Bashkit

Bashkit is a virtual bash interpreter and in-memory file system written in Rust and exposed to Python that lets you run shell commands from AI agents without ever touching the host. Instead of shelling out with fork/exec, Bashkit reimplements 164 POSIX commands in-process, so every command executes inside a fully isolated, multi-tenant sandbox with no filesystem, process, or network access unless you explicitly grant it.

Built for agentic workloads, it ships a first-class LLM tool contract, configurable resource limits, snapshotting for checkpoint/resume, and a virtual filesystem with overlay and mountable backends. Each interpreter instance is independent, making it safe to hand a language model a real shell while keeping strict control over what that shell can reach.

What You Get

• A sandboxed bash interpreter that reimplements 164 POSIX commands in Rust with no fork/exec
• A virtual file system (in-memory, overlay, and mountable backends) isolated per interpreter instance
• An LLM tool contract (BashTool) with discovery metadata, streaming output, and system prompts
• Configurable resource limits for command count, loop iterations, function depth, output size, and filesystem size
• Snapshotting to serialize shell state and VFS contents for checkpoint and resume workflows

Common Use Cases

• Giving an AI coding or ops agent a safe shell to run generated commands
• Executing untrusted, model-generated bash in a multi-tenant SaaS backend
• Sandboxing tool calls in an agent framework where a real filesystem would be risky

Under The Hood

Architecture Bashkit is a Rust workspace split into focused crates (bashkit core, bashkit-cli, bashkit-coreutils-port, plus bashkit-python and bashkit-js bindings). The core parses and evaluates shell scripts against a virtual filesystem abstraction rather than the host, with every builtin implemented natively in Rust and dispatched in-process; the async engine is built on tokio. The Python package (crates/bashkit-python, built with PyO3) surfaces the interpreter and the BashTool contract to Python callers.

Tech Stack Written in Rust (371 source files across the workspace) with PyO3 for Python bindings and NAPI-RS for Node/Bun/Deno. It uses tokio for async execution and cargo features to gate optional capabilities (realfs, git, python, typescript, sqlite, scripted_tool). Packaging is via maturin to publish the bashkit wheel on PyPI.

Code Quality The repository is unusually disciplined: a specs/ directory documents a threat model, testing and security-testing strategies, and 29 Python plus many Rust test files exercise the interpreter. Supply-chain controls (deny.toml, supply-chain/, THIRD_PARTY_LICENSES) and CI badges indicate a mature engineering process for a young project.

API Design The public surface is deliberately agent-first: you instantiate an interpreter, optionally enable features, and expose a BashTool with built-in discovery metadata and streaming, so wiring it into an LLM tool loop requires minimal boilerplate. Resource limits and network allowlists are explicit configuration rather than afterthoughts.