Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
A thin protective layer for Claude Code
| Date | Stars |
|---|---|
| 2026-07-31 | 422 |
| 2026-08-06 | 422 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
<div align="center">
<img src="cco.svg" alt="cco logo" width="500">
</div>
<hr>
**cco** (Claude Condom if you're so inclined) provides essential protection while Claude Code is up close and personal with your system. It automatically selects the best available sandboxing method - using native OS sandboxing (sandbox-exec on macOS, bubblewrap on Linux) when available, or falling back to Docker as a barrier to keep Claude contained while keeping your real system safe.
**UPDATE**: `cco` can now sandbox OpenAI's `codex` as well! Just start it with `cco codex` to don your codex condom! ([Opencode](https://github.com/anomalyco/opencode), [Pi coding agent](https://github.com/badlogic/pi-mono/tree/main/packages/coding-agent), and factory.ai's [droid](https://factory.ai/) are supported as well.)
## Why protection matters
Running Claude Code with `--dangerously-skip-permissions` feels great - fast, responsive, no interruptions. But going in unprotected has risks: web search makes Claude vulnerable to prompt injections that could trick it into accessing files outside your project or running unexpected commands.
**`cco` lets you have it both ways: all the pleasure of autonomous Claude, with a barrier between Claude and your machine's sensitive areas.**
### The problem with exposure
- **Leaves Claude Unprotected**: Lightning fast but vulnerable to nasty prompt injections
- **Mood killer**: Constant permission prompts kill the flow
### Protected interaction
- **Smooth operation**: No more constant permission prompts
- **Barrier protection**: Keeps unwanted side effects contained
- **Peace of mind**: Enjoy the experience without worry
- **Easy cleanup**: Fresh environment every time
For more information about `cco`'s security model, limitations, and threat analysis, see [SECURITY.md](SECURITY.md).
## Quick start
### Installation
```bash
curl -fsSL https://raw.githubusercontent.com/nikvdp/cco/master/install.sh | bash
```
### Usage
Just type `cco` where you would normally type `claude` and your protection is on!
```bash
cco "write a hello world script"
cco "help me refactor this code"
```
## Design philosophy
**`cco` gets out of your way.** It's designed to feel natural - like using Claude directly, just safer.
- **Thin layer**: Barely noticeable protection
- **Natural feel**: Works exactly like `claude` but protected
- **No surprises**: Everything you expect, just contained
- **Seamless experience**: Your environment, your files, your workflow
You should barely notice `cco` is there, except for that reassuring feeling of safety.
## How it works
**`cco` runs Claude Code inside a sandboxed environment.** It automatically detects and uses the best available sandboxing method:
- **Native sandboxing (default when available)**: Uses OS-native tools (sandbox-exec on macOS, bubblewrap on Linux) for lightweight, fast isolation. **Note**: Native sandboxing exposes the entire host filesystem as read-only by default - use `--safe` for stronger filesystem isolation.
- **Docker sandboxing (fallback)**: Uses Docker containers when native tools aren't available. Provides stronger filesystem isolation by only exposing explicitly mounted paths.
- **Automatic sandbox selection**: Chooses native OS sandboxing when available, Docker as fallback
- **Native sandbox (preferred)**: Lightweight, fast startup, direct Keychain access on macOS. Exposes host filesystem read-only by default.
- **Docker sandbox (fallback)**: Stronger filesystem isolation with container-only filesystem when native tools unavailable
- **Host file access**: Your project files and Claude state paths are accessible so Claude can read and edit what it needs
- **Git worktree support**: Automatically detects git worktrees and whitelists the main repo's `.git` directory so git operations work seamlessly
- **Network access**: Full host network access for localhost development servers, MCP servers, and web requests
- **Credential management**: Authentication is handled securelyExcerpt of 33,139 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:549b77b7b0573466, llm:Repository description: "A thin protective layer for Claude Code". No topics. Likely a wrapper/protective layer around Anthropic Claude Code (LLM) — related to guarding/promoting safety or interfacing with a model (agent/proxy).
matched fp:549b77b7b0573466, llm:Repository description: "A thin protective layer for Claude Code". No topics. Likely a wrapper/protective layer around Anthropic Claude Code (LLM) — related to guarding/promoting safety or interfacing with a model (agent/proxy).