lamp-the-djinnFull autonomy for any coding agent, none of the risk.

The agent gets free rein inside a disposable cage. Your files, credentials, and network stay out of reach.

Runs anything

claude, aider, pi, or any command you pass — harness- and model-agnostic by design. One LiteLLM proxy fronts your models, so real API keys never enter the cage.

Touches only your project

A Docker cage mounts just the project directory, at its real path. Everything else on your machine is unreachable; the cage is destroyed on exit.

Default-deny network

An iptables firewall blocks all outbound traffic except an explicit domain allowlist — the agent can't exfiltrate your code or secrets.

Git as undo

Review the diff the agent produced, then keep it or git reset --hard it away. The cage is ephemeral; your judgment is the gate.