MOOTER · SECURITY · DES. 013ESC 1:1 · REV v1.53.0 · 2026-08-28

The 4-layer sandbox, in the open.

CVE-2025-59528 — the Antigravity sandbox escape (CVSS 10.0) — is why Mooter ships sandboxing as mandatory. There is no --no-sandbox: when no backend can enforce these layers, the orchestrator refuses to spawn and tells you what to install.

coverage2 of 3on windows no agent is spawned at all

Backends today: Linux via bubblewrap, macOS via Seatbelt (sandbox-exec). Windows has no backend yet — local spawns are reported unavailable, never run unprotected.

sandbox4 layersall mandatory — there is no mode without them
  1. 01Network egress

    An empty network namespace for isolated spawns — a local agent has no route off the machine.

  2. 02Filesystem boundary

    Read-only root, exactly one writable worktree, and secret directories masked out of view.

  3. 03Secrets scoping

    Cleared env plus an explicit whitelist — provider API keys are excluded from local spawns.

  4. 04Config protection

    Your settings stay read-only. A spawned agent cannot rewrite the rules it runs under.

verify2 commandsspawn-test must block 3 accesses
Verify it yourself

mooter security audit reports the layers active on your host. mooter security spawn-test runs a real escape attempt and must block reading ~/.ssh, writing outside the worktree, and leaking the API key.

sourceMITthe sandbox is in the repository
← Back homeopen source, MIT · audit the sandbox on GitHub