Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Proper sandboxing for agentic coding and web browsing
| Date | Stars |
|---|---|
| 2026-07-31 | 273 |
| 2026-08-06 | 273 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
60.0
growth rate 0.00%/day
<p align="center"> <img src="Resources/AppIcon.png" width="128" height="128" alt="Bromure icon"> <img src="Resources/BromureACIcon.png" width="128" height="128" alt="Bromure Agentic Coding icon"> </p> <h1 align="center">Bromure</h1> <p align="center"> Secure, ephemeral computing in disposable Linux VMs on macOS. </p> <h2 align="center"> → Full details, screenshots, and downloads at <a href="https://bromure.io">bromure.io</a> </h2> --- This repo ships two sibling apps, both built on Apple's [Virtualization.framework](https://developer.apple.com/documentation/virtualization): - **Bromure** — every browser session runs in a throwaway Linux VM. Close the window, the VM is destroyed. - **Bromure Agentic Coding** — a sandboxed environment for AI coding agents (Claude Code, Codex). A host-side MITM proxy swaps fake credentials for real ones on the wire so secrets never enter the VM, then adds supply-chain scanning, prompt-injection detection, a multi-model panel, local/hybrid inference, and remote access — all enforced at that one boundary. <details> <summary><strong>How Bromure Agentic Coding compares</strong></summary> Isolation, keeping secrets out of the agent, scoping their use, scanning the supply chain, catching prompt injection: most tools pick one. Bromure does all five at a single boundary, then adds what a secret-broker never could: a model panel, local inference, and a way in from anywhere. Here is the same threat model run across the tools people reach for, and where each one stops. A more detailed feature matrix is available at [bromure.io/en/feature-matrix](https://bromure.io/en/feature-matrix). | Protection | Dev Container<br><sub>VS Code</sub> | nono<br><sub>kernel sandbox</sub> | agent-vault<br><sub>octokraft</sub> | Agent Vault<br><sub>Infisical</sub> | Docker Sandboxes<br><sub>microVM</sub> | Capsem<br><sub>air-gapped VM</sub> | **Bromure**<br><sub>Agentic Coding</sub> | | --- | --- | --- | --- | --- | --- | --- | --- | | **Security** | | | | | | | | | **Isolation boundary**<br><sub>Where the blast radius stops</sub> | 🟡 Same container, shared kernel | 🟡 Kernel allow-lists, no own kernel | ❌ Agent runs in place | ❌ Proxy only; agent unboxed | ✅ microVM, its own kernel | ✅ Hardware VM, its own kernel | ✅ Hardware VM, its own kernel | | **Keep secrets out of the agent**<br><sub>Can it ever read the real credential?</sub> | ❌ Forwards SSH agent + git creds | 🟡 Blocks key files; proxies some | ✅ Piped in; no read path | ✅ Proxy attaches on the wire | ✅ Host proxy injects headers | ❌ Real API keys live in the VM | ✅ Stub swapped at the wire | | **Credential scope & approval**<br><sub>Per-use limits, read-only, expiry, consent</sub> | ❌ No per-use scoping | 🟡 Approval flow + egress filter | 🟡 Per-secret TTL; blocks shells | 🟡 Egress filter per endpoint | 🟡 Domain allow-list; in-VM code can still use it | 🟡 Domain + method/path egress rules | ✅ Per-destination consent + TTL | | **Supply-chain scanning**<br><sub>Catching malicious / vulnerable packages</sub> | ❌ No registry scanning | ❌ Signing only, no pkg scan | ❌ Out of scope | ❌ Out of scope | ❌ No package scanning | ❌ No package scanning | ✅ Age-gate, OSV, socket.dev, Delpi | | **Prompt-injection detection**<br><sub>Scanning untrusted content & rules files</sub> | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ PromptGuard + ModernBERT | | **Audit trail**<br><sub>Recording what the agent did</sub> | ❌ Container logs only | 🟡 Immutable local audit | ❌ | 🟡 Request logging | 🟡 Request logging | 🟡 Full HTTP bodies in SQLite | ✅ Full session trace, encrypted | | **Supply-chain inventory** <sub>(Enterprise)</sub><br><sub>A record of every package fetched</sub> | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Every dependency + verdict, searchable | | **Productivity** | | | | | | | | | **Token usage** <sub>(Enterprise)</sub><br><sub>Which files burn the most tokens</sub> | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ Per file, repo, and model | | **Multi-model fusion**<br><sub>A
Excerpt of 9,783 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:452edafeb2f65a87, llm:Repository description: 'Proper sandboxing for agentic coding and web browsing'; topics include agentic, browser, developer-tools, infosec, sandbox, security, virtual-machine.
matched fp:452edafeb2f65a87, llm:Repository description: 'Proper sandboxing for agentic coding and web browsing'; topics include agentic, browser, developer-tools, infosec, sandbox, security, virtual-machine.
matched fp:452edafeb2f65a87, llm:Repository description: 'Proper sandboxing for agentic coding and web browsing'; topics include agentic, browser, developer-tools, infosec, sandbox, security, virtual-machine.
matched fp:452edafeb2f65a87, llm:Repository description: 'Proper sandboxing for agentic coding and web browsing'; topics include agentic, browser, developer-tools, infosec, sandbox, security, virtual-machine.