- I could use regardless of the model or harness running underneath
- I could build simple, composable, plaintext security policies for
- Provided strong vm level isolation
- Hid credentials from agents
- Scanned and monitored everything going in and out of agent workspace
- Allowed me to use the same mobile flow I had gotten used to with claude code, but with arbitrary harnesses
I couldn't find a tool that met all of these, so I started bot-bottle. It's evolved into what I'm hoping will be the best security conscious, local first coding agent orchestrator out there.
Here's how it works:
Each agent runs in its own microVM (Firecracker on Linux, Apple's container on macOS, Docker as a weaker fallback), with whichever harness you want. Claude Code, Codex and pi are built in, and custom agent providers are supported (still being documented/tested).
What an agent can reach is defined in a "bottle", which is just a short markdown file listing hosts, repos and which secret goes to which host. Bottles are enforced by a gateway outside the agent VM, which adds the real credentials to requests on the way out, so the agent only sees placeholders. Bottles stack, so you can keep small ones around (npm read only, one repo, one API, etc) and combine them per task. Repos can ship their own bottles, which only run after you trust their exact contents.
Outgoing requests and git pushes are scanned for secrets, and everything is logged locally (you can stream it to your own endpoint as NDJSON or OCSF). Anything a bottle doesn't allow comes to you for approval, in the terminal or on your phone through an optional paired console.
It's in alpha (the console especially), so UI polish is still in progress.
Install:
curl -fsSL https://raw.githubusercontent.com/diderisoft/bot-bottle/main/install.sh | sh
Would love feedback, especially on the threat model and on whether bottles are the right abstraction.