glovebox-monitor

A second model that reads every tool call an agent proposes, before the call runs, and answers allow / ask / deny. This is the supervision layer out of glovebox, packaged on its own so you can run it over your existing isolation instead of adopting glovebox's sandbox.

If pip install glovebox-monitor reports no matching distribution, no release has reached PyPI yet. Install from the repository instead, which tracks the main branch:

pip install "glovebox-monitor @ git+https://github.com/AlexanderMattTurner/agent-glovebox.git#subdirectory=glovebox-monitor"

What is in the box

The package is monitorlib, and it is stdlib-only. That is a deliberate constraint, not an accident: the monitor runs inside a guest image with no package index, so a dependency here would have to be installable there too.

• A fail-closed design. Every layer that judges a call denies on its own failure. The fail-mode setting structurally refuses allow, an unparsable model reply is a hard deny, and the circuit breaker denies rather than opening the gate.
• Code-side legs the model cannot be argued out of: a static scan of the proposed command, and a deterministic risk taxonomy that labels the action from its content alone.
• Memory across calls. The judge sees what the agent already did this trajectory, so a chain assembled one harmless-looking step at a time is visible.
• Injection hardening. Two independent parsers must agree on the verdict, and untrusted text is stripped of invisible and ANSI bytes before the judge reads it.

Using it with Inspect

Register it as an Inspect approver. It composes with an approver you already have rather than replacing it — the approver contract covers the rules, including the edge where a policy list with no catch-all entry silently rejects every tool it forgot.

What a scaffold-level deployment does not give you

glovebox's own deployment reads the sandbox's network decision log, so it can say what a call actually reached. An approver sees only what the agent proposed. A tool that opens its own connection, and any process the agent started earlier, are outside its view. Pair it with the egress gateway when you need that ground truth.