predictionguard/sbx-predictionguard repository overview

⁠Prediction Guard + Docker SBX

Run autonomous agents (Claude Code, OpenCode, Hermes, etc.) inside the Prediction Guard Docker verified sandbox, with operational control of every action they take. Maintain least agency and limit the blast radius by restricting network access to your self-hosted Prediction Guard⁠ sovereign AI control plane.

The Prediction Guard control plane allows you to manage the supply chain on which the agents operate, scope model & tool access, and enforce agent behavioral controls. The Docker sandbox ensures that there is not a workaround to this scoping and the Prediction Guard controls.

To spin up autonomous agents via these "two gates of defense" grab your evaluation license for Prediction Guard⁠.

⁠How it works

Ensure "two gates of defense" for autonomous agents:

Gate #1: Docker Sandbox (SBX) This SBX "kit" isolates the local runtime layer. The agent harness runs inside a microVM sandbox with its own kernel, filesystem, and network stack. It is locked down to only those resources that are explicitly allowed (least agency).

Gate #2: Prediction Guard (PG) This "control plane" manages and controls the supply chain of allowed resources (models and tools) and how the agent behaves as it operates on those resources. Every agent action (and traces of agent behavior over time) are analyzed in real time to enforce: (a) proper agent scoping to only certain MCP servers, tools within MCP servers, and model endpoints; (b) agent behavioral controls bound to the agent's identity protecting against risks such as memory poisoning, tool misuse, runaway token use, and privilege escalation; and (c) component input and output policies for how PII, injections, and other potentially harmful context is handled in API handshakes.

Read the full writeup on this combined solution here: Two Gates of Defense — predictionguard.com/blog⁠

Architecturally, this provides a pathway to run autonomous agents at scale without losing control. A fleet of agents operating with these two gates of defense would look like the following:

┌──────────────────────┐  ┌──────────────────────┐  ┌──────────────────────┐
│ Docker SBX (Gate 1)  │  │ Docker SBX (Gate 1)  │  │ Docker SBX (Gate 1)  │
│ • egress: PG only    │  │ • egress: PG only    │  │ • egress: PG only    │
│ • creds: proxied     │  │ • creds: proxied     │  │ • creds: proxied     │
│ • fs: workspace only │  │ • fs: workspace only │  │ • fs: workspace only │
│ • no pkg installs    │  │ • no pkg installs    │  │ • no pkg installs    │
│ ┌──────────────────┐ │  │ ┌──────────────────┐ │  │ ┌──────────────────┐ │
│ │ Agent 1          │ │  │ │ Agent 2          │ │  │ │ Agent N          │ │
│ │ (OpenCode)       │ │  │ │ (Hermes)         │ │  │ │ (any harness)    │ │
│ └────────┬─────────┘ │  │ └────────┬─────────┘ │  │ └────────┬─────────┘ │
└──────────┼───────────┘  └──────────┼───────────┘  └──────────┼───────────┘
           │                         │                         │
           └─────────────────────────┼─────────────────────────┘
                                     │  (only reachable endpoint)
                                     ▼
┌──────────────────────────────────────────────────────────────────────────┐
│  Self-hosted Prediction Guard control plane (Gate 2)                     │
│                                                                          │
│  • Model endpoint, MCP server & tool scoping                             │
│  • Agent tracing bound to unique agent identities                        │
│  • Immutable Audit Log                                                   │
│  • Component input/output policy enforcement (prompt injection,          │
│    toxicity, PII processing, etc.)                                       │
│  • Behavioral controls tied to agent identity (privilege                 │
│    escalation, tool misuse, memory poisoning, runaway token use)         │
│  • Agent kill switches                                                   │
│  • AIBOM export in CycloneDX format (with supply chain risks)            │
│  • Human-in-the-loop approvals for tool access                           │
│  • AI security events with SIEM integration                              │
│                                                                          │
└───────┬───────────────────┬───────────────────┬───────────────────┬──────┘
        │                   │                   │                   │
        ▼                   ▼                   ▼                   ▼
┌──────────────┐    ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│ Model 1      │    │ Model N      │    │ MCP server 1 │    │ MCP server N │
└──────────────┘    └──────────────┘    └──────────────┘    └──────────────┘

⁠Quick start

Register your Prediction Guard API token once:

sbx secret set predictionguard

Then compose the kit onto any agent workload:

# Claude Code
sbx run docker/claude-code \
  --kit docker.io/predictionguard/sbx-predictionguard:latest \
  --kit-arg pgHost=pg.yourcompany.com \
  .

# Hermes
sbx run docker/hermes-agent \
  --kit docker.io/predictionguard/sbx-predictionguard:latest \
  --kit-arg pgHost=pg.yourcompany.com \
  .

# OpenCode
sbx run docker/opencode \
  --kit docker.io/predictionguard/sbx-predictionguard:latest \
  --kit-arg pgHost=pg.yourcompany.com \
  .

Replace pg.yourcompany.com with your Prediction Guard deployment URL.

Need a Prediction Guard deployment? Get your evaluation license →⁠

⁠What this kit does for developers

• Control plane integration: supply chain management of an agent's underlying system, runtime controls for components of that system (e.g., models) and agents themselves, rate and token budget controls, and full observability into agent behavior and model/tool calls
• MCP tool scoping: control of registered MCP servers, with scoping per agent identity, logging of every tool call, built-in MCP proxy, and configurable human-in-the-loop approvals
• Runtime controls: standards-aligned policies for component input and output (including PII processing and redaction, prompt injection detection, and credential scrubbing among others) and agent behavior controls (for detection of memory poisoning, runaway token use, goal drift, etc.), which are applied on live agent behavior rather than after the fact
• Compatible API surface: OpenAI, Anthropic, MCP, and agent SDK compatible endpoints, so existing agent implementations (such as LangGraph, Pydantic AI, CrewAI, OpenCode and Claude Code) operate with zero refactoring
• Verified provenance: signed images, Docker Scout vulnerability scanning, and the Docker Verified Publisher badge

⁠Learn more

• Two Gates of Defense — predictionguard.com/blog⁠
• Prediction Guard joins Docker Verified Publisher Program⁠
• Source — github.com/predictionguard/docker-pg-experiment⁠