AgentToolDrop

20 of 48

nono

Runs coding agents in a least-privilege sandbox with per-tool filesystem, network and credential rules

  • score 45
  • 4.5k stars
  • 17.6 stars/day since creation
  • pushed
  • v0.80.0 on
  • Apache-2.0

Install with Homebrew

brew install nono

Copied from the project's docs at github.com/nolabs-ai/nono

Why you'd want it

nono wraps an agent such as Claude Code, Codex or Pi in a sandbox with no daemon, container or VM, and shows the exact filesystem, network and credential access before applying it. Profiles for common agents are pulled from the nono registry and can be extended into an editable JSON profile. Tools the agent calls, such as git, gh, curl or kubectl, can run in their own command sandboxes with separate filesystem and network policy, and credentials reach them through a proxy that can filter by HTTP method and path.

Best for

  • Sandboxing Claude Code, Codex or Pi locally
  • Scoping credentials to one tool
  • Sharing reviewed agent profiles with a team

Use it when

You want to run a coding agent on your own machine with explicit filesystem, network and credential limits, without setting up containers or VMs.

Skip it if

You want VM or container isolation; the README says nono runs with no daemon, container or VM. APIs may still change before 1.0, and Windows is supported through WSL2. It runs agent commands and brokers credentials, so review a profile's grants before pulling it from the registry.

Editor's note

Other install routes (install script, Nix, Debian, Fedora, Arch) are listed in the README and at nono.sh/docs.

Related tools

Same category or shared tags.

  1. Rank 17

    smolvm

    Sandbox

    Runs agent workloads in local microVMs with their own kernel, which you can checkpoint, branch and pack

    • score 47
    • 6.7k stars
    • 22.4 stars/day since creation
    • pushed
    • v1.28.1 on
    • Apache-2.0

    Install with Homebrew or the install script

    brew install smol-machines/tap/smolvm                  # macOS (Homebrew)
curl -sSL https://smolmachines.com/install.sh | bash   # macOS + Linux
    Use it when, skip it if, stats for smolvm

    Why you'd want it

    smolvm boots any OCI image as a hardware-virtualized VM with its own guest kernel, using Hypervisor.framework on macOS, KVM on Linux or the Windows Hypervisor Platform, with no Docker daemon. Networking is off by default, egress can be limited to named hosts, and credential substitution lets code use a secret without reading it. A running machine can be checkpointed, rewound or branched into copy-on-write copies, packed into a single .smolmachine file, and driven from Node, Python or Rust SDKs that run in your process without a daemon.

    Best for

    • Running untrusted agent code on your own machine
    • Branching an agent's environment mid-run
    • Embedding VMs in your own app

    Use it when

    You want each agent task in a real VM on your laptop or server, with egress allow lists and the option to snapshot or branch the machine.

    Skip it if

    Containers or a hosted sandbox already give you enough isolation. The README calls safety a shared responsibility: every folder you mount, port you open, host you allow and secret you forward becomes usable by the workload. GPU acceleration is unavailable on Windows, and Intel macOS is marked untested.

    Stats

    New and rising score
    47 of 100
    Stars per day, since repo creation
    22.4
    Release
    v1.28.1,
    License
    Apache-2.0
    Pricing
    Open source
    Works with
    macOS, Linux, Windows
    Forks
    330
    Open issues
    98
    GitHub checked

    Full stat block for smolvm

  2. Rank 48

    Container Use

    Sandbox

    Gives each coding agent its own container and git branch so several can work in parallel without conflicts

    • score 11
    • 4.1k stars
    • 8.0 stars/day since creation
    • pushed
    • v0.4.2 on
    • Apache-2.0

    Install with Homebrew and add to Claude Code

    brew install dagger/tap/container-use
cd /path/to/repository
claude mcp add container-use -- container-use stdio
    Use it when, skip it if, stats for Container Use

    Why you'd want it

    Container Use is an MCP server, run from a CLI and built on Dagger, that gives each agent a fresh container on its own git branch, so you can run several agents at once and discard failed attempts. You can see the full command history and logs of what an agent did, drop into its terminal to take over, and review its work with a normal git checkout of its branch. Setup is the same for any MCP-compatible agent, adding container-use stdio as an MCP server, and the docs have guides for Claude Code, Cursor, Windsurf, Zed, Codex, Gemini CLI and others.

    Best for

    • Running several coding agents in parallel
    • Keeping agent changes off your working tree until reviewed
    • Claude Code, Cursor and other MCP agents

    Use it when

    You want coding agents to work in isolated, reviewable environments on your own machine instead of directly in your checkout.

    Skip it if

    You do not have Docker and Git installed, which the quickstart requires. The project describes itself as experimental and in early development.

    Stats

    New and rising score
    11 of 100
    Stars per day, since repo creation
    8.0
    Release
    v0.4.2,
    License
    Apache-2.0
    Pricing
    Open source
    Works with
    Claude Code, Cursor, Windsurf, Zed, Codex, Gemini CLI, VS Code, Any MCP client
    Forks
    212
    Open issues
    63
    GitHub checked

    Full stat block for Container Use

  3. Rank 7

    Open Code Review

    Devtool

    Reviews Git diffs with a deterministic rule layer plus an LLM agent and writes line-level review comments

    • score 61
    • 47.3k stars
    • 314 stars/day since creation
    • pushed
    • v1.13.0 on
    • Apache-2.0

    Install with npm

    npm install -g @alibaba-group/open-code-review
    Use it when, skip it if, stats for Open Code Review

    Why you'd want it

    Open Code Review is a CLI that reads Git diffs and sends changed files to a configurable LLM through an agent that can read full files and search the codebase. Deterministic code, not the model, handles file selection, bundling of related files into sub-agent review units, and matching review rules to each file. Besides diff review, ocr scan reviews whole files, and delegation mode lets your own coding agent do the review so no OCR API key is needed. The docs list CI integrations for GitHub Actions, GitLab CI, GitFlic CI and Gerrit, and plugins for Claude Code, Codex, Cursor, Kimi Code and OpenCode.

    Best for

    • Reviewing pull requests in CI
    • Rule-driven review of large changesets
    • Giving a coding agent a review command

    Use it when

    You want a code review step that runs from the command line or CI and keeps file selection and rule matching in fixed code instead of in a prompt.

    Skip it if

    You need high recall; the README says its recall is lower than general-purpose agents, a deliberate trade-off for precision. It needs Git 2.41 or newer and, outside delegation mode, an LLM provider with an API key you enter, and it sends changed files to that endpoint. The README links an OpenTelemetry telemetry page, so read it before using the tool on private code. The repo is about five months old and ships releases every few days.

    Stats

    New and rising score
    61 of 100
    Stars per day, since repo creation
    314
    Release
    v1.13.0,
    License
    Apache-2.0
    Pricing
    Open source
    Works with
    Claude Code, Codex, Cursor, macOS, Linux, Windows
    Forks
    3,444
    Open issues
    311
    GitHub checked

    Full stat block for Open Code Review

For agents

The same entry, as files an agent can read without scraping this page. 

# read one entry
curl -s https://agenttooldrop.com/tools/nono.md

# list the MCP servers in the catalog
curl -s https://agenttooldrop.com/tools.json \
  | jq -r '.tools[] | select(.category=="mcp-server") | .slug'