SANDBOX FOR AI TOOLS · MACOS

A sandbox for AI tools
on your Mac.

Let the AI work. You decide what it can touch. ScopeShelf runs your terminal or app inside the macOS Seatbelt sandbox: project folder writable, references read-only, private folders invisible.

Try free for 7 days See what's inside

No credit card, no account. Then €19 once — no subscription.

  • Project folder writable, references read-only, private folders invisible.
  • SSH keys, keychains and cloud credentials are blocked by default.
  • Cut an app's network access with one switch.
  • Watch blocked accesses live in the audit log.

sandbox-exec · Seatbelt profiles · macOS 14+ · Apple Silicon & Intel

ScopeShelf — Übersicht
ScopeShelf showing the launcher overview with protection status

macOS 14+ · Apple Silicon & Intel · runs sandboxed apps even when closed

For Claude Code, Codex & Co.

YOLO mode without flying blind.

claude --dangerously-skip-permissions and codex --yolo are popular because constant permission prompts break your flow. ScopeShelf gives you the third option: set the access boundaries before launch — one launcher per tool or project — and let your AI agent work inside them. Blocked accesses show up live in the audit log.

Project folder — writable

References — read-only

Private folders — invisible

Inside folders you granted as writable the AI can still delete and modify — that's by design. ScopeShelf limits file access upfront instead of warning you after the fact.

Step-by-step guides: Claude Code without constant prompts · Codex in YOLO mode, with limits

Try free for 7 days

Constant permission prompts break your flow.

AI agents want to work — and your terminal asks for permission on every move. Or you switch the prompts off entirely and open everything.

Approving every single action kills the flow.

Claude Code asks about files, commands, directories. After the hundredth „Allow“, nobody reads any more.

YOLO without boundaries means the AI reads everything.

With --dangerously-skip-permissions or --yolo the agent runs with your full user rights — including ~/.ssh, keychains and cloud credentials.

Hand-rolled sandboxing is an arcane dialect.

sandbox-exec ships with every Mac, but nobody wants to maintain Seatbelt profiles per tool. So almost nobody does.

ScopeShelf writes and maintains those profiles for you — per tool, in plain sight, reusable.

Try free for 7 days

The sandbox is built into macOS.
We made it usable.

Why ScopeShelf exists

It started with an app I didn't trust.

A while back I downloaded a small utility — closed source, from a vendor I'd never heard of, solving exactly my problem. Before double-clicking, I caught myself thinking: the moment this thing launches, it can read my entire home folder. SSH keys, cloud credentials, client projects. With my full user rights, no questions asked.

The irony is that macOS has shipped the answer since 2007: Seatbelt, the same kernel sandbox Apple uses for its own apps. sandbox-exec sits in /usr/bin on every Mac. But writing Seatbelt profiles by hand is tedious, the syntax is unforgiving, and one rule in the wrong order silently breaks the whole thing. So I wrote one profile, then a generator, then a GUI.

That became ScopeShelf. My apps live on a shelf now, each with exactly the folders I granted — and when one of them tries something I didn't allow, macOS blocks it and my audit log shows me it tried. I still use that little utility. It just can't read my life anymore.

— Christof, builder of ScopeShelf

Features

One job, done properly.

ScopeShelf does exactly one thing: it decides what each app can reach. Everything below serves that.

🗂

Three protection zones

Writable, read-only, invisible — per launcher, per folder. Read-only is enforced by real deny file-write* rules, not by politeness.

🔑

Credentials blocked by default

~/.ssh, ~/.gnupg, ~/Library/Keychains, ~/.aws and ~/.config/gcloud are invisible to every launcher before you grant anything.

🌐

Network off, per app

One switch adds deny network-outbound. The app keeps running — it just can't send anything anywhere.

📜

Live audit log

Start a recording and watch macOS work: which operation, which path, how often. Proof beats promises.

🚀

Dock starters

Turn any launcher into a small clickable app for your Dock. Double-click, sandboxed — ScopeShelf doesn't need to be open.

🛡

Menu bar status

The menu bar extra shows which watched apps are running protected — and warns you when one is running without its sandbox.

⌨️

CLI and project configs

scopeshelf run, dry, add, presets — plus a .scopeshelf file per project directory. Scriptable, diffable, yours.

📦

Curated app presets

VS Code, Cursor, Windsurf, WebStorm and iTerm ship with their known data folders. One command, sensible sandbox.

How it works

Built on the sandbox Apple ships.

No kernel extension, no helper daemon, no cloud. ScopeShelf renders a Seatbelt profile per launcher and starts the app through sandbox-exec — the enforcement is macOS itself, and it keeps working when ScopeShelf is closed.

Terminal — scopeshelf dry 
$ scopeshelf dry "VS Code"
(version 1)
(allow default)                          ; system paths stay usable
(deny file-read* file-write* (subpath "/Users/christof"))   ; your home: invisible
(allow file-read* file-write* (subpath "/Users/christof/Projects/work"))  ; granted: writable
(allow file-read* (subpath "/Users/christof/Documents"))
(deny file-write* (subpath "/Users/christof/Documents"))    ; granted: read-only
(deny file-read* (subpath "/Users/christof/.ssh"))          ; always blocked
(deny network-outbound)                  ; no network for this app

This is the actual profile, abridged. Rule order matters — ScopeShelf's renderer gets it right every time.

Try free for 7 days

Security

Enforced by the kernel, not by us.

ScopeShelf doesn't intercept anything itself. It writes rules; macOS enforces them. That distinction is the whole point.

Kernel-enforced rules

Seatbelt rules are evaluated by the macOS kernel. The sandboxed app cannot switch them off — and neither can a bug inside it.

Invisible means denied

„Invisible" folders get real deny rules. The app can't read them, can't write them, can't even see they exist.

Read-only means read-only

Read-only folders receive explicit deny file-write* rules. Open them, yes. Modify them, no.

Verified protection

The live status checks each running process with the system's own sandbox_check. If ScopeShelf says „protected", macOS confirmed it.

Honest about what it sees

If the protection state of a process can't be determined, ScopeShelf says exactly that — it never claims a protection it can't verify.

Nothing new in your system

No kext, no launchd daemon, no root privileges. ScopeShelf composes tools your Mac already has — and removes nothing when you uninstall it.

Try free for 7 days

Privacy

All local. No account. No telemetry.

We don't know who you are, and we like it that way.

🚫 No telemetry, ever

No analytics SDK, no crash reporting you didn't ask for, no usage metrics. The app makes no network connections of its own.

🗄 Local-first by design

Launchers, profiles and audit logs live in your user folder. There is no ScopeShelf cloud to leak, breach or subpoena.

👤 No account

You download the app and it runs. No sign-up, no email verification, no password to forget.

🧾 Sold by Polar, not by data

Polar.sh is our merchant of record. They process the payment; we receive an email address for your license. Nothing else changes hands.

Pricing

Buy once. Own it.

One payment, no subscription. Sold by Christof Müller (Switzerland) via Polar.sh as merchant of record — VAT handled properly, invoice included.

Personal

€19 once

For developers, freelancers and anyone who installs software they don't fully trust.

  • ✓ Unlimited launchers & sandboxed apps
  • ✓ GUI, menu bar agent & Dock starters
  • ✓ CLI with presets & .scopeshelf project configs
  • ✓ Live audit log & verified protection status
  • ✓ 1 user, install on all your own Macs
  • ✓ Every 1.x update included — a future v2 would be an optional upgrade
  • ✓ 7-day free trial, no credit card, no account
  • ✓ 14-day money-back guarantee
Buy now for €19 Download free 7-day trial

Good to know before you buy: ScopeShelf is signed with our Apple Developer ID and notarized by Apple — Gatekeeper opens it straight from the download, no warning. The only real limitation: apps that already ship Apple's own App Sandbox can't be wrapped; ScopeShelf detects them and tells you.

Honest expectations

What ScopeShelf is and isn't.

Please read this before you buy. It saves both of us a refund.

✓ What it is

  • A launcher that runs your Mac apps under the macOS Seatbelt sandbox.
  • Per-app control over which folders are writable, read-only or invisible.
  • A way to cut an app's outbound network access entirely.
  • A live log of the accesses macOS blocked.
  • A GUI plus a scriptable CLI with per-project config files.
  • Built entirely on macOS built-ins: sandbox-exec and Seatbelt profiles.

✗ What it isn't

  • Not an antivirus: it doesn't scan, detect or remove malware.
  • Not a connection filter like Little Snitch: the network switch is all-or-nothing per app, not per-host rules.
  • Not for apps that ship Apple's own App Sandbox — macOS won't nest sandboxes, and ScopeShelf says so when it detects one.
  • Not a container or VM: sandboxed apps share your kernel and filesystem semantics — and the performance of your real Mac.
  • Not a guarantee against malicious software: Seatbelt shrinks what an app can reach; it can't make hostile code safe.
  • Not cloud-managed: no account, no dashboard, no sync, nothing to log into.

Frequently asked

Questions, answered.

Is there a free trial?

Yes: 7 days, full features, no credit card, no account. Download, sandbox your first app, decide.

Refund policy?

14 days, money-back, no questions asked. Email [email protected] from the address you bought with.

How do updates work?

Every 1.x update is free, for as long as the OS allows. A future v2 would be an optional paid upgrade — your v1 keeps working either way.

Is the app signed and notarized?

Yes — signed with our Apple Developer ID and notarized by Apple. The app opens right after the download, no warning, no right-click dance. And it makes no network connections of its own — sandboxed or not.

Why can't ScopeShelf sandbox some of my apps?

Apps signed with Apple's own App Sandbox can't be nested inside another sandbox — macOS simply refuses. ScopeShelf detects this when you pick the app and tells you before you buy a launcher for nothing.

Do Electron apps work?

Yes. ScopeShelf handles their helper processes and the inner Chromium sandbox (--no-sandbox), so the outer Seatbelt rules apply cleanly to the whole app.

Is there a command-line interface?

Yes — scopeshelf with list, run, dry, add, remove, init and presets. Extras: --env for environment variables, a :ro suffix for read-only folders, and .scopeshelf config files per project.

Which macOS versions are supported?

macOS 14 Sonoma or later, on Apple Silicon and Intel.

What exactly does the network block cover?

deny network-outbound blocks all outbound connections for the app and its child processes — TCP, UDP, the lot. It's deliberately all-or-nothing per launcher, not per-host filtering; for that, a connection-level firewall remains the right tool.

What if an app needs a folder I didn't grant?

It simply doesn't see it — as if the folder didn't exist. Most apps cope fine. If one misbehaves, the audit log shows exactly which access was blocked, and granting that folder takes one click.

Does ScopeShelf replace Claude Code's built-in sandboxing?

No, and it doesn't have to. Claude Code can sandbox itself — but the rules live inside the tool, per session. ScopeShelf manages the boundaries visibly and reusable on the outside: one launcher per tool or project, the zone model (writable/read-only/invisible), and a live log showing what macOS actually blocked — across Claude Code, Codex and any other app.

Talk to us

Bug, feature wish, or question before buying?

We read every message and usually reply within a working day.

Or email [email protected] directly.

From the same workshop

Two more tools from the shelf.

DeviceShelf

Map your network, with DeviceShelf

Our local-first network scanner: every device on your LAN, open ports, a security report and presence alerts. Same principles: one-time purchase, no account, no telemetry.

Discover DeviceShelf ↗
ServerShelf

Know your servers, with ServerShelf

Our local-first server cockpit: SSH inventory, Docker, TLS and uptime monitoring, AI log triage — with your own key. Same principles: one-time purchase, no account, no telemetry.

Discover ServerShelf ↗