⚡

API Calls

Outbound API sandbox with domain allowlisting. No filesystem write access.

v1.4.0•4,201 downloads

Select Agent

Configuration

api-calls-claude.safespace
{
  "sandbox": "api-calls",
  "version": "1.4.0",
  "fs": {
    "allow_read": ["~/.config/api-keys.json"],
    "deny_write": ["~/**"],
    "deny_read": ["~/.ssh/*"]
  },
  "network": {
    "allow": ["api.stripe.com", "api.github.com"],
    "deny": ["*.internal", "localhost"]
  },
  "process": {
    "allow": ["/usr/bin/curl"]
  }
}

Quick Start

1. Download the .safespace file below

2. Open Agent Safehouse on your Mac

3. Click Import Config and select the file

4. Run safehouse start

✓ Allowed

  • network api.stripe.com
  • network api.github.com
  • read ~/.config/api-keys.json
  • execute /usr/bin/curl

✗ Denied

  • write ~/**
  • network *.internal
  • execute /bin/rm
  • read ~/.ssh/*