Score the harness you already use and run any agent in a box that is created, does the work and is destroyed, with no internet (by default) and without your secrets files. With or without a screen.
caixa-do-agente (Agent Box) is a free kit for people who already use AI agents on their computer, such as Claude Code, Codex or DeepSeek Harness. The harness is the software around the model: it runs the commands, controls the permissions and keeps the history. The kit scores the harness you use from 0 to 10 and runs any agent or command in a disposable Docker box, with no internet and without your secrets files (.env). You need Docker and Python 3.
The video behind this kit (in Portuguese): DeepSeek's body, academy and manager, and why the harness matters as much as the model.
When you let Claude Code, Codex, or your Jarvis tinker with your computer on its own, it can reach everything. It almost never makes a mess, but all it takes is one mistake or a malicious prompt hidden in a website or file.
It reads .env files, API keys, and SSH keys.
It can send your data out or download something malicious.
It can delete or damage the real project.
./caixa.sh ~/meu-projeto -- npm testMakes a copy of the project in a temporary folder and leaves out passwords and keys.
The agent works on the copy, in a Docker container without internet, with memory, processor, and time limits.
Shows what changed in a .patch file, deletes the container, and deletes the copy.
Your original project doesn't change. You read the .patch and only apply it if you like it (patch -p1, in step 6). It's like letting a builder work on a model of your house, without the safe key: at the end, you check what they did and decide whether to do the same in the real house.
python3 auditar.py ~/meu-projetoIt only reads, changes nothing, and gives a score from 0 to 10 for the protection you already have, based on 6 questions:
Does the agent run in isolation?
Does someone confirm before dangerous actions?
Are there blocks that don't depend on the prompt?
Is there a test to prove the work is correct?
Does the agent have project instructions and memory?
Are passwords out of its reach?
For each missing layer, the auditor points to the INEMA kit that addresses it.
In one sentence: your agent is the employee; caixa-do-agente is the secure room where any employee works, plus a score that tells you how protected your room is.
Watch the video explanation (in Portuguese):
DeepSeek reported that the same model (V4.1 Flash) solves 65.6% of the DeepSWE tasks (a benchmark of real coding tasks) inside Codex and 74.2% in a minimal harness (mini-SWE): almost 9 points just by swapping the harness (model card). This kit brings that idea to your machine.
Reads the settings of Claude Code, Codex and DeepSeek Harness and gives a 0 to 10 score across 6 layers: box, approval, guardrails, verification, context and secrets. It only reads, it changes nothing.
Copies the project without the secrets, runs the command in a container with no network and with memory, CPU and time limits, shows what changed and deletes everything. The original only changes with --aplicar.
Each missing layer points to an INEMA kit that fixes it: guardrails against prompt injection, lessons that become guardrails, project memory, local DeepSeek Harness.
It is the same cycle DeepSeek uses to train its agents (more than 380 thousand boxes at the same time, according to its paper), at the scale of one person.
Linux with Docker running without sudo (your user in the docker group). On macOS, first run brew install coreutils (it provides gtimeout). The auditor even runs without Docker.
For the box. Check that it responds:
# command
docker --versionFor the auditor (no extra libraries).
# command
python3 --versionTo copy the project without the secrets.
# command
rsync --version | head -1The commands use only what is in the repository. Steps 1 to 4, 6 and 7 and the first command of step 5 were run on this machine on 11/10/2026; the Claude Code examples depend on your key or login.
Flags and script output are in Portuguese: --aplicar = apply, --rede = network, --montar = mount, --interativo = interactive, --memoria = memory, --tempo = time, --imagem = image.
Clone the repository and enter the folder.
git clone https://github.com/inematds/caixa-do-agente && cd caixa-do-agente
18 checks (the first time it downloads the node:22-slim image, ~250 MB; the --interativo check uses the script command): .env and keys stay out, network closed, original untouched, container deleted, --aplicar works, --env passes only the requested variable, --interativo opens a terminal, cache and node_modules do not return to the original, --help works, and the auditor detects a secret, a disabled sandbox and a machine with no harness.
bash testes/teste.sh # ends with: TUDO OK (18/18)
Point it at one of your projects. The auditor reads the settings of Claude Code, Codex and DeepSeek Harness (DeepSeek's open-source agent, command dsh): ~/.claude/settings.json, ~/.codex/config.toml and ~/.dsh/settings.yaml (if they exist), and the project itself. Box, Approval and Guardrails come from the global settings combined with the project's, so projects on the same machine share those three.
Each layer is worth 2 points (OK), 1 (MEIO) or 0 (FALTA); the score is the sum divided by 12, times 10. Box: sandbox enabled in some harness. Approval: no harness in "skip everything" mode. Guardrails: deny rules (what the agent may never do) and PreToolUse hooks (a script that blocks the action beforehand). Verification: tests in the project and Stop/PostToolUse hooks (a script that checks afterwards). Context: AGENTS.md or CLAUDE.md. Secrets: no .env or key inside the project.
python3 auditar.py ~/meu-projeto # 0 to 10 score + the next step for each layer python3 auditar.py ~/meu-projeto --json # same thing, for use in scripts python3 auditar.py --help # the criterion for each layer
Everything after -- runs inside the container, on a copy of the project. Left out of the copy: .env, keys and credentials, node_modules and .venv. No network by default; if the command needs to install dependencies, use --rede.
./caixa.sh ~/meu-projeto --imagem python:3.12-slim -- python3 -m unittest # no dependencies, no network ./caixa.sh ~/meu-projeto --rede -- sh -c 'npm install && npm test' # Node: installs and tests inside the box
Agents need to talk to the model, so use --rede. There are two ways in:
With an API key: --env NOME passes only that variable from your terminal into the box. In headless mode (-p), Claude Code needs permission to run commands and edit files; inside the disposable box you can allow everything, because the worst case stays trapped in it.
With your subscription (login): open the agent with --interativo and log in inside the box. The login disappears when the box is destroyed.
To give access to one of your folders, use --montar origem:destino:ro (:ro = read-only). The project's secrets files still stay out.
./caixa.sh ~/meu-projeto --rede -- npx -y @deepseek-ai/dsh@latest --help # tested: 1st time ~5 min (downloads the package) ./caixa.sh ~/meu-projeto --rede --env ANTHROPIC_API_KEY -- npx -y @anthropic-ai/claude-code -p "rode os testes e corrija o que falhar" --dangerously-skip-permissions ./caixa.sh ~/meu-projeto --rede --interativo -- npx -y @anthropic-ai/claude-code # run /login inside
Each run that changes files saves a caixa-AAAAMMDD-HHMMSS.patch: a text file with the difference (the diff) of everything that changed. It is saved in the folder you ran the command from (or the one you set with --patch PASTA) and is there for you to review; you do not need to apply it with git apply. To bring exactly what you read into the original, apply the patch itself with patch -p1 inside the project. --aplicar does a new run and asks before copying: read that run's patch before answering s (with an agent, each run can come out different). New and changed files come back; node_modules, .venv and caches do not; a file deleted in the box is not deleted in the original.
less caixa-AAAAMMDD-HHMMSS.patch # read cd ~/meu-projeto && patch -p1 < ~/caixa-AAAAMMDD-HHMMSS.patch # applies exactly what you read # or: a new run that asks before copying (read the new patch before s) ./caixa.sh ~/meu-projeto --rede --aplicar -- sh -c 'npm install && npm run format'
Default: image node:22-slim, 4 GB of memory, 2 CPUs, 30 minutes. Use --imagem when the command needs another language or tool (the Node image has no make, for example).
./caixa.sh ~/meu-projeto --rede --memoria 8g --cpus 4 --tempo 7200 -- sh -c 'npm install && npm run build' ./caixa.sh ~/meu-projeto --imagem python:3.12 -- make build # full image, with make
Run on this machine on 11/10/2026.
The same 6 layers as the auditor. When one is missing, the auditor's arrow points to the row here.
.env and keys out; the other kit shows credentials kept out of the chat and out of git in a defensive security use case.Docker isolates files, network and resources, but shares the system kernel. For code you don't trust at all, use a VM.
With --rede, the agent can send out whatever is in the copy. The secrets were already left out, the rest was not.
It reads the most common settings. A high score does not replace reviewing what the agent is allowed to do.