Sandboxed agent supervision

Govern your AI coding agent

Sandbox it. Verify its work. Approve before it lands.

Get started in 5 minutes View on GitHub

Skep terminal demo showing inline shell approval, review, branch approval, and a remembered approval template on the next run.

Transcript

$ skep run ~/code/demo "add a health endpoint" --execution-mode workspace
worker started in isolated worktree skep/019f...
approval needed: shell.run
reason: shell.run requires approval for command: python -m pytest
[a] approve once [b] approve + remember [d] deny [s] skip
> b
resumed: original -> resumed-1
re-verify: passed on clean copy
review: patch + evidence ready
approved: patch applied on branch skep/019f...
saved template: health-endpoint
$ skep run ~/code/demo "add a status endpoint" --execution-mode workspace
matched template: health-endpoint (shell: python -m pytest)
completed without new approvals

The risk

Raw coding agents move fast and wide

They can mutate repos directly

Agents can edit, commit, or push before you have reviewed the actual diff.

They can run broad commands

Package installs, shell commands, and network calls need a boundary.

They can overstate verification

A model saying "tests passed" is not the same as an independent check.

The control plane

Skep puts the agent behind a contract

Sandbox

OS-level containment

macOS Seatbelt and Linux bubblewrap keep writes and network inside policy.

Verify

Evidence over claims

Skep re-runs checks on a clean copy before you see the result.

Approve

Patch-first review

The agent produces a patch. You approve the branch when the evidence holds.

Audit

Durable run history

Events, commands, approvals, artifacts, and decisions are queryable later.

Flow

From prompt to review branch

1 run
2 sandbox
3 worker edits
4 re-verify
5 review
6 approve branch

Quickstart

Run your first supervised task

Install

pip install skep

Run and review

skep run /path/to/repo "fix the failing test" --execution-mode workspace
skep status --personal
skep review <task_id>
skep review <task_id> --approve

Linux sandboxing requires bubblewrap. Claude Code users can run with --worker-cmd "python -m skep.workers.claude_code". Prefer source? git clone https://github.com/Anmolnoor/skep.git and uv sync --frozen work too.

Why it is different

Skep adds the missing control loop

Capability	Raw coding agent	Agent Safehouse	Cursor sandbox	Skep
Sandbox boundary	Depends on the agent	Primary focus	Editor-owned	Supervisor-owned
Independent verification	Usually absent	Not the core loop	Editor-dependent	Required evidence
Patch approval	Optional	Outside the wrapper	Editor workflow	Default landing path
Audit trail	Fragmented logs	Sandbox-level logs	Editor history	Durable run store