Panic Room, a local zero-dependency sandbox for agents

Panic Room, an open-source MIT-licensed tool, provides a zero-dependency sandbox for AI agents, giving each agent a cloned repo, fake credentials, a throwaway database, and a container, with an audit trail and a diff for human approval. The tool, available as a single Python file, logs every agent action, blocks network access to production hosts, and generates screenshots, aiming to make agent-driven code changes safe and reviewable.

Open source, MIT. Your agent gets a copy of the repo, fake credentials, a throwaway database and a container. You get an audit trail and a diff to sign off. ln -s $PWD/panic.py ~/.local/bin/panic cd ~/code/myapp panic run --db -c "claude -p 'refactor the billing module'" panic shot <id http://localhost:3000 --serve "npm run dev" panic report <id files, commands, sql, egress, screenshots panic diff <id panic approve <id applies to the real repo, unstaged panic rm <id First run builds a panicroom:base image node 22, git, chromium, psql, claude-code . After that a sandbox costs a git clone . Files. The repo is cloned to ~/.panicroom/<id /repo , your uncommitted work is carried over and committed as a baseline, so every later diff is the agent's doing and not yours. panic diff is a plain git diff; approve is a plain git apply , left unstaged for you to read before committing. No filesystem watcher, git already knows. Commands. $HOME/.claude/settings.json in the sandbox carries a PreToolUse hook that appends every tool call to /panic/audit.jsonl . That is the agent's real actions, not scraped terminal output, and it lives outside the repo so it never shows up in the diff. Database. --db starts a throwaway postgres beside the sandbox with log statement=all and points every SQL-shaped env var at it. On exit the log is kept and panic report shows the writes, reads filtered out. --db-schema dump.sql seeds it so the agent works against your real shape. Network. A proxy bound to the docker gateway, never the LAN. Every host the sandbox connects to is logged, and every host that appears in your real .env is refused with a 403. If the agent tries to reach prod, it fails and the attempt is on the record. Hosts and ports, no TLS interception. Screenshots. panic shot starts your dev server inside the sandbox, waits, and drives headless chromium at it. PNGs land in the sandbox audit dir. Every .env in the source is read for its keys, never its values. URLs keep their scheme and point at localhost, connection strings become panic:panic@localhost , everything else becomes panic-dummy-<key . The generated .env is git-excluded, so it can never ride along into approve , and it is passed to the container as --env-file so shell tools see it too. Only your agent API key crosses the boundary from your own environment. Check: python3 test panic.py round trip, proxy allow and block, sql filtering, no creds in the patch . Teams, billing, a web dashboard, a hosted control plane. One founder, one repo, one terminal. Issues and pull requests are welcome. Keep it to one Python file with no dependencies outside the stdlib, and make python3 test panic.py pass. MIT, see LICENSE /storesm/panicroom/blob/main/LICENSE .