# nono

Ephemeral micro sandboxes for AI agents, with zero setup and zero latency.

Source: https://wheredoirunthis.com/products/nono · JSON: https://wheredoirunthis.com/api/products/nono · Read on 2026-08-07

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Not disclosed
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: Not documented
- Regions: Not disclosed
- Coverage: 8 of 54 assessed capabilities supported · 7 not assessed
- Agent readiness: read 9.5 of 10 signals, drive 3.5 of 7 signals

## Links

- Homepage: https://nono.sh/
- Docs: https://nono.sh/docs
- Repository: https://github.com/nolabs-ai/nono

## Runtime

- **GPU & accelerators**: na — "nono provisions no compute — it constrains a process on the machine you are already on, so it neither offers nor withholds GPUs. A sandboxed workload uses the host's GPU if the profile grants the device paths (there is a `gpu` blog tag covering ML-training runs under nono). Not a GPU-provisioning axis." [source](https://nono.sh/docs/cli/features/resource-limits) (confidence: high)
- **BYOC (Bring your own cloud)**: na
- **Secrets management**: Credential brokering, not env-var handoff: secrets live in the OS keystore (macOS Keychain / Linux Secret Service), 1Password, or Apple Passwords, and the child receives a PHANTOM session token — the proxy swaps it for the real key at the HTTP header level en route to the upstream, so the real credential never enters the sandbox and is zeroised on exit. Per-route endpoint policy limits which methods/paths a credential may be used against. SPIFFE/SPIRE JWT-SVID workload identity is supported as an alternative to static keys (direct bearer injection or an OAuth2 jwt-bearer client assertion). Best-effort redaction scrubs secret-bearing argv/headers/query params from session metadata, audit records and attestations. — "'Child process sees: OPENAI_API_KEY=nono_sess_a1b2c3... (phantom token) / Proxy transparently swaps to real Bearer sk-... when forwarding to api.openai.com'" [source](https://nono.sh/docs/cli/features/credential-injection) (confidence: high)
- **Storage options**: Path-level allow/deny over the host filesystem (--allow / --read / --allow-file, deny-by-default), with a built-in sensitive-path blocklist that wins even inside an allowed parent (~/.ssh, ~/.aws, ~/.gnupg, ~/.kube, ~/.docker, ~/.npmrc, ~/.netrc, ~/.git-credentials, shell history and rc files; on macOS a always-active deny_keychains_macos group). No platform-provided storage. — "'nono blocks access to sensitive paths by default, even if a parent directory is explicitly allowed.'" [source](https://nono.sh/docs/cli/internals/overview) (confidence: high)
- **Supported workloads**: ai-coding-agents, agent tool invocations (git/gh/curl/kubectl/package managers), mcp-servers, untrusted scripts (python/node/go), ci jobs, llm/ml workloads — "'Secure, kernel-enforced sandbox CLI and SDKs for AI agents, MCP and LLM workloads.'" [source](https://nono.sh/docs/introduction) (confidence: high)
- **Persistence**: Host filesystem — the sandbox operates directly on your real working directory (no volume mounts, no copy-in/copy-out). Sandbox lifetime = the command's lifetime; session state, audit records and rollback snapshots persist under $XDG_STATE_HOME/nono (0700/0600). — "'Works on host files: Yes (directly)' vs Docker's 'Requires volume mounts'; 'AI coding agents need to read and modify your actual source files. With nono, this works naturally.'" [source](https://nono.sh/docs/cli/internals/containers) (confidence: high)
- **Data jurisdiction**: na
- **Resource limits & quotas**: Linux only, supervised runs only, fail-closed: --memory sets a cgroup v2 memory.max over the whole process tree (with memory.swap.max=0 and memory.oom.group=1, so the tree is killed together and cannot spill to swap; exit 137 with a diagnostic) and --max-processes sets pids.max (fork bomb bound — the kernel refuses the fork with EAGAIN, it kills nothing). Requires cgroup v2 with a systemd Delegate=yes user session and the relevant delegated controller; nono REFUSES the run rather than leaving a requested limit unenforced, and refuses write access overlapping /sys/fs/cgroup while a limit is active. NO CPU or I/O limits ('for those, reach for a container'). [source](https://nono.sh/docs/cli/features/resource-limits) (confidence: high)
- **SDK languages**: rust, python, typescript, go, c-ffi — "'nono provides FFI bindings for Rust, Python, TypeScript, and Go. Also available as Python (nono-py), TypeScript (nono-ts), and Go (nono-go) bindings.' The Rust `nono` crate is the core and exposes a plain C FFI." [source](https://nono.sh/docs/introduction) (confidence: high)
- **Network & egress controls**: The differentiator. Default-deny outbound via a supervisor-side HTTP proxy: --block-net (no outbound at all), --allow-domain host allowlists with optional per-PATH globs, six preset network profiles (minimal / developer / claude-code / codex / opencode / enterprise) composed from named host groups, L7 method+path endpoint policy per credential route, DNS-rebinding protection (the proxy resolves and checks every resolved IP against a deny list), cloud-metadata endpoints denied even through an enterprise upstream proxy, a 256-bit per-session proxy token, and --upstream-proxy/--upstream-bypass for corporate egress. The child can only reach localhost:<proxy-port>; all other outbound TCP is blocked at the kernel level. — "'When you restrict networking, nono routes traffic through an HTTP proxy running in the unsandboxed supervisor process. The sandboxed child can only reach localhost:<proxy-port> — all other outbound TCP is blocked at the kernel level.'" [source](https://nono.sh/docs/cli/features/networking) (confidence: high)
- **Snapshots & forks**: Atomic rollback snapshots of the workspace (content-addressable, baseline + final) with `--rollback`; `nono rollback` supports summary, unified/side-by-side diff, restore-to-baseline or to a snapshot, --dry-run preview, and retention pruning. NOT a fork of a running instance. — "'Content-addressable filesystem snapshots with integrity verification'; supervised mode only." [source](https://nono.sh/docs/cli/features/atomic-rollbacks) (confidence: high)
- **Deployment methods**: cli, sdk — "`nono run --profile <pack> -- <agent>` / `nono shell` / `nono wrap` (direct exec, no parent) / `nono proxy` (standalone filtering proxy), or the Python/TS/Go/Rust libraries applying a CapabilitySet in-process. Policy is composable JSON (a profile), optionally pulled as a signed pack from registry.nono.sh — recorded under sandbox-templates / template-marketplace rather than as a deploy method." [source](https://nono.sh/docs/cli/getting_started/quickstart) (confidence: high)
- **Isolation**: Not disclosed — "TAXONOMY GAP, NOT UNDISCLOSED. nono's boundary is kernel-LSM in-process sandboxing, documented in precise detail: 'Landlock LSM provides the hard security floor. Once restrict_self() is called, the child process is permanently restricted to its initial capability set... The only escape is a kernel exploit', layered with seccomp user-notification (SECCOMP_RET_USER_NOTIF traps openat/openat2 and the supervisor injects fds via SECCOMP_IOCTL_NOTIF_ADDFD). macOS uses Seatbelt (sandbox_init) 'with the same irreversibility guarantees'; Windows runs the same Landlock path inside the WSL2 kernel. The README is explicit that it is NONE of the enum values: 'no daemon, no container, no VM, and no disk space usage'; the os-sandbox page says 'No root, no containers, no overhead.' isolationEnum has no value for this, so `unknown` is the least-wrong token — see meta.notes and the `os-lsm-sandbox` proposal in features.unmatched[]. HONEST CEILING, stated by the vendor: 'nono's trust boundary is agent containment — restricting what the sandboxed child can access — not guest/host isolation between same-user processes... If you need stronger isolation between same-user processes — for example, in a multi-tenant hosting environment — run nono inside a container or microVM.' It shares the host PID namespace and provides no process isolation." [source](https://nono.sh/docs/cli/internals/security-model) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "plugin — a file that lives at its declared path inside the pack store. Used for assets that live alongside the profile (a Claude Code plugin's .claude-plugin/plugin.json, hooks/hooks.json, bin/*.sh, skills/*/SKILL.md, etc.)" [source](https://nono.sh/docs/cli/features/package-publishing) |
| AI app builder | Not supported | "Sandbox for AI Agents — Kernel-Level Isolation" [source](https://nono.sh/) |
| Autonomous QA agent | Not supported | "nono sandboxes any terminal agent." [source](https://nono.sh/) |
| Built-in coding agent | Not supported | "nono sandboxes any terminal agent. Pull a signed profile from the registry and run — no wrappers, no rewrites." [source](https://nono.sh/) |
| BYOK for LLMs | Supported | "1. Store credentials in the system keystore 2. Run with credential injection — nono run --allow-cwd --credential openai -- my-agent" [source](https://nono.sh/docs/cli/features/credential-injection) |
| Credential-injection proxy | Not assessed |  |
| LLM gateway | Partially supported | "llm_apis — api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, ... [and] Applications that read OPENAI_BASE_URL, ANTHROPIC_BASE_URL, etc. from the environment don't need --proxy-port — nono sets these automatically." [source](https://nono.sh/docs/cli/features/networking) |
| MCP client | Not supported | "Secure, kernel-enforced sandbox CLI and SDKs for AI agents, MCP and LLM workloads." [source](https://nono.sh/docs/introduction) |
| MCP-server hosting | Supported | "Run an MCP server and a client in separate sandboxes, communicating over localhost: # Terminal 1: MCP server on port 3000 (network blocked except IPC port) — nono run --block-net --open-port 3000 --allow ./mcp-server -- node server.js" [source](https://nono.sh/docs/cli/usage/examples) |
| MCP server | Not supported | "[no MCP server entry across the 76-page docs index]" [source](https://nono.sh/docs/llms.txt) |
| Model inference API (first-party) | Not applicable | "llm_apis — api.openai.com, api.anthropic.com, generativelanguage.googleapis.com, ..." [source](https://nono.sh/docs/cli/features/networking) |
| Preinstalled coding agent | Not assessed |  |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not applicable | "The sandboxed child can only reach localhost:<proxy-port> — all other outbound TCP is blocked at the kernel level." [source](https://nono.sh/docs/cli/features/networking) |
| Custom domains | Not applicable | "Ephemeral micro sandboxes for AI agents, with zero setup and zero latency." [source](https://nono.sh/) |
| Direct public IPv6 | Not applicable | "--allow-domain is an HTTP(S) proxy allowlist, not a generic raw TCP host:port allow." [source](https://nono.sh/docs/cli/features/networking) |
| Edge KV store | Not applicable | "Sandbox for AI Agents — Kernel-Level Isolation" [source](https://nono.sh/) |
| Egress controls | Supported | "When you restrict networking, nono routes traffic through an HTTP proxy running in the unsandboxed supervisor process. The sandboxed child can only reach localhost:<proxy-port> — all other outbound TCP is blocked at the kernel level." [source](https://nono.sh/docs/cli/features/networking) |
| Email send / receive | Not supported | "--allow-domain is an HTTP(S) proxy allowlist, not a generic raw TCP host:port allow." [source](https://nono.sh/docs/cli/features/networking) |
| Public preview URLs | Not applicable | "Current attach is local-only and same-user only." [source](https://nono.sh/docs/cli/internals/security-model) |
| Private networking | Partially supported | "Allow bidirectional localhost TCP on a specific port. The sandboxed process can both connect to and bind/listen on 127.0.0.1:<PORT>. Use this for IPC between sandboxed processes (e.g., MCP servers, dev tools, AI agents running in separate sandboxes)." [source](https://nono.sh/docs/cli/usage/flags) |
| Built-in reverse proxy | Not applicable | "Reverse proxy — Credential injection for API calls. Requests arrive at http://localhost:<port>/<service>/..., the proxy injects the real API key and forwards to the upstream over TLS." [source](https://nono.sh/docs/cli/features/networking) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Partially supported | "nono integrates with the SPIFFE Workload API to authenticate outbound API calls using workload identity. Instead of storing a secret in a keystore or profile, nono contacts the local SPIRE agent socket at startup, obtains a credential, and handles injection automatically." [source](https://nono.sh/docs/cli/features/spiffe) |
| BYOC | Not applicable | "Ephemeral micro sandboxes for AI agents, with zero setup and zero latency." [source](https://nono.sh/) |
| Deploy into customers' VPCs | Not assessed |  |
| Secrets management | Supported | "Child process sees: OPENAI_API_KEY=nono_sess_a1b2c3... (phantom token) / Proxy transparently swaps to real Bearer sk-... when forwarding to api.openai.com" [source](https://nono.sh/docs/cli/features/credential-injection) |
| Self-host / OSS core | Supported | "Apache-2.0 — nono is available under Apache 2.0 at nono.sh and on GitHub at github.com/nolabs-ai/nono" [source](https://github.com/nolabs-ai/nono/blob/main/LICENSE) |
| Sharing | Partially supported | "From here fork the config, tweak it, theme it, make it your own, and share it with your team or the community via the nono registry." [source](https://github.com/nolabs-ai/nono) |
| SSO / SAML | Not supported | "Creates an ECDSA P-256 key pair in the system keystore (macOS Keychain / Linux Secret Service)." [source](https://nono.sh/docs/cli/features/trust) |
| Teams | Partially supported | "Namespace binding is enforced. If your pack is acme-corp/claude-code, the publishing repository must be under acme-corp/*." [source](https://nono.sh/docs/cli/features/package-publishing) |
| Workload identity | Not assessed |  |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "brew install nono — nono run --profile nolabs-ai/opencode -- opencode" [source](https://nono.sh/docs/cli/usage/flags) |
| E2B-compatible API | Not assessed |  |
| Filesystem API | Not applicable | "Works on host files: Yes (directly)" [source](https://nono.sh/docs/cli/internals/containers) |
| Git deploy | Not applicable | "Learn how to use nono to sandbox commands" [source](https://nono.sh/docs/cli/getting_started/quickstart) |
| HTTP data API | Not applicable | "Sandbox for AI Agents — Kernel-Level Isolation" [source](https://nono.sh/) |
| OpenAPI spec | Not supported | "[HTTP 404 on nono.sh and registry.nono.sh]" [source](https://nono.sh/openapi.json) |
| Private container registry | Not applicable | "A nono pack is a signed bundle of artifacts — profiles, hooks, plugins, instructions, scripts, trust policies, groups — distributed via the registry and verified with Sigstore at install time." [source](https://nono.sh/docs/cli/features/package-publishing) |
| Public API | Not supported | "CLI — Install and use the nono CLI to sandbox any command / Core Library — Rust library providing FFI bindings for all SDKs" [source](https://nono.sh/docs/introduction) |
| SDK | Supported | "nono provides FFI bindings for Rust, Python, TypeScript, and Go. Also available as Python (nono-py), TypeScript (nono-ts), and Go (nono-go) bindings." [source](https://nono.sh/docs/introduction) |
| SSH access | Not applicable | "Current attach is local-only and same-user only. [...] This is not a remote authentication protocol. It does not distinguish between two processes running as the same uid, and it is not intended to support cross-host attach." [source](https://nono.sh/docs/cli/internals/security-model) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not applicable | "[a capability manifest declares filesystem/network/resources for a run]" [source](https://nono.sh/docs/cli/internals/capability-manifest) |
| Desktop / computer-use sandbox | Not supported | "[no GUI/VNC/computer-use page in the 76-page docs index]" [source](https://nono.sh/docs/llms.txt) |
| GPU compute | Not applicable | "nono does not limit CPU, memory, or disk usage [beyond the cgroup memory/pids caps]" [source](https://nono.sh/docs/cli/features/resource-limits) |
| Live-state (memory) snapshots | Not assessed |  |
| Multi-region | Not applicable | "Platform Support — Linux (kernel 5.13+) Landlock LSM / macOS Seatbelt / Windows (WSL2)" [source](https://nono.sh/docs/cli/getting_started/installation) |
| Object storage | Not applicable | "Deny by default, allow explicitly. When you run a command through nono, it can only access what you explicitly grant." [source](https://nono.sh/docs/cli/internals/overview) |
| Persistent disk | Not applicable | "Works on host files: Yes (directly) [vs Docker] Requires volume mounts" [source](https://nono.sh/docs/cli/internals/containers) |
| Sandbox templates / custom images | Partially supported | "nono profile init opencode --extends nolabs-ai/opencode — nono profile init exports an extended and editable profile file for your agent, that inherits from the specified base profile." [source](https://github.com/nolabs-ai/nono) |
| Scale to zero | Not applicable | "nono applies the sandbox and then exec()s directly into the target command. nono disappears from the process tree entirely - there is no parent process." [source](https://nono.sh/docs/cli/features/execution-modes) |
| Selectable isolation runtime | Not assessed |  |
| Snapshots / forking | Partially supported | "Content-addressable filesystem snapshots with integrity verification — Restore all files to baseline state / Restore to a specific snapshot (0 = baseline, 1 = final) / Preview what would change without modifying files" [source](https://nono.sh/docs/cli/features/atomic-rollbacks) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "Sandbox for AI Agents — Kernel-Level Isolation" [source](https://nono.sh/) |
| Ephemeral instant DB (no-signup) | Not applicable | "Sandbox for AI Agents — Kernel-Level Isolation" [source](https://nono.sh/) |
| First-party database | Not applicable | "[session records are written under $XDG_STATE_HOME/nono]" [source](https://nono.sh/docs/cli/features/audit) |
| Vector search | Not applicable | "Sandbox for AI Agents — Kernel-Level Isolation" [source](https://nono.sh/) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | "A GitHub Actions workflow with permissions: id-token: write" [source](https://nono.sh/docs/cli/features/package-publishing) |
| Built-in observability | Partially supported | "Security-relevant events are hash-chained into an audit record sealed with a SHA-256 Merkle root [...] # Verify session-local audit integrity and ledger inclusion / # Machine-readable JSON export" [source](https://nono.sh/docs/cli/features/audit) |
| Preview environments | Not applicable | "Ephemeral micro sandboxes for AI agents" [source](https://nono.sh/) |
| Scheduled tasks | Not supported | "[session lifecycle covers run/attach/detach/cleanup — no scheduler]" [source](https://nono.sh/docs/cli/features/session-lifecycle) |
| Project template marketplace | Partially supported | "nono registry — Secure package registry for agent setup, skills and policy enforcement [and] Profiles for all the popular agents live at registry.nono.sh, secured and ready to pull. Each one bundles the right filesystem scope, network allowlist, hooks, skills and more." [source](https://registry.nono.sh/) |
| Durable workflows | Not applicable | "Supervised and Direct execution strategies" [source](https://nono.sh/docs/cli/features/execution-modes) |

## Agent readiness

### Read: 9.5 of 10 signals present

9.5/10 signals (9 full, 1 partial; 1 na) — near-complete machine-readable surface: llms.txt + llms-full.txt, .md content negotiation on every docs page, SoftwareApplication JSON-LD, two sitemaps; only robots.txt is merely silent

- Llms txt: pass — "https://nono.sh/docs/llms.txt — 10,296 bytes, '# Nono Docs' with every one of 76 pages linked as a .md URL plus a one-line description each. (Apex /llms.txt returns the Next.js 404 shell — per rubric v3 the docs-path copy earns full credit.)"
- Llms full txt: pass — "https://nono.sh/docs/llms-full.txt — 796,388 bytes, all 76 pages concatenated with `Source:` provenance headers. Comprehensive, not truncated. (Retained as a POINTER stub in artifacts/ per the size cap; the pages scored against are saved individually.)"
- Robots AI policy: partial — "https://nono.sh/robots.txt — 'User-Agent: *\nAllow: /' plus two Sitemap: lines. Default-allow with no AI-UA mention either way → half per the rubric."
- JSON LD: pass — "Homepage carries 6 ld+json blocks incl. SoftwareApplication {applicationCategory: SecurityApplication, operatingSystem: 'macOS, Linux, Windows', offers: {price: '0', priceCurrency: 'USD'}, downloadUrl}, plus Organization and WebSite. Rich, product-level. (Organization name is the stale 'Always Further' — see meta.notes.)"
- Sitemap: pass — "https://nono.sh/sitemap.xml — 95 <loc> entries with lastmod/changefreq/priority; a second https://nono.sh/docs/sitemap.xml with 76 more. Both declared in robots.txt."
- Meta quality: pass — "Descriptive <title> 'Sandbox for AI Agents — Kernel-Level Isolation | nono', a substantive meta description, a full OG set incl. a generated og:image (1200x630), a 14-term keywords list, and rel=canonical."
- Markdown negotiation: pass — "Every docs page has a clean .md twin — https://nono.sh/docs/cli/clients/claude.md returns markdown prefixed with '> ## Documentation Index / > Fetch the complete documentation index at: https://nono.sh/docs/llms.txt / > Use this file to discover all available pages before exploring further.' An agent is actively pointed at the index."
- Content efficiency: pass — "Homepage: 8,131 bytes of readable text out of 134,732 bytes of HTML = 6.03% (>5%). Server-rendered Next.js — the full hero, feature copy and testimonials are in the initial HTML."
- Docs discoverable: pass — "Docs are first-class in the header nav (Sandboxes / Features / Docs), present in the no-JS HTML, and reachable at https://nono.sh/docs without any client-side routing."
- Pricing machine readable: na — "No commercial offering to price — a free Apache-2.0 self-hosted tool with no hosted tier. /pricing 404s and the JSON-LD declares price '0' USD. Dropped from the denominator per the oss-tool kind-pack rather than scored as a failure."
- Anti bot: pass — "No challenge anywhere on the public surface: homepage, all docs pages, .md variants, both sitemaps, robots.txt, install.sh and registry.nono.sh all fetched headless with plain curl/firecrawl at HTTP 200."

### Drive: 3.5 of 7 signals present

3.5/7 signals (3 full, 1 partial; 4 na — a local CLI with no hosted endpoint) — official CLI, four SDKs and a real agent-config/skills surface, but no first-party MCP server and no programmatic API of any kind

- Public API: fail — "No HTTP/socket control API. The product surface is `nono` (CLI) plus in-process libraries; registry.nono.sh exposes no documented API (/api → HTTP 500, /openapi.json → 404). Scored fail rather than na because a local tool can expose a local API — microsandbox in this dataset does."
- Openapi spec: fail — "No spec at any probed path on nono.sh or registry.nono.sh; none referenced in the 76-page docs index."
- MCP server: fail — "No first-party MCP server. /.well-known/mcp returns the Next.js 404 shell; no npm/pip-installable MCP package is documented. All 11 'MCP' hits in llms-full.txt are about sandboxing OTHER MCP servers (`nono run --block-net --open-port 3000 -- node server.js`) or the tagline 'AI agents, MCP and LLM workloads' — verified against the rubric's mcp_server false-positive guard."
- SDK packages: pass — "Four official SDKs over one Rust core: nono (crates.io, docs.rs/nono), nono-py, nono-ts, nono-go — each with its own API-reference tree in the docs (/docs/python/api/* 10 pages, /docs/go/api/* 4, /docs/typescript/* 8)."
- Auth docs: na — "No hosted API to authenticate against — nono runs locally and holds no account. (There ARE deep credential docs — keyring, 1Password, OAuth capture, SPIFFE — but those authenticate the WORKLOAD's outbound calls, not a consumer calling nono; registry publishing uses GitHub OIDC trusted publishing, a publisher flow.)"
- Agent self serve creds: na — "There is nothing to sign up for: `brew install nono` (or curl/apt/dnf/AUR/Nix) and run. No account, no key, no card at any point — the check has no object."
- Webhooks: fail — "No webhooks. nono has 'hooks' in the agent sense (Claude Code / Codex PostToolUse hook scripts shipped in packs), which is a different mechanism — no outbound HTTP event delivery, signed or otherwise."
- CLI tool: pass — "Official, first-party, and the primary interface. Homebrew + .deb + Fedora COPR + RPM + AUR (nono-ai-bin, officially maintained) + nixpkgs + a checksum-verifying install.sh; a dedicated 65 KB flag reference page."
- Error model: partial — "Typed SDK errors are documented (https://nono.sh/docs/go/api/errors; Python/TS error surfaces) and several commands emit machine-readable output (`nono audit --json`, `nono rollback --json`, `nono profile show --raw --json`, exit 137 on an OOM kill with a structured diagnostic). But there is no JSON error model in the API sense — there is no API."
- Rate limit docs: na — "No hosted endpoint to rate-limit. The nearest analogue is local resource capping (--memory / --max-processes), documented thoroughly but a different concept."
- Agent config: pass — "Two surfaces: (1) the repo ships AGENTS.md AND CLAUDE.md (plus a NOGENT.md) at its root; (2) packs are a documented distribution channel for agent skills and plugins — `skills/*/SKILL.md`, `.claude-plugin/plugin.json`, `hooks/hooks.json`, with `nono pull` synthesising the Claude Code marketplace wiring. No /.well-known/agent on the web surface (404)."

## Coding harnesses

- Claude Code (Anthropic) — "Sandboxing Anthropic Claude Code with nono — `nono run --profile nolabs-ai/claude -- claude`" [source](https://nono.sh/docs/cli/clients/claude)
- Codex CLI (OpenAI) — "Sandboxing OpenAI Codex CLI with nono" [source](https://nono.sh/docs/cli/clients/codex)
- OpenCode (opencode) — "Sandboxing OpenCode AI coding assistant with nono" [source](https://nono.sh/docs/cli/clients/opencode)
- OpenClaw (Peter Steinberger) — "Sandboxing OpenClaw AI coding agent with nono" [source](https://nono.sh/docs/cli/clients/openclaw)
- GitHub Copilot (GitHub) — "GitHub Copilot — https://registry.nono.sh/packages/nolabs-ai/copilot-cli" [source](https://nono.sh/)
- Pi (earendil-works) — "$nono search pi ↳ nolabs-ai/pi — $nono run --profile nolabs-ai/pi -- pi" [source](https://nono.sh/)
- Hermes Agent (Nous Research) — "Hermes — https://registry.nono.sh/packages/nolabs-ai/hermes" [source](https://nono.sh/)
- Goose (Block) — "Works with your agents — nono sandboxes any terminal agent. Pull a signed profile from the registry and run — no wrappers, no rewrites. [...] Goose" [source](https://nono.sh/)
- Antigravity (Google) — "Antigravity — https://registry.nono.sh/packages/nolabs-ai/antigravity" [source](https://nono.sh/)
- Qwen Code (Alibaba (Qwen)) — "Works with your agents [...] Qwen Code" [source](https://nono.sh/)

## Open source

- Repository: https://github.com/nolabs-ai/nono
- License: Apache-2.0
- Stars: 3533
- Forks: 236
- Self-host methods: package-manager, binary, source-build

## Company & presence

- Headquarters: London, United Kingdom
- Founded: 2025
- Privacy policy: https://nolabs.ai/privacy
- GitHub: https://github.com/nolabs-ai/nono
- Discord: https://discord.gg/pPcjYzGvbS
- X / Twitter: https://x.com/nolabs_ai
- Bluesky: https://bsky.app/profile/nolabs.ai
- Blog: https://nono.sh/blog
- Company blog: https://nolabs.ai/blog
- Package registry: https://registry.nono.sh/
- Careers: https://nolabs.ai/careers
- Academy / learning: https://nono.sh/academy

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.