AI terminal agent · sandboxed by default

Let the AI run wild. In a pen.

Corral is an agent that operates your terminal — one command at a time, in a disposable sandbox it can't escape. It sees the result of everything it runs and corrects course. Point it at a folder and let it work on your real files, contained.

Get started → See the loop

$ corral --workdir ./project "fix the failing test and re-run it"

◇ penned · no network
corral — sandbox
corral› sort data.csv by score, write sorted.csv, then show it [1] awk 'NR==1;NR>1{print|"sort -t, -k2,2nr"}' data.csv > sorted.csv writes the sorted rows, header kept first [2] cat sorted.csv | name,score | bob,7 | carol,5 | alice,3 === complete === sorted.csv written to your folder.
Sandboxed
by default
Real files & SSH
scoped & guarded
Secrets redacted
before they reach the model
Local models
nothing leaves
93 tests · CI
zero dependencies

The loop

It works like you would.

One command at a time — read the result, decide the next step, stop when it's done. No firing a wall of commands and hoping.

observe

Run one command

The agent issues a single command as strict JSON — with its reasoning and whether it needs root.

decide

See what happened

The exact stdout, stderr, and exit code stream back live and feed the next decision, so it corrects instead of guessing.

act

Know when to stop

It finishes when the goal is met — or tells you plainly what it's missing, instead of flailing.

The pen

Bold inside. Contained.

The whole idea: give the agent room to be autonomous because it can't reach anything it shouldn't. The sandbox is the fence.

  • ✓
    No network
    Egress is off by default; opt in per run with --network.
  • ✓
    No host access
    Work lives in a container — dropped capabilities, no-new-privileges, memory and process caps.
  • ✓
    Scoped, not sprawling
    --workdir exposes exactly one folder; the blast radius is that folder and nothing else.
  • ✓
    You hold the reins
    Confirm each command, or let it run autonomously with --yes. Your call, per session.
# the agent runs as root INSIDE the box — and the box has nothing to hurt corral› who am i and can i reach the internet? [1] id -un; curl -m3 https://example.com || echo BLOCKED | node | BLOCKED (no network) [2] ls / && touch /etc/probe 2>&1 || echo "host untouched" | workspace usr bin ... | contained — the host never sees any of this
$ corral --workdir ./my-cli "add a --version flag and a test for it" [1] grep -n version src/cli.js [2] apply the flag + write test/version.test.js [3] node --test | tests 3 pass 3 === complete === # the changes are on your host, in ./my-cli

Real work

Point it at a folder.

The middle ground between an empty sandbox and handing over your whole machine: mount one project directory and the agent works on your actual files — still with no network, still capped. Changes land on your host, in that folder, and nowhere else.

works in the REPL too — open a session against a project and iterate, with the sandbox kept warm and context carried across goals.

More

Built to be trusted.

BRING YOUR OWN MODEL

OpenAI, Anthropic, or fully local

Point it at Ollama, vLLM, or LM Studio and inference never leaves your machine. The command contract is guaranteed on every backend.

TRANSPARENT · TESTED

Read every line

A handful of small files, zero dependencies, MIT-licensed, with 93 tests run in CI — including tests that prove the sandbox really contains the agent. You trust it because you can see it.

INTERACTIVE

A REPL that remembers

Run with no goal to start a session: the sandbox stays warm and context carries across goals, so work builds up conversationally.

STREAMING

Watch it work

Output appears live as each command runs — not dumped at the end. You see exactly what's happening, as it happens.

GUARDRAIL

Won't wreck your machine

On real-file targets, obviously destructive commands (rm -rf, dd, curl | sh) are flagged and need confirmation — even in autonomous mode. Secrets in command output are redacted before they're sent to the model.

ANYWHERE

Sandbox, folder, or remote

Run in the disposable sandbox, point it at a project with --workdir, or operate a remote box over --ssh — the same loop and safety everywhere. Save a session and --resume it tomorrow.

Get started

Turn it loose. Safely.

Give Corral a goal and let it work — knowing it's boxed in the whole time, and you can read every line of how it works.

Get the code → How it works

$ npx @smartledger/corral  ·  or  $ npm i -g @smartledger/corral

Requires Docker + Node 18+ · no runtime dependencies