Recommended Free Tools
Give an AI coding agent enough access to complete the task, but no more: read the project, write only inside the active workspace, and keep secrets, unrelated repositories, destructive commands, and unnecessary network destinations outside its reach. Treat file access, shell execution, network egress, credentials, external integrations, and approval prompts as separate controls.
Use a sandbox to enforce technical limits and an approval policy to decide when a human must authorize an exception. Before committing, merging, pushing, or publishing, inspect the complete diff and test results. Exact defaults vary by agent, operating system, edition, and organization policy.
As an Amazon Associate I earn from qualifying purchases.
What “permission” means for an AI coding agent
An agent can exercise several kinds of authority at once. A setting that permits file edits does not necessarily control shell commands; a confirmation prompt does not necessarily prevent a subprocess from reaching the network; and a sandbox may not cover every extension, language server, or Model Context Protocol (MCP) server.
Evaluate these controls independently:
- Filesystem: Which directories can the agent read, create, modify, or delete?
- Execution: Can it run a shell, package manager, compiler, test, script, or child process?
- Network: Can processes make outbound Internet connections, reach local or private networks, or both?
- Credentials: Which environment variables, files, tokens, SSH agents, cloud identities, and credential proxies are visible?
- Approvals: Which operations pause for a human, and which are automatically allowed?
- Integrations: Can MCP servers, extensions, webhooks, issue trackers, or deployment tools receive data or cause side effects?
- Review and audit: Can you inspect changes and see policy decisions or tool calls before integration?
A useful policy therefore states a scope, not just “allow” or “deny.” For example: “Read this repository, write under its workspace, run tests, use the package registry only when approved, and ask before touching credentials or pushing changes.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A practical least-privilege baseline
Start with the narrowest profile that can finish the current task. Expand it for a specific, documented reason, then remove the exception when the session ends.
| Control | Recommended starting point | Require an explicit exception for |
|---|---|---|
| Project files | Read the active repository; write inside its workspace and approved temporary directories | Home-directory access, unrelated repositories, system paths, mounted secrets, or production data |
| Shell and tools | Permit the commands needed for editing, building, linting, and tests | Destructive commands, privilege changes, system-wide installation, service control, or actions outside the workspace |
| Network | Off when the task does not need it | New hosts, internal services, local-network access, uploads, deployments, or broad Internet access |
| Credentials | No broad personal or production credentials; use scoped or brokered access | Any token, private key, cloud identity, or secret-bearing file |
| Approvals | Ask before expanding permissions or creating external side effects | Permission changes, sensitive paths, new destinations, deletion, pushing, publishing, or deployment |
| Review | Inspect the diff, tests, generated files, and tool activity | Never skip review merely because a command was auto-approved |
This is a policy pattern, not a promise that every product implements identical defaults. Confirm the effective settings in the agent and host you are using.
Filesystem access: keep writes inside the workspace
Workspace-limited write access is the most useful default for ordinary coding. The agent can inspect source, edit files, create tests, and generate build artifacts without gaining authority over your entire account.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Directories to include
- The checked-out repository or explicitly selected project root.
- Temporary directories required by the build or test runner.
- A narrowly selected fixture or dependency cache when the tool cannot work without it.
Directories to exclude
- Home-directory files unrelated to the project.
- Other repositories and shared workspaces.
.envfiles, cloud credential directories, SSH keys, signing keys, password stores, and production configuration.- Operating-system directories and mounted drives containing personal or regulated data.
Grant an extra path only for a named task. If a build needs a cache outside the project, expose that cache rather than the whole parent directory. Afterward, remove the path and check whether generated files or copied secrets remain in the workspace.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
GitHub Copilot CLI documentation describes a default in which sandboxed commands can write to the current working directory and temporary folders while other paths are blocked unless granted. VS Code documents workspace-limited built-in file tools. These examples illustrate the desired boundary; they are not universal defaults.
Terminal commands: useful, but put impact behind approval
Agents often need a shell to run tests, formatters, compilers, and package managers. Allow those tools only within the same filesystem and network boundaries as the task. A shell can invoke child processes, read inherited environment variables, follow symlinks, execute repository scripts, or combine harmless-looking commands into a destructive operation.
Commands that commonly fit the baseline
- Read-only inspection such as listing files, searching text, and viewing version information.
- Project-local formatters, linters, compilers, and test commands.
- Build steps that write artifacts under the workspace or an approved temporary directory.
Commands that should pause for a human
- Recursive deletion, disk formatting, database resets, or irreversible migrations.
- Changes to system configuration, services, users, permissions, or firewall rules.
- Installing software system-wide or modifying shared package locations.
- Publishing artifacts, pushing branches, opening pull requests, sending messages, or deploying.
Auto-approval rules can reduce repetitive prompts, but they are not a security boundary. VS Code warns that command parsing is best-effort and has limitations. Prefer session-scoped rules for a small, known command set, and inspect the exact command and arguments before allowing anything with external or destructive effects.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Network access is a separate decision
Disable network egress when the task can be completed from local files and installed dependencies. If network access is necessary, define why, which destinations are needed, and whether local or private-network access is also enabled.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Common legitimate needs
- Downloading a declared package or retrieving documentation for a version-specific API.
- Running integration tests against a designated staging service.
- Querying an approved issue tracker or source-control API.
Risks to distinguish
- Outbound Internet: Code, prompts, logs, or secrets may be sent to an external host.
- Local/private network: A process may reach internal dashboards, databases, metadata services, or other machines.
- Uploads and side effects: A request can create tickets, trigger builds, or alter remote data even when it looks like a read operation.
Defaults differ. GitHub Copilot CLI documentation describes outbound Internet as enabled by default while local network access is disabled. NERSC documentation describes its workspace-write profile with network access off unless enabled. Do not infer your agent’s behavior from either example; inspect the current policy and host controls. Where supported, allowlist exact hosts and keep package or documentation access separate from internal-service access.
Credentials: the highest-value boundary
Do not give an agent a broad personal access token, production credential, or private key simply because a command might need authentication. A credential can be copied into logs, passed to a child process, read by an MCP server, or used against every destination reachable from the session.
Safer patterns
- Use a short-lived, least-privilege token limited to one repository, API, or environment.
- Prefer a credential proxy that releases a secret only to an approved HTTPS destination.
- Mask additional environment variables when the product supports masking.
- Keep secrets outside the workspace and prevent the agent from reading their source files.
- Check which language servers, extensions, subprocesses, and MCP servers inherit the environment.
GitHub describes placeholder credentials for sandboxed commands: real values are supplied only for approved HTTPS destinations, with masking available for additional environment variables. Treat that as product-specific behavior and verify the session’s effective policy rather than assuming every tool provides the same protection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Sandboxing and approvals solve different problems
A sandbox is an enforcement mechanism. It can restrict filesystem paths, network access, and sometimes child processes. An approval policy is a decision mechanism: it determines when the agent must stop and ask you to authorize an operation outside its current allowance.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use both when available. A prompt alone can be bypassed by an already-authorized command or a malicious script; a sandbox without approvals may block useful work or silently permit an action inside an overly broad boundary. OpenAI describes these controls as complementary: the sandbox sets where Codex can write, whether it can use the network, and which paths are protected, while the approval policy determines when it asks to act beyond that boundary. OpenAI’s May 8, 2026 guidance also describes centrally managed requirements and agent-aware event telemetry; organization settings should not be assumed to match an individual installation.
Keep exceptions narrow and temporary. Require a fresh approval for permission expansion, a new network host, sensitive-path access, destructive operations, and any external side effect. Record the reason in the session or change log when your tooling supports it.
Untrusted repositories, scripts, and MCP servers
Repository content is input, not an instruction you automatically trust. A README, build script, test fixture, editor task, or package hook can ask the agent to reveal environment variables, run a destructive command, or contact an unexpected host.
- Open an unfamiliar project in a restricted or untrusted-project mode.
- Review repository instructions, task files, scripts, hooks, and dependency-install steps before granting broader access.
- Inspect MCP configuration and the provenance of every external server. Give each integration only the data and operations it needs.
- Run tests and builds in the sandbox, watching for unexpected network requests or writes outside the workspace.
- Review the diff and generated files before merging or executing deployment steps.
VS Code recommends restricted mode for untrusted projects, reviewing MCP servers before trust, and treating sandboxing as one layer rather than a virtual machine, user-account boundary, or replacement for endpoint security. Its guidance also notes that agent-executed development tasks operate with the user’s permissions, so the host account itself must be appropriately limited.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What current product guidance illustrates
| Product or documentation | Permission details described by the source | How to use the example |
|---|---|---|
| OpenAI Codex | Approvals and sandboxing are complementary; organizational controls and telemetry may be centrally managed. | Check the active sandbox, approval policy, and organization requirements rather than assuming a universal personal default. |
| GitHub Copilot CLI | Local sandboxing restricts files, network resources, and credentials. Documented defaults allow writes in the current directory and temporary folders, enable outbound Internet, disable local network access, and mediate approved HTTPS credentials. | Confirm platform prerequisites, enterprise policy, and effective settings before relying on those defaults. |
| Claude Code | An Anthropic engineering article dated October 20, 2025 described read-only-by-default behavior, prompts before modifications or commands (with some safe-command exceptions), and a sandbox runtime presented then as a beta research preview. | Verify current availability and behavior; the dated preview description should not be treated as a permanent product guarantee. |
| Visual Studio Code | Guidance recommends restricted mode, agent sandboxing, review before integration, session-scoped auto-approval, and MCP review. It warns that command parsing and sandbox coverage have limits. | Use the host account and injected credentials as part of the threat model. |
| NERSC Codex guidance | read-only permits inspection without filesystem changes; workspace-write permits routine writes in active workspace roots and temporary directories with network off unless enabled; danger-full-access removes local sandbox restrictions. |
These are NERSC operational profiles, not universal settings for every Codex installation. |
How to configure a session safely
- Define the task boundary. Name the repository, expected files, required commands, data sources, and whether any remote service is necessary.
- Select the narrowest filesystem profile. Start read-only for analysis. Move to workspace-only writes for implementation. Add a specific path only when a documented build or test requirement demands it.
- Set execution rules. Permit project-local checks and builds. Leave destructive, system-wide, and external commands approval-gated.
- Set network policy. Keep egress disabled when possible. If enabled, allow only the required destinations and decide separately about local/private-network access.
- Remove ambient credentials. Unset broad tokens and keys. Supply a scoped, short-lived credential through a proxy or masked mechanism only when the task requires it.
- Review integrations. Inspect MCP servers, extensions, hooks, package scripts, and language-server configuration before trusting them with project data.
- Run and observe. Watch file paths, commands, network requests, and approval prompts. Stop when behavior differs from the declared plan.
- Inspect before integration. Review the complete diff, test output, generated files, dependency changes, and any remote side effects before committing, merging, pushing, or publishing.
- Revoke temporary access. Close the session, remove extra paths and hosts, rotate credentials exposed to the session, and retain logs required by your organization.
A comparison framework for agents or configurations
Do not rank an agent with a single “safe” label. Compare the controls that matter to your task:
- Filesystem scope: List every readable, writable, and denied root, including symlink behavior and temporary directories.
- Execution boundary: Determine whether shell commands, child processes, MCP servers, and language servers are confined by the same sandbox.
- Network egress: Check Internet and local/private-network settings independently; identify host allowlisting and upload controls.
- Credential handling: Find out whether secrets are inherited, masked, proxied, or scoped to selected destinations.
- Approval behavior: Identify auto-approved operations, bypass paths, session duration, and organization overrides.
- Review and audit: Confirm that diffs, tool calls, policy decisions, and remote actions can be inspected and logged.
Common mistakes and recovery steps
“It only edits code, so the home directory is fine.”
Broad read access can expose keys, tax records, browser data, or unrelated source. Revoke the path, rotate any exposed credentials, inspect logs, and restart with a workspace-only profile.
“A confirmation prompt makes every command safe.”
Prompts do not replace execution isolation. Tighten the sandbox, remove auto-approval rules, and review scripts that the agent can invoke indirectly.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems“Internet access is harmless if the agent is not deploying.”
Outbound requests can leak source or trigger remote actions. Disable egress, clear credentials, inspect network logs, and allowlist only the documented hosts.
“The sandbox protects every integration automatically.”
Check MCP servers, extensions, language servers, and host processes individually. Remove untrusted integrations and rerun the task with only reviewed components.
“A successful test run means the change is safe.”
Tests establish behavior, not intent or supply-chain safety. Review the diff, dependency updates, generated files, and side effects before integration.
Quick checklist before you press Allow
- Is the active workspace the only writable project location?
- Are secrets, keys, unrelated repositories, and production data inaccessible?
- Are shell commands limited to the tools the task needs?
- Will destructive, system-wide, or external actions pause for approval?
- Is network egress off unless a named host is required?
- Are local/private-network connections separately controlled?
- Are credentials scoped, short-lived, masked, or brokered?
- Have repository scripts, extensions, MCP servers, and hooks been reviewed?
- Can you inspect the diff, tests, tool calls, and policy decisions?
- Do you know how to revoke temporary permissions when the session ends?
The safest useful configuration is therefore task-specific and reversible: workspace-limited writes, narrowly enabled tools, deliberate network access, no ambient secrets, approval for meaningful exceptions, and human review before integration.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
