GHOSTBOUND: open-source tool that lets AI agents see only allowlisted files from private repos
TheFreakinOG · reddit · 2026-09-13
A developer open-sourced GHOSTBOUND, a tool answering the question 'what is actually allowed to cross the boundary' when handing code to external AI agents, without exposing the whole private repo.
Flow: private Git repo → exact immutable commit → explicit allowlist policy → GHOSTBOUND → separate verified mirror → AI agent/reviewer/planner.
Key design points:
- Export bytes come from the exact Git commit, not the working tree; dirty and untracked files can't leak
- Symlinks and submodules rejected; aggressive path checking
- Gitleaks runs before materialization; deterministic provenance manifest lets receivers verify without repo access
The author tested it with a fresh external Claude coding agent on a mirror-derived working copy: the agent changed exactly the expected files, passed tests, and never asked for anything outside the allowed view. v0.1 is deliberately narrow—no plugins, remote access, agent write-back, or auto policy generation. Repo: github.com/TheFreakinOG/GHOSTBOUND
More from coding & agent
- Codex script bulk-downloads 9,000 baby monitor photos in 45 minutes — thegautamkamath · 2026-09-13
- 'The End of Prompt Engineering': 300 Kimi K3 agents, one AGENTS.md, zero escapes in 41 days — JohnAlexander · 2026-09-13
- Automation's blind spot: the undocumented tasks humans quietly do — chris_j_paxton · 2026-09-13
- Stop harness hopping: model and endpoint decide agent success, not the wrapper — aidenclarke_12 · 2026-09-13
- Agentic commerce in action: agent buys Berlin weather data via x402 for $0.06 — MountainAssignment36 · 2026-09-13
- Dev burns Claude's 5-hour limit in one hour, switches to Codex for implementation — rudrank · 2026-09-13