AxioLogic Contained Agents puts the AI agent of your choice in an isolated sandbox: it reaches only the folders and hosts you explicitly grant — and every file operation and every request through its only exit, allowed or denied, lands in an audit log you can watch live.
Download How it works$ contained logs -f my-project 14:02:11 my-project fs open_r /work/src/billing.ts 14:02:14 my-project net ALLOW api.openai.com:443 14:02:19 my-project fs open_w /work/src/billing.ts 14:02:20 my-project fs create /work/src/billing.test.ts 14:02:26 my-project net ALLOW registry.npmjs.org:443 14:02:31 my-project net DENY telemetry.some-sdk.io:443
AI agents no longer just suggest code — they act.
An AI agent reads and changes files, runs programs and talks to services on the internet — on the same computer that holds your projects, your private files, your passwords and keys. Whether it is one agent on your own laptop or several in a team, you want three things the agent itself does not give you:
AxioLogic Contained Agents provides all three on an ordinary Windows or Linux computer with Docker, for the command-line agent you choose.
In addition, organisations that have to account for what software does on their computers — in security reviews, audits or for compliance — can use the audit log as evidence and the sandbox definitions as policy that is reviewed and approved before an agent runs.
Three ideas, applied consistently.
Any command-line agent that runs in a Linux container. Ready-made settings come with the application for Aider, Claude Code, Gemini CLI, OpenAI Codex CLI and OpenCode; any other agent is set up in the same form. The agent is not part of the product: it works with your own account at its provider.
The agent's world is what you mount and allow: folders, network host:port pairs, settings. Everything else simply does not exist inside the sandbox — the network is default-deny, with no route around the built-in proxy.
Every request through the sandbox's proxy with its verdict, every file operation in audited folders — timestamped, filterable, queryable. Watch it live in the application or tail it from the command line. Metadata, not contents: honest by design.
Create sandboxes in a form, enter API keys once, start and stop agents and watch their logs — all in one window; nothing listens on the network. Docker is handled for you, and any sandbox exports to YAML that applies anywhere.
Work with the agent in its own terminal inside the application. Agents with a conversation interface — so far Claude Code — also get a chat view: streamed answers, every tool call with its result, file edits as diffs.
Agents run unprivileged; containers drop all Linux capabilities beyond the minimal audit needs, with no-new-privileges set. The network proxy runs on a read-only filesystem with zero capabilities.
Security tools should say precisely what they do — and what they don't.
Questions, a pilot in your organisation, or a bug to report.
Contact form