Glovebox

Glovebox — Inner sandbox for Claude Code

Don't box the agent. Box the action.

Why Glovebox?

A lab glovebox is a sealed chamber for handling things you can't be in the room with — radioactive material, toxic compounds. The operator stands outside. Gloves are built into the wall. You see through the window, you decide from outside, and only your hands cross the boundary through a narrow, controlled interface.

That's the model here. The agent is the operator. The sandbox is the box. Bash, Edit, Read, Write are the gloves — the only way anything gets touched. A hallucinated rm -rf or a prompt-injected exfiltration attempt stays inside the box.

---

Installation

1. Install MSB:

npm install -g microsandbox

2. Pull the default sandbox image:

msb pull mcr.microsoft.com/devcontainers/base:debian

3. Install the plugin:

claude plugin marketplace add jedi4ever/glovebox
claude plugin install glovebox@glovebox --scope project

Or point directly at the plugin directory for local use:

claude --plugin-dir /path/to/glovebox/plugins/glovebox

Optional: add a .glovebox.yml to your project root to configure the sandbox (image, network policy, secrets, scope). See plugins/glovebox/CONFIG.md for all options.

---

What Is This?

• Glovebox is a Claude Code plugin that routes all Claude tool calls (Bash, Read, Write, Edit, WebFetch) through isolated Micro Sandbox (MSB) micro-VMs, preventing Claude from running arbitrary commands on your host machine
• The plugin lives at plugins/glovebox/ and is usable directly — no compilation step required
• This project repo contains only the test harness (Vitest + TypeScript); the plugin itself is the deliverable

Inner vs. Outer Sandboxing

Most sandboxing approaches for AI agents are outer sandboxes — they wrap the entire Claude Code process inside a container or VM. The agent is boxed.

Glovebox is an inner sandbox. Claude Code itself runs normally on your host. What gets sandboxed are the individual actions Claude takes — each Bash command, each file read, each write — intercepted at the tool call level via Claude's hook system and redirected into a micro-VM.

This is distinct from Claude Code's own built-in sandbox: rather than restricting what Claude Code can do as a process, Glovebox replaces the execution target for each tool call. Claude thinks it's running commands locally; they actually run inside an isolated VM. The agent stays on the host; only the actions cross the boundary.

Anthropic has since embraced the same idea officially with self-hosted sandboxes for managed agents, allowing the execution plane to be delegated to providers like E2B or Daytona. Glovebox takes the same approach but locally, via MSB micro-VMs, with finer-grained control over network policy, secrets, and config.

The same pattern was pioneered by pi-gondolin — a Pi coding agent extension that uses Gondolin as its inner execution engine in the same way. That project was the direct inspiration for Glovebox.

---

Why Was It Built?

• Previous sandboxing approaches (Docker, bubblewrap, seatbelt) all had friction: secrets management, static configuration, version drift with Claude Code updates
• Claude Code's own sandbox was not restrictive enough for our purposes
• Micro Sandbox was chosen because it supports OCI/existing container images, and MSB gives a JavaScript SDK — making it programmable, not just configurable

---

The Core Problem It Solves

• When Claude Code runs bash, read, or write commands, they run on your host by default
• Glovebox intercepts those calls via Claude's hook system and transparently redirects them into a sandboxed micro-VM
• Claude doesn't know it's sandboxed — the same commands work, but execution is isolated

---

How the Hook System Works

• Claude Code supports hooks that fire at SessionStart, PreToolUse, PostToolUse, and SessionEnd
• Glovebox registers hooks in hooks/hooks.json to intercept every relevant tool
• Bash → the command is base64-encoded and wrapped as printf '<base64>' | base64 -d | msb exec -- bash to avoid shell-escaping issues
• Read → the file is pulled from the sandbox into a local shadow directory, then Claude reads the shadow copy
• Write/Edit → writes land in the shadow directory first; PostToolUse syncs them back into the sandbox
• WebFetch → denied with a hint to use curl inside a Bash call instead (so network policy applies)
• pre-tool-use.mjs handles interception; post-tool-use.mjs handles sync-back and notices to Claude

---

Sandbox Lifecycle