Only what you allow. Not your whole Mac.

Nothing to migrate, nothing to move

BX puts apps you already have into a sandbox. Pick Claude, Claude Code, Cursor or your terminal. Pick the folders it is allowed to touch. BX builds a launcher for it, and you start it from the Dock like any other app.

Inside that session the app sees those folders. It does not see your passwords, your mail, your messages, your keys, or anything else lying around in your home directory.

Nothing else about your setup changes. Same apps, same folders, same workflow — only the field of view is smaller.

If you use Claude and other AI apps

You do not have to write code for this to matter. An AI app that can read files reads them with your rights, and so does everything it starts. A single “let me have a look at your folder” is enough to also put your tax documents, your mail archive and your password database within reach.

Give it a launcher instead. It gets the folder you meant, and nothing beyond it.

Two things worth knowing:

• Quit the app first. If it is already running unprotected, starting the launcher only opens a window in the process that is already there — silently, without a sandbox.
• The value often sits in the extensions, not the app. An MCP server started as npx some-mcp-server is code from a stranger, running as a child process with your full rights. That is exactly what the sandbox is around.

If you build software

The obvious pitch — “AI agents are unsafe” — is the wrong one. The accurate one is narrower and easier to check: the sandboxes these tools ship with barely cover the read side.

Claude Code sandboxes on macOS, and so do Codex CLI, Gemini CLI and others. But the focus there is writes outside the working directory and network egress. Meanwhile ~/.ssh, ~/.aws, ~/.zsh_history, Mail and password manager containers stay readable the whole time.

And each of those sandboxes only covers its own harness. The editor extension, an MCP server, a terminal spawned by an in-editor agent — all outside of it. BX sits one layer below and does not care what runs inside.

That covers the whole family: terminal harnesses such as Claude Code, Codex, aider, opencode or goose, and editors with AI extensions like VS Code, Cursor, Windsurf, Zed or JetBrains. Same recipe, different bundle id.

Not only AI

Everything you start reads with your rights, agent or not:

• Package installs and builds — pnpm install, pip install, cargo build, make, Gradle. Postinstall scripts are the most used supply chain vector there is, and this happens daily.
• Mac-native toolchains that cannot be containerised — Swift, code signing, Fastlane. There is no Docker for these, and it is exactly where App Store Connect keys and signing identities live.
• Client separation in contract work — client A’s material stays out of reach while you work for client B. That is a contractual argument, not a fear-based one.
• Unfamiliar repositories — clone from GitHub and take a look. .vscode/tasks.json, .envrc, git hooks and the Makefile all run before you have read a line.

Any app that macOS does not already confine can go into a sandbox. For most of them it is not worth the trouble — for the ones that execute code you did not write, it is.

What you get

• A launcher per folder. A real app bundle in the Launchpad and in the Dock. Double-click, done.
• A policy you can read before you run it. The preview lists every folder the session may read and write. No guessing.
• Observation mode. Turn on “Record denied accesses” and every blocked path lands in a log. When something does not work, the list says what was missing — and a click hands it over.
• The same engine on the command line. bx run, bx dry, bx create-launcher, bx list.

Common apps are recognised automatically, including the Electron quirks that would otherwise keep them from starting.

Where the protection ends

BX is a file system read filter. A session may still run anything and reach the network — it simply sees less.

Seatbelt escapes are documented, and whatever a process can read it can also transmit. That covers the realistic problem, which is not a targeted attacker but a tool that reads more than it needs to and forwards it somewhere. Running deliberately malicious software is not what BX is for.

Origin

The concept, the protection rules and the .bxignore / .bxconfig.toml formats come from the command line tool bx-mac (MIT). The app is a full Swift port of that engine — no Node, no separate bx installation, same configuration files.