Inspiration
AI coding agents paste code into repos every day, and that code runs with the developer's credentials. The sandbox setting meant to contain it is a setting the agent can switch off. CageCheck puts a cage between the agent and the repo: the policy lives outside the cage, so the code inside cannot switch it off.
What it does
Paste an AI-written Python snippet (or use a preset). A deterministic policy scan runs before dispatch, then the snippet runs in a throwaway runtime cage and is stamped PASSED, HELD or BLOCKED. Every block comes with a receipt naming the exact path, rule and replay instruction, so a block can be quoted back and reproduced. A clean snippet is the only one that can be approved — a BLOCKED receipt cannot be approved.
The policy is deterministic and fail-closed: secret-path reads, network connects, subprocess/shell, destructive calls, secret environment reads, and reads or writes outside the cage are blocked; a network import with no connect attempt is HELD for review. Secret environment variables are scrubbed before the cage sees them, and the cage has a 5-second timeout, 256 MB memory, 1 MB file and 64 KiB output caps. Vultr Serverless Inference explains a finding and suggests a safe replacement — it never decides block or approve.
Try it on the live demo: the attack preset reading /home/dev/.ssh/id_ed25519 is BLOCKED under rule secret_path_read, trying to write to the policy file is BLOCKED, and a clean snippet such as total([10, 20, 30]) PASSES with output 60.
How I built it
Built 3–10 November 2026 in Python 3.12, using only the standard library (stdlib http.server), with a Vercel serverless adaptation for the live demo. The policy engine sits outside the cage, the runtime cage is a child process with restricted imports and a scrubbed environment, and a receipt plus an audit-log entry are kept for every check. The test suite passed 10/10 on 3 November 2026, covering the policy rules, the runtime cage and redaction.
Honest limits
The live demo is process-level isolation, not a kernel or container boundary. A throwaway Docker container per check is the documented deployment path in the repo (Dockerfile and VULTR_DEPLOY.md), not the live Vercel tier — the live site says so on its /health page.
What I learned
Building a fail-closed policy that blocks unlisted external effects without blocking clean code, and making every block reproducible from its receipt.
Challenges I ran into
Keeping the policy deterministic while the cage still had to run real code, and keeping secrets out of the cage entirely — the cage never receives credentials.
Note
Also entered at SafeSpace Hacks on 10 November 2026; it was not built exclusively for GenHacks.
