Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
You should sandbox your agents. This is for when you don't.
| Date | Stars |
|---|---|
| 2026-07-31 | 458 |
| 2026-08-06 | 458 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
35.0
growth rate 0.00%/day
<p align="center"> <img src="https://raw.githubusercontent.com/manuelschipper/nah/main/assets/logo-round.png" alt="nah" width="280"> </p> <p align="center"> <strong>Action-aware, deterministic permissions for coding agents</strong><br> You should sandbox your agents. This is for when you don't. </p> <p align="center"> <a href="https://nah.build/">Docs</a> • <a href="#how-nah-decides">How nah decides</a> • <a href="#install">Install</a> • <a href="#threat-model">Threat model</a> • <a href="#configure">Configure</a> • <a href="#cli">CLI</a> • <a href="https://nah.build/privacy/">Privacy</a> </p> > [!IMPORTANT] > **nah 1.0 is a ground-up Rust rewrite with breaking changes.** This Python > version is in maintenance mode. I will accept security, correctness, and small > low-risk fixes, but generally not new classifier or configuration features. > When 1.0 arrives, this version will remain available; pin `nah<1` or fork it > if you depend on its current behavior. --- ## The Problem You shouldn't run a coding agent outside a sandbox. Sometimes you do it anyway, on your laptop or on a server with injected secrets. That leaves three ways to keep it in check, and each trades away something you need. ### Three options, different tradeoffs - **Manual permissions:** approve every action and you drown in prompts; pre-approve and you over-grant. - **Auto modes:** Claude Code Auto Mode, Codex auto-review. Less prompting and intent-aware review, but an LLM is still deciding. Advice, not enforcement. - **YOLO** (`--dangerously-skip-permissions`): speed, zero guardrails. ### A permission list of command names is the wrong abstraction `git` can check status, or it can rewrite history. `git status`: normal.<br> `git reset --hard HEAD~20`: destroys work. `rm` can clean a build artifact, or it can break your shell. `rm -rf __pycache__`: cleanup.<br> `rm ~/.bashrc`: breaks your shell. `cat` can read source code, or it can leak cloud keys. `cat ./src/app.py`: normal.<br> `cat ~/.aws/credentials`: leaks credentials. Even when you curate permissions, agents can route around command names through shells, wrappers, scripts, and MCP tools. Allow/deny lists are a fool's errand. You either approve too much, block useful work, or train yourself to click through prompts. ### Auto modes are advice, not enforcement Auto modes like Claude Code's Auto Mode and Codex auto review are a real improvement on skipping permissions and can be a reasonable fit for some security postures. But they still lean on model judgement, and no classifier is perfect. Anthropic's [own evaluation](https://www.anthropic.com/engineering/claude-code-auto-mode) of Auto Mode is candid that the deployed pipeline still misses about 1 in 6 real overeager actions. nah is different: it classifies the decisions you can express as policy deterministically and gives the same answer every time, in milliseconds with no tokens. The two approaches can also be used together: nah provides the safety floor, while the runtime adds intent-aware LLM review for ambiguous decisions. That means fewer prompts without treating model judgment as a hard boundary. ### What nah adds nah reads what an action *does*, applies your policy in milliseconds, and gives the same answer every time. Use it on its own or underneath a native approval mode. Low friction and no LLM required by nah. ## The Idea nah is a permissions guard built in pure Python with zero required dependencies that works out of the box. The main classifier maps tools deterministically into an intent taxonomy in milliseconds. An optional LLM (off by default) does one narrow job behind the deterministic floor: it classifies an `unknown` command into an action type whose surfaced targets are re-checked deterministically. ## How nah decides Before a guarded action runs, nah turns it into a policy decision: 1. Parse the command or tool call. 2. Map it to action types like `git_histor
Excerpt of 11,730 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:f9cd31b177066f29, llm:Description: 'You should sandbox your agents. This is for when you don't.' Repository name 'nah' suggests tool for running agents without sandboxing — likely agent/agents-related code for AI. Language: Python. No topics or README provided.
matched fp:f9cd31b177066f29, llm:Description: 'You should sandbox your agents. This is for when you don't.' Repository name 'nah' suggests tool for running agents without sandboxing — likely agent/agents-related code for AI. Language: Python. No topics or README provided.