Affiliate Disclosure: 9bests.com is supported by our readers. When you click on links and make a purchase, we may receive a small affiliate commission from the seller at no additional cost to you.

agent-run

Name: agent-run
Author: 9bests.com

agent-run is a tiny (under 1 MB) standalone binary that runs coding agents — pi, opencode, codex, or claude — inside a Bubblewrap (bwrap) sandbox. Its purpose is to let an agent operate freely inside your project without being able to touch anything outside it: the host filesystem is mounted read-only by default, and only paths you explicitly allow become read-write. It's built for catching agent mistakes, not malicious code — if an agent tries to delete your home directory or exfiltrate a file, the sandbox contains it. Configuration is a simple TOML file with per-tool sections (tools.claude, tools.codex, …) controlling env inheritance, network access, and mounts. The bwrap binary is compiled for the target platform and embedded directly into agent-run, then exec'd at runtime via a memfd, so there's no separate dependency to install. It currently supports aarch64 and x86_64 Linux and depends on unprivileged user namespaces.

★★★⯨☆ 3.8 Free (Open Source, GPL-3.0)

Visit Website 🔗 Compare Tool

📖 9bests In-Depth Review Jul 15, 2026

agent-run Review 2026: Run Coding Agents in a Tiny Sandbox That Catches Mistakes Before They Spread

In-depth review of agent-run — a sub-1MB standalone binary that sandboxes coding agents (Claude Code, Codex, OpenCode, pi) inside a Bubblewrap container. Host filesystem is read-only by default. Built to catch agent mistakes, not malware.

Read the full long-form review & analysis →

💡 9bests Editorial Buying Advice

Why choose agent-run: agent-run is a tiny (under 1 MB) standalone binary that runs coding agents — pi, opencode, codex, or claude — inside a Bubblewrap (bwrap) sandbox. Its purpose is to let an agent operate freely inside your project without being able to touch anything outside it: the host filesystem is mounted read-only by default, and only paths you explicitly allow become read-write. It's built for catching agent mistakes, not malicious code — if an agent tries to delete your home directory or exfiltrate a file, the sandbox contains it. Configuration is a simple TOML file with per-tool sections (tools.claude, tools.codex, …) controlling env inheritance, network access, and mounts. The bwrap binary is compiled for the target platform and embedded directly into agent-run, then exec'd at runtime via a memfd, so there's no separate dependency to install. It currently supports aarch64 and x86_64 Linux and depends on unprivileged user namespaces.

Optimal workflow match: Ideal for teams seeking automated and streamlined AI workflows.

✅ Pros / Key Advantages

• Under 1MB, no runtime dependencies
• Read-only host FS by default, explicit mounts only
• Catches agent mistakes before they spread
• Simple TOML config, per-tool isolation
• Self-contained embedded bwrap

❌ Cons / Limitations

• Linux-only (bwrap + user namespaces)
• Threat model is mistakes, not hardened malware
• Env vars do not expand inside mount paths
• No config merging across files yet
• Limited arch support (aarch64, x86_64)

💰 Pricing Plans & Structure

Free (Open Source, GPL-3.0)

Pricing details are gathered from public sources and are subject to change. Please visit the official website for real-time rates and trial terms.

Pricing verified from official public sources · Reviewed by Bill (Lead Editor)

🎯 Who should use agent-run

Best suited for users focused on digital productivity and AI automation who value under 1mb, no runtime dependencies.

⚠️ Who should look elsewhere

Users who require features outside its core scope or cannot accommodate linux-only (bwrap + user namespaces) may benefit from exploring alternative tools in this category.

🚀 Common use cases

Autocompleting and refactoring code

Multi-file AI edits

Debugging and test generation

⚖️ Direct Head-to-Head Comparisons

Curated Matchups

Compare Matrix → Free (Open Source, GPL-3.0) vs Free / $20/mo

agent-run vs Cursor

Side-by-side analysis of features, scores, pros, and cons.

Compare Matrix → Free (Open Source, GPL-3.0) vs $10-39/mo

agent-run vs GitHub Copilot

Side-by-side analysis of features, scores, pros, and cons.

Compare Matrix → Free (Open Source, GPL-3.0) vs Free / $15/mo

agent-run vs Windsurf (Codeium)

Side-by-side analysis of features, scores, pros, and cons.

Compare Matrix → Free (Open Source, GPL-3.0) vs Free / $25/mo

agent-run vs Replit Agent

Side-by-side analysis of features, scores, pros, and cons.

❓ Frequently asked questions

Is agent-run free?

Pricing for agent-run is available on its official site.

What is agent-run used for and what are its strengths?

Key strengths of agent-run: Under 1MB, no runtime dependencies, Read-only host FS by default, explicit mounts only. agent-run is a tiny (under 1 MB) standalone binary that runs coding agents — pi, opencode, codex, or claude — inside a Bubblewrap (bwrap) sandbox. Its purpose is to let an agent operate freely inside your project without being able to touch anything outside it: the host filesystem is mounted read-only by default, and only paths you explicitly allow become read-write. It's built for catching agent mistakes, not malicious code — if an agent tries to delete your home directory or exfiltrate a file, the sandbox contains it. Configuration is a simple TOML file with per-tool sections (tools.claude, tools.codex, …) controlling env inheritance, network access, and mounts. The bwrap binary is compiled for the target platform and embedded directly into agent-run, then exec'd at runtime via a memfd, so there's no separate dependency to install. It currently supports aarch64 and x86_64 Linux and depends on unprivileged user namespaces.

What is the best alternative to agent-run?

If you're looking for an alternative to agent-run, consider Cursor: it stands out for Best AI code editor, Multi-file editing.

How do I choose the right alternative to agent-run?

Selection advice: compare ratings, pricing, and core features within the AI Coding category, then match to your own workflow. See the comparison matrix and Top alternatives list on this page.