicit configuration making security boundaries visible and auditable

via “filesystem-write-restriction-with-safe-zone-allowlisting”

Show HN: Yolobox – Run AI coding agents with full sudo without nuking home dir

Unique: Implements allowlist-based write restriction specifically targeting the home directory preservation problem, using kernel-level enforcement rather than application-level checks that agents could bypass

vs others: More robust than application-level permission checks because it operates at the syscall level where agents cannot circumvent restrictions, while simpler than full mandatory access control (MAC) systems

via “user-isolated-filesystem-abstraction-with-userfs”

A computer you can curl ⚡

Unique: Implements filesystem isolation via FastAPI dependency injection with UserFS abstraction that normalizes and scopes all file paths to user directories, preventing directory traversal without requiring OS-level containerization or separate processes

vs others: Simpler to deploy than per-user containers or chroot jails because it uses logical isolation at the application layer, but weaker than OS-level isolation and requires careful path validation to prevent escapes

via “execution-context-isolation-with-controlled-resource-access”

I made this for myself, and it seemed like it might be useful to others. I'd love some feedback, both on the threat model and the tool itself. I hope you find it useful!Backstory: I've been using many agents in parallel as I work on a somewhat ambitious financial analysis tool. I was juggl

Unique: Implements fine-grained resource isolation using OS-level namespaces and capability dropping, allowing precise control over what code can access while maintaining execution efficiency — goes beyond simple process isolation by controlling file system, network, and system call access

vs others: Lighter-weight than container-based isolation (Docker) because it uses kernel namespaces directly rather than full container runtime; more flexible than static allowlists because it can be configured per-execution based on code requirements

via “secure directory browsing”

Browse directories and read files within a safe, configurable root. Pull accurate context from local projects and docs without leaving your workflow. Limit access to a chosen root to keep your environment secure.

Unique: Utilizes a configurable root directory to enforce strict access controls, unlike traditional file access methods that may expose the entire file system.

vs others: More secure than standard file access libraries as it restricts visibility to a defined root, reducing risk of data leaks.