Guide

Sandbox modes in every AI coding agent: Claude Code, Cursor, Codex and Gemini CLI compared (2026)

How do I run an AI coding agent's commands in a sandbox, and how do I allow network access?

Claude Code: run /sandbox or set sandbox.enabled and list hosts in sandbox.network.allowedDomains. Cursor: configure .cursor/sandbox.json, where networkPolicy defaults to deny. Codex: pick read-only, workspace-write or danger-full-access with --sandbox or sandbox_mode. Gemini CLI: start with -s, set GEMINI_SANDBOX or tools.sandbox, and choose Docker, Podman, macOS Seatbelt, gVisor or LXC.

Coding agent settings change often

Get one email a week when a setting, flag or permission rule changes, checked against the vendor docs.

Quick answer: how to turn it on

  • Claude Code: off by default. Run /sandbox, or set "sandbox": {"enabled": true} in ~/.claude/settings.json or .claude/settings.json.
  • Cursor: sandbox.json in ~/.cursor/ (all workspaces) or <workspace>/.cursor/ (one workspace, higher priority). type is workspace_readwrite (default), workspace_readonly or insecure_none, which disables it.
  • Codex: codex --sandbox read-only | workspace-write | danger-full-access, or sandbox_mode in config.toml. workspace-write is the default low-friction mode for local work.
  • Gemini CLI: gemini -s (or --sandbox), GEMINI_SANDBOX=true|docker|podman|sandbox-exec|runsc|lxc, or tools.sandbox in settings.json. The flag wins over the variable, which wins over the settings file.

What each sandbox uses under the hood

  • Claude Code: Seatbelt on macOS, bubblewrap and socat on Linux and WSL2. On native Windows commands run unsandboxed.
  • Codex: Seatbelt on macOS, bubblewrap on Linux and WSL2 (the first bwrap on PATH), and a native Windows sandbox in PowerShell.
  • Gemini CLI: Docker or Podman containers (default image ghcr.io/google/gemini-cli:latest), sandbox-exec (Seatbelt) on macOS, runsc (gVisor) or experimental LXC on Linux. runsc is never auto detected.

Network access

  • Claude Code: commands reach the network only through a local proxy. Allowed domains start empty; add hosts to sandbox.network.allowedDomains, block with deniedDomains, or set strictAllowlist to refuse anything unlisted.
  • Cursor: networkPolicy.default is deny unless you change it. allow and deny take exact domains, wildcards such as *.example.com (which also match example.com) or CIDR ranges. Deny always beats allow, URL paths are ignored, and private ranges, loopback and the cloud metadata IP are blocked by default.
  • Gemini CLI on macOS: pick one of six Seatbelt profiles with SEATBELT_PROFILE (permissive, restrictive or strict, each in an -open and a -proxied variant). The default is permissive-open, which confines writes to the project directory.

Claude Code: .claude/settings.json

{
  "sandbox": {
    "enabled": true,
    "network": {
      "allowedDomains": ["github.com", "*.npmjs.org"]
    }
  }
}

Cursor: .cursor/sandbox.json

{
  "networkPolicy": {
    "default": "deny",
    "allow": ["registry.npmjs.org", "*.githubusercontent.com"]
  }
}

Codex and Gemini CLI: one run

codex --sandbox workspace-write --ask-for-approval on-request
gemini -s -p "analyze the code structure"

Extra write paths and escape hatches

  • Claude Code: sandbox.filesystem.allowWrite adds paths. sandbox.excludedCommands (for example docker compose *) runs trusted tools outside the sandbox. allowUnsandboxedCommands: false turns off the unsandboxed retry.
  • Cursor: readBoundary "workspace" (Cursor 3.23 or later) asks before reading outside the workspace. disableTmpWrite: true removes write access to /tmp and temp directories.
  • Codex: sandbox_workspace_write.writable_roots adds folders in workspace-write mode. danger-full-access removes the sandbox entirely.
  • Gemini CLI: GEMINI_SANDBOX_IMAGE or tools.sandbox.image picks a custom container image.

Full sandbox guide for each agent

Get coding agent settings changes by email

When a setting, flag or permission rule in this guide changes, it goes in the weekly AgentAtlas update, checked against the vendor docs. One email a week.

Sources

Claude Code Docs: Configure the sandboxed Bash toolCursor: sandbox.json referenceOpenAI: SandboxGemini CLI: Sandboxing in Gemini CLI

Other guides

How to allow Cursor to run all commands: Run Everything, allowlist and sandboxHow to allow Claude Code to run all commands: permission modes, allow rules and skip permissionsClaude Code permissions: allow, ask and deny rules, rule syntax and allowed toolsCodex CLI: approval and sandbox modesGemini CLI: YOLO mode, auto_edit and allowing specific shell commandsCursor Privacy Mode: telemetry, training and data retentionClaude Code telemetry and data retention: what is sent and how to turn it offGemini CLI: turn off usage statistics and telemetryCLAUDE.md: where it goes, how it loads, and how it works with AGENTS.mdClaude Code hooks: format on save, block risky edits, get notifiedClaude Code subagents: create one, limit its tools, and call itAdd MCP servers to Cursor with mcp.json: Keep files out of Cursor with .cursorignore: Configure Codex with config.toml: Configure Gemini CLI with settings.json: Add MCP servers to Claude Code (claude mcp add, .mcp.json, scopes): Claude Code custom slash commands and skills (SKILL.md): GitHub Copilot custom instructions: Adding MCP servers to GitHub Copilot: Claude Code settings.json: file locations, precedence, and key settingsClaude Code plugins and marketplaces: install, create, and shareGemini CLI extensions and custom commands: Configuring OpenCode with opencode.json: Cline Rules: workspace, global, and conditional rulesKiro steering files: .kiro/steering, inclusion modes, and AGENTS.mdZed agent: instruction files, MCP servers, tool permissions, and ACP agentsCursor CLI: install, headless mode, permissions and CIAider: CONVENTIONS.md, .aider.conf.yml and API keysJunie guidelines, MCP and the Action Allowlist: Amp AGENTS.md, settings.json and MCP: Configure Goose extensions, hints, recipes and permissions: Customize OpenHands with skills, AGENTS.md, setup.sh and MCP: Configure Factory Droid CLI: AGENTS.md, settings.json, autonomy, custom droids and MCPConfigure Qwen Code: settings.json, providers, QWEN.md, MCP and approval modesCursor hooks: hooks.json, beforeShellExecution, afterFileEdit and exit codesCursor sandbox: sandbox.json, network allowlist and run modesCursor settings: settings.json, Cursor Settings and the ~/.cursor config filesCursor browser agent: @browser, browser automation and approval modesCursor subagents: .cursor/agents, frontmatter, built-in Explore and BrowserCursor telemetry and OpenTelemetry export (Privacy Mode, OTLP, Analytics API): Cursor rules setup: project, user and Team Rules, .mdc frontmatter, globs and AGENTS.mdClaude Code headless mode: claude -p, --output-format json, --bare and CI flagsClaude Code statusline: custom status bar in settings.json with context %, cost and git branchClaude Code /model: switch models, aliasesClaude Code /cost and /usage: check token spend, usage limits and reduce costsClaude Code VS Code extension: install, shortcuts, settings and /ideCodex AGENTS.md: global, project and override instruction files explainedCodex MCP servers: codex mcp add and [mcp_servers] in config.tomlCodex sandbox modes: read-only, workspace-write, danger-full-access and network accesscodex exec: run Codex non-interactively in scripts and CI with JSON outputCodex skills: create SKILL.md, skill folder locations and $skill invocationGEMINI.md in Gemini CLI: context file locations, imports and /memoryGemini CLI MCP servers: gemini mcp add and mcpServers in settings.jsonGemini CLI custom slash commands: TOML files, {{args}}, !{shell} and @{file}Gemini CLI headless mode: gemini -p, JSON output and exit codes for scripts and CIGemini CLI sandbox: enable Docker, Podman, macOS Seatbelt or gVisorcopilot-setup-steps.yml: set up the GitHub Copilot cloudGitHub Copilot CLI permissions: --allow-tool, --deny-tool, --allow-all-tools and trusted directoriesGitHub Copilot custom agents: .github/agents/*.agent.md profiles, tools and frontmatterGitHub Copilot code review settings: automatic PR reviews, rulesets, effort level and approvalsOpenCode MCP Server Setup: Local and Remote Servers in opencode.jsonOpenCode Permissions: Allow, Ask or Deny Bash, Edit and WebfetchOpenCode Custom Agents and Subagents: Markdown Files, Modes and @ MentionsCline MCP Setup: cline_mcp_settings.json for Local and Remote ServersCline Auto Approve and YOLO Mode: Run Commands and Edits Without PromptsCline Skills: SKILL.md Location, Format and Slash Command UseAmp MCP Setup: amp mcp add, amp.mcpServers and Workspace ApprovalAmp AGENTS.md: File Locations, @ Mentions and Glob-Scoped GuidanceAmp Skills: SKILL.md Folders, amp skill add and Search OrderKiro MCP Setup: .kiro/settings/mcp.json, autoApprove and OAuthKiro Hooks: .kiro/hooks JSON, PreToolUse, PostFileSave and StopKiro Permissions: permissions.yaml Allow, Ask and Deny RulesFactory Droid MCP Setup: droid mcp add, mcp.json Locations and /mcpFactory Droid Hooks: hooks.json, PreToolUse Matchers and Exit CodesFactory Droid Custom Droids (Subagents): .factory/droids Markdown FilesJunie MCP Setup: .junie/mcp/mcp.json for CLI and /mcp CommandJunie Brave Mode and Action Allowlist: Auto-Approve Commands in Junie CLIJunie Custom Slash Commands: .junie/commands Markdown Files and Argumentsgoose .goosehints and AGENTS.md: Global and Project Instructionsgoose Permission Modes: GOOSE_MODE auto, approve, smart_approve and chatgoose Recipes: recipe.yaml Format, Parameters and goose run --recipeZed Agent Tool Permissions: Auto-Approve Terminal Commands with tool_permissionsUse Claude, Codex and Gemini CLI in Zed: External Agents and agent_serversZed with Ollama, LM Studio and llama.cpp: Local Model Setup and Context LengthMCP 2026-07-28 Migration Guide: Stateless Protocol, No Sessions, server/discover, MRTR, and SDK v2 UpgradeSubagents and Custom Agents Compared: Claude Code vs Codex vs Cursor vs Gemini CLI vs GitHub CopilotAllow all commands in any AI coding agent: Cursor, Claude Code, Codex, Gemini CLI, Copilot CLI and 7 moreAdd an MCP server to any AI coding agent: Claude Code, Cursor, Codex, Gemini CLI, VS Code and 8 moreSettings file locations for every AI coding agent: Claude Code, Cursor, Codex, Gemini CLI, OpenCode, Qwen Code, Amp and Factory DroidRules and instruction files in every AI coding agent: .cursor/rules, CLAUDE.md, AGENTS.md, GEMINI.md, Copilot instructions and moreGemini CLI hooks: settings.json, BeforeTool, AfterTool, exit codes and /hooksGitHub Copilot hooks: .github/hooks/*.json for Copilot CLI and the cloud agentHooks in every AI coding agent: Claude Code, Cursor, Gemini CLI, GitHub Copilot, Kiro and Factory DroidAgent Skills (SKILL.md) in every AI coding agent: Claude Code, Codex, Cline, Amp and OpenHandsHow to deploy a remote MCP server (Streamable HTTP): Cloudflare Workers, Vercel, Railway and moreHeadless mode in every AI coding agent: claude -p, codex exec, gemini -p, Cursor agent -p and copilot -p for scripts and CIClaude Code sandbox: /sandbox, sandbox.enabled, allowedDomains, excludedCommands and strict mode

Reviewed Oct 18, 2026. Settings change often; the linked vendor docs are the source of truth.