ScopeShelf 1.0.0 release notes

September 11, 2026 · Auf Deutsch lesen

ScopeShelf 1.0.0 is here — the first public release. The app puts AI agent tools like Claude Code or Codex (and any other app) inside Apple's Seatbelt sandbox: you decide before launch which folders are reachable, and the kernel enforces it — not „please don't touch", but Operation not permitted. No subscription, no account, all local.

Why a sandbox for AI agents?

AI coding agents work best without constant permission prompts — but the alternatives are uncomfortable: either you click „Allow" a hundred times a day (and eventually stop reading), or you launch with --dangerously-skip-permissions / --yolo and hand the agent your full user rights, including ~/.ssh, keychains and cloud credentials. ScopeShelf is the third way: declare the boundaries once, then let the agent work freely — it won't notice anything, except that outside those boundaries it simply gets blocked.

What's in 1.0.0

• Launchers with three protection zones per folder: writable, read-only, invisible. Anything in your home folder that isn't granted does not exist for the protected app. Grants cover folders or individual files.
• Per-app network switch: allowed or blocked — and optionally a per-domain filter: you provide an allowlist of domains (including *.example.com wildcards), and a local CONNECT proxy only lets those through. Without filter entries, the plain switch applies.
• Live audit log of blocked accesses: if the app tries something outside its boundaries, ScopeShelf shows the attempt straight from the macOS sandbox kernel log — operation, path, how often.
• Menu bar agent with verified protection status: shows running protected apps — and doesn't take protection on faith, it verifies it via sandbox_check against the kernel.
• Dock starters: one click in the Dock launches the app directly protected, without ScopeShelf needing to be in front.
• Change journal: during a protected session, ScopeShelf records (via FSEvents) which files in the granted write paths were modified — afterwards you see what the AI actually touched.
• CLI scopeshelf: create launchers, inspect profiles as a dry run, launch — including curated presets for common apps: scopeshelf add --preset.
• scopeshelf doctor: read-only audit of your local AI tool configuration — e.g. whether Claude Code runs with bypassPermissions, dangerous environment variables or blanket Bash(*) grants.
• .scopeshelf project configs: check folder boundaries into the repo as a file — the whole team gives their agents the same boundaries.
• Lifetime license: buy once, use forever. Offline activation via Ed25519 signature — no account, no tracking, no server dependency.

Quick start via CLI

# Create a launcher for your terminal from a preset, grant your project folder:
scopeshelf add "Terminal Claude" --preset iterm --name "Terminal Claude"
# then add grants in the launcher editor (or via CLI):
#   --write ~/repos/my-project --write ~/.claude
# Inspect the profile first:
scopeshelf dry terminal-claude
# Since 1.1: a terminal is not sandboxed as an app — open the sandboxed shell inside it:
scopeshelf shell terminal-claude --cd ~/repos/my-project

Archived release

ScopeShelf 1.0.0 runs on macOS 14 (Sonoma) or later; the DMG is notarized — no Gatekeeper workarounds needed.

These release notes describe an earlier version. Purchases and downloads are paused. ScopeShelf is coming with macOS 27.

Pricing

ScopeShelf is being prepared for macOS 27. Purchases and downloads are paused. Launch announcement · Read next: Use Claude Code without constant permission prompts · Codex CLI in YOLO mode: limit file access