AI terminal agent · sandboxed by default

Let the AI run wild. In a pen.

Corral is an agent that operates your terminal — one command at a time, in a disposable sandbox it can't escape. It sees the result of everything it runs and corrects course. Point it at a folder and let it work on your real files, contained.

Get started → See the loop

$ corral --workdir ./project "fix the failing test and re-run it"

◇ penned · no network
corral — sandbox
corral› sort data.csv by score, write sorted.csv, then show it [1] awk 'NR==1;NR>1{print|"sort -t, -k2,2nr"}' data.csv > sorted.csv writes the sorted rows, header kept first [2] cat sorted.csv | name,score | bob,7 | carol,5 | alice,3 === complete === sorted.csv written to your folder.
Sandboxed
by default
Sees results
and corrects
Real files
scoped to a folder
Local models
nothing leaves
~4 files
zero dependencies

The loop

It works like you would.

One command at a time — read the result, decide the next step, stop when it's done. No firing a wall of commands and hoping.

observe

Run one command

The agent issues a single command as strict JSON — with its reasoning and whether it needs root.

decide

See what happened

The exact stdout, stderr, and exit code stream back live and feed the next decision, so it corrects instead of guessing.

act

Know when to stop

It finishes when the goal is met — or tells you plainly what it's missing, instead of flailing.

The pen

Bold inside. Contained.

The whole idea: give the agent room to be autonomous because it can't reach anything it shouldn't. The sandbox is the fence.

  • ✓
    No network
    Egress is off by default; opt in per run with --network.
  • ✓
    No host access
    Work lives in a container — dropped capabilities, no-new-privileges, memory and process caps.
  • ✓
    Scoped, not sprawling
    --workdir exposes exactly one folder; the blast radius is that folder and nothing else.
  • ✓
    You hold the reins
    Confirm each command, or let it run autonomously with --yes. Your call, per session.
# the agent runs as root INSIDE the box — and the box has nothing to hurt corral› who am i and can i reach the internet? [1] id -un; curl -m3 https://example.com || echo BLOCKED | node | BLOCKED (no network) [2] ls / && touch /etc/probe 2>&1 || echo "host untouched" | workspace usr bin ... | contained — the host never sees any of this
$ corral --workdir ./my-cli "add a --version flag and a test for it" [1] grep -n version src/cli.js [2] apply the flag + write test/version.test.js [3] node --test | tests 3 pass 3 === complete === # the changes are on your host, in ./my-cli

Real work

Point it at a folder.

The middle ground between an empty sandbox and handing over your whole machine: mount one project directory and the agent works on your actual files — still with no network, still capped. Changes land on your host, in that folder, and nowhere else.

works in the REPL too — open a session against a project and iterate, with the sandbox kept warm and context carried across goals.

More

Built to be trusted.

BRING YOUR OWN MODEL

OpenAI, Anthropic, or fully local

Point it at Ollama, vLLM, or LM Studio and inference never leaves your machine. The command contract is guaranteed on every backend.

TRANSPARENT

Read every line

Four small files, zero dependencies. For a tool that runs commands, "you can read the whole thing in ten minutes" is a feature — you trust it because you can see it.

INTERACTIVE

A REPL that remembers

Run with no goal to start a session: the sandbox stays warm and context carries across goals, so work builds up conversationally.

STREAMING

Watch it work

Output appears live as each command runs — not dumped at the end. You see exactly what's happening, as it happens.

Get started

Turn it loose. Safely.

Give Corral a goal and let it work — knowing it's boxed in the whole time, and you can read every line of how it works.

Get the code → How it works

Requires Docker + Node 18+ · no runtime dependencies