About

Why this exists

This is a labor of curiosity. I wanted to deeply understand the security models available to me for local development with agents and potentially malicious code, the kind of thing that shows up in supply-chain attacks like the Shai-Hulud 2.0 worm, which compromised around 30,000 repositories and stole GitHub credentials and tokens. Along the way I ran into plenty of senior engineers who, like me, had only vague ideas about how these isolation models actually work. So I built this: to pin down the underlying models and make isolation-level choices transparent, so we can all make better ones.

Methodology

Every entry, every piece of tech, every agent, is hand-curated from primary sources: vendor documentation, source code, and independent technical write-ups. Nothing here is generated or scraped. Where a claim could not be confirmed, that is stated explicitly rather than filled in with a guess.

What the verification field means

Every tech and agent entry carries a verification field that says how well-established its isolation claim is. It is one of four values, and the distinction matters:

verified-code

We read the source. The isolation mechanism is confirmed by inspecting the actual implementation, not just a claim about it.

documented

The vendor documents it. We trust the vendor's own written description of the mechanism, but have not independently verified it against the code.

inferred

Deduced from design. Neither the vendor nor the code says so directly, but the architecture makes the conclusion reasonably certain, e.g. "runs in a container" because it ships a Dockerfile and no other isolation is mentioned anywhere.

undisclosed

The vendor does not say. This is never presented as fact, and it is never guessed into a tier, an agent with undisclosed isolation gets tier: "unknown", not a made-up answer. One exception: when a vendor states the tier itself ("runs in a VM") but never names the technology behind it, we keep the vendor-stated tier and still mark the entry undisclosed. Even "none" is a claim (that there is no isolation), so it is reserved for cases where that has actually been confirmed.

Sources

Each entry cites its own primary sources, vendor documentation and the project's source repositories are linked directly from the entry. Those citations are the record; follow them to check any claim. The ones worth reading end to end, rather than consulting, are collected under further reading.

Feedback

Found an error, have a correction, want to suggest an entry, or just have thoughts? Errata and suggestions are especially welcome; getting these details right is the point.

Colophon

Built by Chad Fennell. You can find more about me and my work at chadfennell.com.