leash (strongdm) — Summary

Leash by StrongDM is a Go-compiled CLI tool that wraps AI coding agents (Claude, Codex, Gemini, Qwen, OpenCode) in containers (Docker/Podman/OrbStack) with real-time Cedar policy enforcement via eBPF LSM and an HTTP MITM proxy, providing full monitoring of filesystem access, network connections, MCP tool calls, and a web-based Control UI at localhost:18080.

Problem it solves: AI coding agents running on the host machine have unlimited filesystem and network access — they can exfiltrate data, execute malicious commands, or access resources outside the project directory. Leash enforces deterministic Cedar policies at the kernel level (eBPF), making policy violations structurally impossible rather than probabilistically unlikely.

Distinctive trait: Cedar policy enforcement via eBPF LSM — not prompt-level guidance, not YAML allow-lists, but actual kernel-level system call interception. The Control UI includes a Monaco-based Cedar policy editor with live autocomplete, syntax highlighting, inline validation, and a real-time event stream from the eBPF monitor.

Target audience: Security-conscious organizations and developers who want to run AI coding agents with verifiable containment guarantees — the same teams that use StrongDM's PAM/zero-trust infrastructure products.

Production-readiness: Active (565 stars, Apache-2.0, Go, last commit 2026-04-06). Ships as npm package, Homebrew cask, and pre-built binaries. Run by StrongDM (enterprise infrastructure company).

Differs from seeds: No seed framework provides anything comparable. Leash operates at the OS/container layer, below all other frameworks in the corpus. Unlike claude-code-guardrails (which blocks specific write operations via hooks), Leash monitors and enforces at the system call level. Unlike agent-governance-toolkit (which enforces at the API call layer in application code), Leash enforces at the filesystem and network layer independent of the agent's code.

leash (strongdm) — Overview

Origin

Created by StrongDM, an enterprise Privileged Access Management (PAM) and zero-trust infrastructure company. Leash applies StrongDM's core competency (policy-controlled access to infrastructure) to AI coding agents. Apache-2.0 license.

Philosophy

From the README:

"Leash wraps AI coding agents in containers and monitors their activity. You define policies in Cedar; Leash enforces them instantly."

The core premise: "prompt-level safety is not a control surface." Cedar policies enforced via eBPF make violations structurally impossible, not just unlikely.

Key Concepts (from README)

• Full monitoring: Captures every filesystem access and network connection initiated by the agent so Cedar policies and audit trails operate on complete telemetry.
• Agent container: Runs your command with the current directory bind-mounted, so tools see the same file tree they would on the host.
• Leash container: Monitors system calls, applies Cedar policies, and exposes the Control UI at http://localhost:18080.
• Mount prompts: Remember whether to forward host agent credentials.

Cedar Policy Language

Cedar (AWS open-source policy language) provides:

permit (
    principal,
    action == Action::"FileOpen",
    resource
) when {
    resource in [ Dir::"/workspace" ]
};

Actions: FileOpen, ProcessExec, NetworkConnect, HttpRewrite, MCP tool calls

MCP Observer

From the docs:

"Leash includes a Model Context Protocol (MCP) observer that inspects, records, and enforces MCP tool calls made by the agent. Requests flowing through supported MCP transports are correlated with filesystem and network telemetry, enabling Cedar policies to govern tool use alongside core runtime activity."

Telemetry

Privacy-preserving: only os, arch, mode, Leash version, hashed workspace ID, and session duration are transmitted (no file paths, no policy contents). Disabled via LEASH_DISABLE_TELEMETRY.

leash (strongdm) — Architecture

Distribution

• Type: CLI tool (Go binary + npm wrapper + Homebrew cask)
• License: Apache-2.0
• Language: Go
• Binary: leash

Install Methods

# npm (recommended)
npm install -g @strongdm/leash

# Homebrew (macOS)
brew tap strongdm/tap
brew install --cask leash-app

# Pre-built binary from GitHub releases

Required Runtime

• Docker, Podman, or OrbStack
• macOS or Linux (WSL supported)
• The macOS app installs a helper for native eBPF monitoring

Architecture

User runs: leash --open claude

┌─────────────────────────────┐   ┌──────────────────────────────┐
│     Agent Container          │   │     Leash Container           │
│  ┌─────────────────────┐    │   │  ┌────────────────────────┐  │
│  │  AI Agent (claude,  │    │   │  │  eBPF LSM Programs     │  │
│  │  codex, gemini...)  │    │   │  │  (filesystem monitor)  │  │
│  │  + current dir      │    │   │  ├────────────────────────┤  │
│  │    bind-mounted     │    │   │  │  HTTP MITM Proxy       │  │
│  └─────────────────────┘    │   │  │  (network + MCP)       │  │
│                              │   │  ├────────────────────────┤  │
│                              │   │  │  Cedar Policy Engine   │  │
│                              │   │  │  (transpile → IR)      │  │
│                              │   │  ├────────────────────────┤  │
│                              │   │  │  Control UI (Next.js)  │  │
│                              │   │  │  localhost:18080       │  │
│                              │   │  └────────────────────────┘  │
└─────────────────────────────┘   └──────────────────────────────┘

Control UI (Web Dashboard)

• Port: 18080
• Stack: Next.js + React (from controlui/web/package.json structure)
• Features:
  • Monaco-based Cedar policy editor (autocomplete, validation, syntax highlighting)
  • Real-time event stream from eBPF monitor (filesystem, network, MCP)
  • Policy update endpoint: POST /api/policies
  • Policy completion: POST /api/policies/complete
  • Policy validation: POST /api/policies/validate

Config Files

~/.config/leash/config.toml

[leash]
codex = true

[projects."/absolute/path/to/project"]
target_image = "ghcr.io/example/dev:latest"

Supported AI Agents (built into default coder image)

claude, codex, gemini, qwen, opencode

Default Image

public.ecr.aws/s5i7k8t3/strongdm/coder — pre-built with all supported agents

leash (strongdm) — Components

CLI Binary

Cedar Policy Actions (enforced at kernel level)

Control UI Components

Configuration System

No Hooks, No Skills, No Commands (Agent-Side)

Leash operates at the OS/container layer. It has no Claude Code hooks, no SKILL.md files, no slash commands. The agent runs normally inside the container — Leash is transparent to the agent.

leash (strongdm) — Uniqueness

Differs from Seeds

No seed framework operates at Leash's layer. Every seed framework works above the OS (prompts, hooks, skills) — Leash works at the OS/container layer. The closest in spirit is kiro's proprietary enforcement hooks (which block agent actions before execution) but Leash uses actual kernel-level enforcement via eBPF rather than IDE hook exit codes. Unlike claude-code-guardrails (which blocks specific file writes via Claude Code's PreToolUse hooks), Leash blocks at the syscall level — the agent cannot even attempt the forbidden operation, rather than receiving an exit code from a hook. Unlike agent-governance-toolkit (which enforces at the API/application layer in your code), Leash enforces at the infrastructure layer independent of the agent's codebase.

Key Differentiators

1. eBPF LSM kernel enforcement: The only framework in the corpus that uses kernel-level system call monitoring. Policy violations are EPERM — structurally impossible, not just blocked by a hook.
2. Cedar policy language: Declarative, auditable, versioned security policy rather than bash if-statements or hook exit codes.
3. MCP observer: Correlates MCP tool calls with filesystem and network telemetry — cross-layer visibility unique in the corpus.
4. Control UI at localhost:18080: The only framework in the corpus with a dedicated real-time web dashboard for live monitoring (Next.js, Monaco editor, live event stream).
5. Truly agent-agnostic: leash bash, leash python3 agent.py — any command can be monitored. Not tied to Claude Code hooks.
6. Commercial company: Backed by StrongDM, bringing enterprise PAM/zero-trust engineering to AI agent containment.

Positioning

Leash is the only "security infrastructure" framework in the corpus — it's not a methodology, not a quality gate, not a TDD enforcer. It is a containment system that makes AI agent misbehavior structurally impossible within defined bounds. The natural enterprise pairing with agent-governance-toolkit (application layer) + Leash (infrastructure layer) covers the full stack.

Observable Failure Modes

• Default permissive policy: Leash starts with permit all — teams that install it without configuring Cedar policies get monitoring with no enforcement.
• Docker requirement: Adds container infrastructure overhead. Not suitable for constrained environments (some CI systems, resource-limited hosts).
• eBPF lint limitation: Cedar statements that eBPF "cannot evaluate" must be translated to the available enforcement techniques — some Cedar semantics may not map cleanly.
• macOS native mode is experimental: eBPF on macOS is not native; the macOS app is a separate, less mature path.
• Single policy file per session: Policies are updated at runtime via API but start from a single .cedar file — complex multi-tenant scenarios need careful design.

Explicit Antipatterns

• Prompt-level safety ("please follow the rules") instead of structural enforcement
• Running AI agents with unlimited filesystem and network access
• Sharing API keys across multiple agent processes (no identity isolation)