AI product Open source
nono is an open-source agent runtime security tool from the team behind Sigstore. It uses kernel-enforced sandboxing with zero setup and low latency to protect AI agents, their tools, credentials, skills, and instruction files; it supports macOS, Linux, and Windows through WSL2 and runs as an unprivileged single binary. On Linux it uses Landlock and on macOS Seatbelt, while delegated tools can run in separate ephemeral child sandboxes with explicit filesystem, network, environment-variable, and credential permissions.
Its policy system controls tool commands, domain and HTTP access, and credential use through proxy-based injection and phantom tokens. It also provides Sigstore-based supply-chain and skill attestation, cryptographic audit records, file-change snapshots and rollback, agent profiles, a registry of packaged agents, and Rust and Python FFI bindings. The project is distributed under the Apache-2.0 license.
1 use taken from transcripts — each links to the moment in the video.
Open-source runtime security for AI agents with zero trust, zero setup and zero latency. It sandboxes an agent in seconds with no daemon, container or VM, enforced by the kernel via Landlock on Linux and Seatbelt on macOS, isolates delegated tools in child sandboxes, and includes a credential proxy that scopes tokens. Works with Claude Code, Codex and more.
1 in the library.