nono

nono is a security runtime for people running terminal AI agents on their own machines or servers. It uses operating system boundaries to restrict an agent's access to files, network services and credentials.

• Per-tool permissions: Give a delegated command narrower access than the agent itself, with separate rules for files, network routes, arguments and credentials.
• Credential protection: Keep real secrets with the supervisor while tools receive substitute tokens; the proxy supplies credentials at the network boundary for authorized requests.
• Network controls and approval: Restrict HTTP methods and paths, and route actions outside the supplied policy to a human decision before they execute.
• Verifiable audit records: Record security events in a cryptographic, tamper-evident trail that users can verify.
• Shared agent policies: Use signed registry profiles or composable JSON policies that teams can review and keep in version control alongside their code.

nono runs locally on macOS, Linux and Windows through WSL2, without a container, virtual machine or daemon. It works with terminal agents including Claude Code, Codex, OpenCode and Pi without requiring changes to those agents. Allowed network requests still reach external services through its proxy.

The runtime is open source under Apache 2.0. Rust, Python, TypeScript and Go bindings support embedding it in other software.