Only your workspace
A command can write inside the folder you shared and the system temporary folder. Nothing else.
SANDBOX
Your AI runs the command. Your credentials stay out of reach.
When ChatGPT, Claude or an Agent runs a command on your computer through Frely CLI, the command runs inside an operating-system sandbox. It can work in the folder you shared. It cannot read your keys or change how your computer starts.
BY DEFAULT
What a command can and cannot touch.
These rules apply to every command before anyone asks for more.
Credential folders
Folders such as ~/.ssh, ~/.aws and saved git credentials are hidden from every command. Frely’s own device key can never be opened, even with your approval.
How your computer starts
Shell start-up files, login items and git hooks are protected, so a command cannot leave something behind that runs later outside the sandbox.
WHEN A TASK NEEDS MORE
The AI asks. You decide.
- 01
The AI asks
It names the reason and the exact command. It cannot approve its own request.
- 02
You decide on Frely
You approve on the Frely website with your account’s verification, not with a button in the chat.
- 03
Narrow first, revoke any time
Approve one command, one credential group or one folder. Running without the sandbox is the last choice, never the default.
BUILT TO FAIL CLOSED
No sandbox, no run.
If a computer cannot run the sandbox, Frely CLI refuses the command and says why. It never runs the command without protection.
Unprotected runs are refused
A command that cannot be sandboxed stops with a reason instead of running.
Git keeps working, safely
Everyday commands like git push work. After each command, Frely CLI removes any new git setting that would run a program later, and tells the AI what it removed.
WHERE IT APPLIES
Every command Frely CLI runs for an AI.
The same rules cover three ways of running commands on your computer.
- Commands ChatGPT, Claude and other apps run on your computer through FrelyMCP
- Agents you run on your computer with Deploy to Frely
- Encrypted scripts in paid Skills
Commands your own AI runs directly in its terminal, such as Claude Code, follow that tool’s own rules.
WHAT IT DOES NOT COVER
Know the edges before you rely on it.
The sandbox keeps credentials out of reach. It is not a wall around everything on your computer.
Sites are not limited
Network is not limited by site, so npm, pip and git keep working. Protection comes from keeping credentials out of reach.
Files outside credential folders
Files outside credential folders, such as an .env file in another project, can be read by a command.
Approved access is real access
Access you approve is real access. Approve what you understand.
Built on open source
The sandbox is built on Anthropic’s open-source sandbox runtime, which is still in beta.
FAQ
Questions before you connect
Can the AI read my SSH keys?
Not by default. If a task needs them, the AI must ask and you approve on the Frely website.
Can the AI turn the sandbox off?
No. Only you can approve a run without the sandbox, on the Frely website.
Does it work on Windows?
Frely CLI runs sandboxed commands on macOS and Linux. Where the sandbox is not available, commands are refused instead of run unprotected.
Can a command send my files to the internet?
It can reach the network, so it can send what it can read. That is why credential folders are hidden.
How do I take back access?
Revoke it any time on the connections page, or run frely link off on the computer.
Open the connections pageREADY TO CONNECT?
Let your AI work. Keep your keys.
Install Frely CLI, then add it to the AI app you use.
Install Frely CLI