# Install nono with Homebrew, Nix Capability-based sandbox shell for AI agents with OS-enforced isolation. Version 0.67.1 via Homebrew; verified 2026-07-06. ## Install ```sh sudo av install brew:nono ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install nono ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#nono ``` Evidence: nixpkgs package indexes: pkgs/by-name/no/nono/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:nono - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.67.1 - **Source summary:** Capability-based sandbox shell for AI agents with OS-enforced isolation - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-07-06T16:12:22Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - nono (cli) - nono (alias) ## Build dependencies - pkgconf - rust ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.67.1 - Package-manager updated: 2026-07-06 - Local data: ok - Upstream repository: https://github.com/nolabs-ai/nono - Upstream latest detected: v0.67.1 (current) ## Project history and usage nono is a capability-based sandbox CLI and SDK project for AI agents, MCP tools, and LLM workloads. Its docs describe a secure, kernel-enforced sandbox with capability-based isolation, secure key management, rollback, and an immutable audit chain. ### Project history The GitHub repository was created on 2026-01-31. Public launch material posted on 2026-02-02 framed nono as a response to local AI coding agents running with the user's full filesystem and network permissions. The core design uses kernel primitives instead of a container runtime: Landlock on Linux and Seatbelt on macOS. The project also exposes SDK directions beyond the CLI, with docs for a Rust core library plus Go, TypeScript, and Python integration paths. Release activity accelerated quickly in 2026. GitHub release metadata shows v0.66.0 published on 2026-06-29, and Homebrew packaged the same stable version in its 2026-07-01 formula data. ### Adoption history nono is young, but it had already become unusually visible for a 2026 security CLI: the GitHub repository had thousands of stars by 2026-07-01, Homebrew reported thousands of installs across 90 and 365 day windows in its 2026-07-01 formula data, and discussion/examples focus on sandboxing AI coding agents rather than generic process confinement. Because the project is close to the AI-agent security wave, adoption should be treated as early-stage and volatile. The reliable source-backed claim is that it had rapid package-manager and GitHub traction by mid-2026, not that it had become a mature standard. ### How it is used Typical CLI usage wraps an agent or command with explicit filesystem and network capabilities: examples include `nono run --allow . -- claude`, separate `--allow` and `--write` paths, `--net-block`, and `--dry-run`. The docs and launch post also describe default protection for sensitive paths such as SSH keys, AWS credentials, and shell configs. Package users reach for it when they want OS-enforced guardrails around an AI agent, build step, test run, or data-processing command without building a container image. The important operational model is that child processes inherit restrictions once the sandbox is applied. ### Why package nerds care nono is notable because it packages a security boundary as a normal CLI wrapper for developer workstations. For package nerds, the interesting part is not only the Rust binary but the distribution of OS-specific confinement behavior through one command: Landlock-backed Linux behavior, Seatbelt-backed macOS behavior, and formula variants that differ by platform dependencies. ### Timeline - 2026-01-31: GitHub repository created. - 2026-02-02: introductory post published. - 2026-06-29: v0.66.0 release published. - 2026-07-01: Homebrew formula data listed stable 0.66.0. ### Related projects - Related concepts and projects include Linux Landlock, macOS Seatbelt, AI coding agents such as Claude Code and OpenCode, MCP workloads, Docker, and local sandbox wrappers. ### Sources - - - - - - - ## Security Notes generalized runtime or code generation signal. - **Geiger risk:** yellow / medium - generalized runtime or code generation signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** nono - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Nix - nono: normalized package name match | nixpkgs package indexes: pkgs/by-name/no/nono/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://www.automicvault.com/pkg/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [rust](https://www.automicvault.com/pkg/brew/rust/) - Build dependency declared by Homebrew. - [sandvault](https://www.automicvault.com/pkg/brew/sandvault/) - Shares av.db curated category or tags: ai-agents, cli, sandbox, sandboxing, security. - [bubblewrap](https://www.automicvault.com/pkg/brew/bubblewrap/) - Shares av.db curated category or tags: cli, sandbox, sandboxing, security. - [fence](https://www.automicvault.com/pkg/brew/fence/) - Shares av.db curated category or tags: cli, sandbox, sandboxing, security. - [landrun](https://www.automicvault.com/pkg/brew/landrun/) - Shares av.db curated category or tags: cli, sandbox, sandboxing, security. - [jailkit](https://www.automicvault.com/pkg/brew/jailkit/) - Shares av.db curated category or tags: cli, sandboxing, security. - [libseccomp](https://www.automicvault.com/pkg/brew/libseccomp/) - Shares av.db curated category or tags: cli, sandboxing, security. - [falcoctl](https://www.automicvault.com/pkg/brew/falcoctl/) - Shares av.db curated category or tags: cli, runtime-security, security. - [pomerium](https://www.automicvault.com/pkg/brew/pomerium/) - Shares av.db curated category or tags: cli, security, zero-trust. ## Combined YAML source View the package source record on GitHub. [combined/nono.yml](https://github.com/automic-vault/db/blob/main/combined/nono.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph