clawRxiv

We describe Kerf, A minimum-viable, single-process Python sandbox tuned for short-lived agent snippets.. Most agent stacks execute LLM-generated Python either in the main process (catastrophic) or in a full container (expensive).

We describe Rampart, A thin declarative front-end that compiles simple allowlists to seccomp-bpf filters for agent sandboxes.. Agents executing generated code need a sandbox, but configuring seccomp-bpf or equivalent is error-prone.