agent-run
agent-run is a tiny (under 1 MB) standalone binary that runs coding agents — pi, opencode, codex, or claude — inside a Bubblewrap (bwrap) sandbox. Its purpose is to let an agent operate freely inside your project without being able to touch anything outside it: the host filesystem is mounted read-only by default, and only paths you explicitly allow become read-write. It's built for catching agent mistakes, not malicious code — if an agent tries to delete your home directory or exfiltrate a file, the sandbox contains it. Configuration is a simple TOML file with per-tool sections (tools.claude, tools.codex, …) controlling env inheritance, network access, and mounts. The bwrap binary is compiled for the target platform and embedded directly into agent-run, then exec'd at runtime via a memfd, so there's no separate dependency to install. It currently supports aarch64 and x86_64 Linux and depends on unprivileged user namespaces.
✅ Pros / Advantages
- • Under 1MB, no runtime dependencies
- • Read-only host FS by default, explicit mounts only
- • Catches agent mistakes before they spread
- • Simple TOML config, per-tool isolation
- • Self-contained embedded bwrap
❌ Cons / Limitations
- • Linux-only (bwrap + user namespaces)
- • Threat model is mistakes, not hardened malware
- • Env vars do not expand inside mount paths
- • No config merging across files yet
- • Limited arch support (aarch64, x86_64)
💰 Pricing Plans
Free (Open Source, GPL-3.0)
Pricing details are gathered from public sources and are subject to change. Please visit the official website for real-time rates.
Last updated: July 2026 · 9bests editorial review
✅ Who should use agent-run
- • Under 1MB, no runtime dependencies
- • Read-only host FS by default, explicit mounts only
- • Catches agent mistakes before they spread
- • Simple TOML config, per-tool isolation
- • Self-contained embedded bwrap
⚠️ Who should look elsewhere
- • Linux-only (bwrap + user namespaces)
- • Threat model is mistakes, not hardened malware
- • Env vars do not expand inside mount paths
- • No config merging across files yet
- • Limited arch support (aarch64, x86_64)
🎯 Common use cases
Autocompleting and refactoring code
Multi-file AI edits
Debugging and test generation
⚖️ agent-run vs Cursor
| agent-run | Cursor | |
|---|---|---|
| Rating | 3.8/5 | 4.8/5 |
| Pricing | Free (Open Source, GPL-3.0) | Free / $20/mo |
| Key strength | Under 1MB, no runtime dependencies | Best AI code editor |
See the full head-to-head in our agent-run vs Cursor comparison.
❓ Frequently asked questions
Is agent-run free?
+
agent-run offers a free tier (Free (Open Source, GPL-3.0)). Paid plans unlock higher limits and advanced features.
What is agent-run best for?
+
agent-run is best for Under 1MB, no runtime dependencies and Read-only host FS by default, explicit mounts only. agent-run is a tiny (under 1 MB) standalone binary that runs coding agents — pi, opencode, codex, or claude — inside a Bubblewrap (bwrap) sandbox. Its purpose is to let an agent operate freely inside your project without being able to touch anything outside it: the host filesystem is mounted read-only by default, and only paths you explicitly allow become read-write. It's built for catching agent mistakes, not malicious code — if an agent tries to delete your home directory or exfiltrate a file, the sandbox contains it. Configuration is a simple TOML file with per-tool sections (tools.claude, tools.codex, …) controlling env inheritance, network access, and mounts. The bwrap binary is compiled for the target platform and embedded directly into agent-run, then exec'd at runtime via a memfd, so there's no separate dependency to install. It currently supports aarch64 and x86_64 Linux and depends on unprivileged user namespaces.
How does agent-run compare to Cursor?
+
agent-run (3.8/5) and Cursor (4.8/5) serve overlapping needs. agent-run stands out for Under 1MB, no runtime dependencies, while Cursor is stronger at Best AI code editor. Choose based on your priority.
🔄 Top Alternatives to agent-run
Related ToolsCursor
AI-first code editor built on VS Code
GitHub Copilot
AI pair programmer by GitHub/OpenAI
Windsurf (Codeium)
Free AI code completion and chat assistant
Replit Agent
AI-powered cloud IDE that builds full apps