YSA – Sandbox for AI agents with outbound network control
Defense-in-depth sandboxing for Claude agents: Podman + MITM proxy + seccomp + iptables.

Outbound-only agent networking on PubNub, but agent control planes are getting crowded.
AI agent developers, teams deploying agents across different runtimes
LangGraph · MCP · Twingate
Defense-in-depth sandboxing for Claude agents: Podman + MITM proxy + seccomp + iptables.
Blocks agent tool calls if shared world state has changed since the last read.
Models human attention as a constrained resource instead of just another agent orchestrator.
Portainer alternative keeping compose files on disk with outbound-only agent connectivity.
Firecracker microVMs isolate coding agents so you can review before merging.
Docker sandboxing for agents when most runners just trust whatever the LLM outputs.