CageCheck
Check the agent's code in a cage before it touches your repo. Paste a snippet, it is checked in a throwaway cage, under a policy the agent cannot switch off, and every block comes with a receipt you can quote back.
The cage — what it does for every check
- Throwaway cage per check, destroyed after the check
- Network off by default · secret env vars scrubbed before the cage sees them
- Policy lives outside the cage — the agent inside cannot switch it off
- 5s timeout · 256 MB memory · 1 MB file · 64 KiB output cap
- Local tier shown on /health — on Vultr this is a Docker container per check