Compare
Forkbench vs Claude Code's sandbox
Claude Code's built-in sandbox (/sandbox) uses macOS Seatbelt or Linux bubblewrap to restrict where Claude can write and which domains it can reach. It is off by default.
Updated
Claude Code's /sandbox is off by default, applies to Claude only, and mainly limits where it can write plus which domains it can reach. Forkbench's folder lock applies to every agent and every process in a Thread, and blocks reads as well as writes outside the job's folders, so ~/.ssh and your other repos stay unreadable. Add the Vault and your keys never enter the agent's context.
Turn on Claude's sandbox by all means. Then give every agent, Claude included, a boundary that also covers what it can read.
| Forkbench | Claude Code's sandbox | |
|---|---|---|
| Agents locked to your project folders | Yes. The macOS kernel seals off the rest of your home folder, per Thread | Writes limited to the working directory; off by default |
| API keys the agent never sees | Yes. The Vault runs the command and the agent only gets the result | No secrets broker |
| Every agent at a glance | Yes. A live pulse on every tab and the task each agent claimed | Inside Claude Code |
| Know when an agent is stuck | Instantly. It turns red and the Thread counts who needs you | Inside Claude Code |
| Share one job with a teammate or client | Yes. Invite them to one Thread, never your machine | No |
| Human sign-off before work counts as done | Always. Agents report, only you accept | No |
| Works with | Any CLI agent: Claude Code, Codex, Cursor CLI, Gemini CLI, Aider, your own scripts | Claude Code only |
| Blocks reading other folders | Yes, everything outside the job's folders | Not by default |
| Network allowlist | No, the lock covers folders | Yes |
| Price | Free on one Mac; Pro €30/mo for every Mac, your phone and sharing | Included with Claude Code |
Why developers pick Forkbench
- Blocks reads outside the job, not only writes.
- Covers every agent and every process in the Thread, whatever the vendor.
- A Vault so keys never reach the agent's context.
- Supervision, sign-off and sharing on top.
What Claude Code's sandbox does well
- Built into Claude Code, with nothing to install.
- A network allowlist, which Forkbench's folder lock does not provide.
The verdict
They stack well: keep Claude's network allowlist and put the job in a locked Forkbench Thread. You get read protection, every agent covered, keys out of reach and a clear view of the whole squad.
Keep reading
Sources
Comparison based on publicly available information, checked on the date above. Spot something out of date? Tell us.