AI with a seatbelt

Claude, VS Code, and other apps run in a sandbox and can only see what you allow them to see. It's a breeze.

Download for free

Works on macOS 26 and 27.

BX windows: the launcher list with Claude, Claude Code, Cursor and other apps, next to the protection view showing which folders a launcher may read or write.

No VM, no containerSame apps, same folders, same workflow – only the field of view is smaller.
It only sees your projectEverything else is not locked away, it is simply not there: credentials, mail, messages.
The sandbox macOS brings itselfNo change to the app, no extra service, no elevated rights.

You decide what the app gets to see

Without BX every program reaches as far as you do.With BX it reaches your project and no further.

What BX does for you

Set it up once, then every app starts inside its own sandbox – and you can see at any time what it is allowed to touch.

Set up once, then one click

Set up your launcher with `+`: pick the app and one or more folders. Adjust the name if you like. Done.

After that you start it from the BX window, from the menu bar, with an icon in the Dock, or by typing its name in a terminal. The app comes up the way you know it – with its settings, its logins and its extensions.

The BX window with the launcher list on the left and the settings of the selected launcher on the right: name, Dock and the collapsed “Advanced” section.

See what the session may do, before it runs

The protection view shows, as a tree, what may be read, what may be written and what cannot be seen at all. Right-click to change it, for this one launcher or for all of them. No guessing, and no configuration file to decipher first.

The BX protection view as a tree: entries in the home folder marked as writable, read-only or blocked.

In the Dock like an app of its own

Every launcher can have an icon of its own – the icon of the app it starts, with the BX “seat belt” mark on it. In the Dock that shows at a glance which copy starts confined. All of them together sit there as a stack and open with one click.

The “bx” stack opened in the Dock: ChatGPT, Claude Desktop, Gemini, IntelliJ IDEA, opencode, Visual Studio Code and Xcode, every icon carrying the BX sign.

A menu bar that says what you are working in

Protected by BX, by a sandbox of its own, or not at all. Plus a warning when a tool runs unprotected although a launcher for it exists – the most common way people switch off their own protection by accident.

The BX menu bar item: the frontmost app shown as “sandboxed by BX”, with every launcher below it ready to start.

The same engine on the command line

bx run, bx dry and bx list – plus every launcher under a short name of its own. If you want, it takes the folder you type the command in, so the same alias fits in every project.

Command line settings: the alias “viscode” starts the launcher as “bx viscode”, optionally in the current folder.

Rules as readable text files

.bxignore, in gitignore syntax, with comments and under version control – globally, per launcher or per project tree.

What was turned away is recorded

When a tool fails, BX marks the denied accesses exactly where they happened in the tree, with the name of the program next to them. “It does nothing and I have no idea why” turns into a list you open up one by one – for sensitive places such as the SSH folder only after asking.

Common apps are recognised

VS Code and its variants, JetBrains IDEs, Claude Desktop, ChatGPT, Xcode and a dozen command line agents already come with what they need in order to run – including the Electron quirks that would otherwise keep them from starting. Only what is really installed on your Mac is offered.

Common questions

I don't write code at all - is BX any use to me?

Absolutely, because an AI app that can read files reads them with your rights - and so does everything it starts. A single “have a look in my folder” is enough to put your tax documents, your mail archive and your password database within reach.

Give it a launcher instead. It gets the folder you meant, and nothing beyond it.

Two things worth knowing:

Quit the app first. If it is already running unprotected, starting the launcher only opens a window in the process that is already there - silently, without a sandbox. BX’s menu bar item points that out.
The value often sits in the extensions, not the app. An MCP server started as npx some-mcp-server is code from a stranger, running as a child process with your full rights. That is exactly what the sandbox is around.

What does `pnpm install` have to do with this? I don't use AI at all

Everything you start reads with your rights, agent or not:

Package installs and builds - pnpm install, pip install, cargo build, make, Gradle. Postinstall scripts are the most used dependency vector there is, and this happens daily.
Mac-native toolchains that cannot be containerised - Swift, code signing, Fastlane. There is no Docker for these, and it is exactly where App Store Connect keys and signing identities live.
Client separation in contract work - client A’s material stays out of reach while you work for client B. A contractual argument, not a fear-based one.
Unfamiliar repositories - clone from GitHub and take a look. .vscode/tasks.json, .envrc, git hooks and the Makefile all run before you have read a line.

Any app that macOS does not already confine can go into a sandbox. For most of them it is not worth the trouble - for the ones that execute code you did not write, it is.

Where does the protection end?

BX is a file system read filter. A session may still run anything and reach the network - it simply sees less. In other words: BX protects against curiosity and accidents, not against an attacker.

Seatbelt escapes are documented, and whatever a process can read it can also transmit. That covers the realistic problem, which is not a targeted attacker but a tool that reads more than it needs to and forwards it somewhere. Running deliberately malicious software is not what BX is for.

There is also nothing to gain for apps that already carry Apple’s own sandbox - they cannot take a second one. BX does not even offer them for selection.

What about virtual machines, Docker and the free scripts?

A virtual machine isolates harder - but your Mac programs do not run inside it. The sandbox an AI tool ships with encloses that one tool, not the extension next to it. The free scripts use the same macOS sandbox, but only for terminal agents and only on the command line.

BX sits around the whole app, on your own Mac. The full comparison also says when something else is the better choice.

How do I put one particular tool into a sandbox?

There is a guide for the ones that come up most: Claude Code, Cursor and VS Code, and keeping your keys and credentials out of reach.

If you would rather see the mechanism first: sandbox-exec and the macOS sandbox, explained. All of them are on the guides page, and they are useful whether or not you ever buy anything.

Which macOS versions can I use BX on?

BX runs on macOS 26 and 27.

What does BX cost?

You get the license as a one-time purchase, no subscription. Try BX for three days with no obligation and pay afterwards if you want to keep using it.