New sw dev tool for safe local AI usage Developer Alex S. released sde, a single-binary CLI tool that creates role-separated, network-isolated containers for AI-assisted development on macOS 13 or later. The tool enforces an egress allowlist by default, keeps credentials on the host via a Unix-socket broker, and requires explicit time-boxed grants for write operations such as git push, aiming to prevent AI agents from exfiltrating code or secrets. Role-separated container isolation for AI-assisted development on macOS. sde is a single-binary CLI that boots a private, network-isolated environment for your project — a workspace container where your code and AI agents run, role-separated data services, an egress firewall, and a credential broker that keeps secrets on the host and out of the container filesystem. Think docker compose up for AI-agent-safe development: your agent gets what it needs to work, nothing more. Running an AI agent against your codebase means giving it a shell. That shell can curl , git push , aws s3 cp , and read every .env on your disk. sde draws the boundary in the right place: Egress allowlist by default — the workspace can only reach the domains you list. Everything else is NXDOMAIN at the DNS layer and DROP at iptables. Cloud instance-metadata 169.254.169.254 is always blocked. Credentials never leave the host — Git tokens live in your macOS Keychain. The workspace talks to a Unix-socket broker; tokens are minted per-operation and injected via GIT CONFIG COUNT env vars no .gitconfig on the container filesystem . Write access is grant-based — git pull is default-allowed; git push requires an explicit, time-boxed sde grant push from your host terminal. Your agent can read; you decide when it can write. AWS via credential process — no static keys in the container. sde injects a ~/.aws/config inside the workspace that calls back to the broker via credential process ; the broker shells out to aws configure export-credentials on the host, so short-lived SSO credentials are vended per-operation without touching the container filesystem. Build from source using git , go , and make — no package manager needed: git clone https://github.com/alexs60/safe-sde.git ~/src/sde cd ~/src/sde make build helper sudo make install Full instructions, Intel/arm64 notes, container image build, and air-gapped workflow: see docs/INSTALL-LOCAL.md /alexs60/safe-sde/blob/main/docs/INSTALL-LOCAL.md . Homebrew: brew tap alexs60/sde && brew trust alexs60/sde && brew install sde . The brew trust step is required for any third-party tap. See . docs/INSTALL.md sde version sde doctor sde doctor checks the configured runtime, Keychain access, credential store, and your topology file — run it any time something feels off. - macOS 13 Ventura or later — Apple Silicon or Intel Colima https://github.com/abiosoft/colima brew install colima — free, Apache 2.0, Docker-API compatible container runtime- Git Optional: - AWS CLI v2 aws configure export-credentials if you want AWS credentials available inside containers OrbStack works with a one-line topology change. See docs/RUNTIMES.md /alexs60/safe-sde/blob/main/docs/RUNTIMES.md for installation, licensing, and the runtime options reference. 1. Store a GitHub PAT so workspace containers can clone private repos sde auth github --store 2. Go to your project cd ~/my-project 3. Generate a topology.yaml from the detected stack sde init 4. Boot the environment detaches by default sde up 5. Open a shell in the workspace container sde shell 6. Grant write access when you want to push sde grant push --repo my-org/my-project --ttl 10m 7. Stop everything sde down sde up is idempotent — run it twice and it tells you the environment is already running. sde down stops containers but preserves volumes; sde nuke wipes state entirely. For a full walkthrough including AWS SSO and first-run setup, see docs/GETTING-STARTED.md /alexs60/safe-sde/blob/main/docs/GETTING-STARTED.md . project: my-project networks: subnet: 172.30.0.0/16 egress: deny all else: true allow: - registry.npmjs.org - github.com - api.anthropic.com services: dev: role: workspace image: ghcr.io/alexs60/sde/node-22-pnpm:latest mounts: - { type: bind, source: ., target: /workspace } - { type: volume, source: node modules, target: /workspace/node modules } ports: 3000, 3001 db: role: datastore image: postgres:16 env: POSTGRES DB: myapp POSTGRES PASSWORD: dev volumes: pgdata ports: 5432 credentials: provider: pat or "github-app" for teams push requires grant: true aws: profile: bedrock-dev region: us-west-2 See topology.example.yaml /alexs60/safe-sde/blob/main/topology.example.yaml for the full reference. | Command | What it does | |---|---| sde init | Detect the project stack and generate topology.yaml . --template