Garuda is a free, open-source AI coding agent with an unusual promise: its safety limits come from the operating system, not from the AI model behaving well. It runs in your terminal, in VS Code and in Zed, and you can plug in Claude, OpenRouter models or a local model.
Coding agents are useful because they read your code, edit files and run commands. That is also what makes them risky. This Garuda coding agent review explains how its sandbox works, what it does and doesn't protect, how to set it up and who should try it. Everything here is based on the developer's own announcement and documentation. We haven't run long-term tests ourselves, so treat this as an informed first look.
QUICK ANSWER
Garuda is a free, open-source AI coding agent, announced on October 8, 2026 and licensed under Apache-2.0. Its safety limits come from the operating system sandbox, not from the AI model behaving well. It runs in your terminal, VS Code and Zed, and works with Claude, OpenRouter models or a local model.
What is the Garuda coding agent?
Garuda was announced on October 8, 2026 by its developer, Madhusudhan Vasanth Kumar. It is licensed under Apache-2.0 and published on GitHub. The author says he started it to learn how coding agents work under the hood, and the design documents are public next to the code.
His main lesson, in his words: "The hard part is not to make the agent act. The hard part is to decide what it may do, and to make that decision hold when the model is wrong or a file tries to trick it."
How the Garuda sandbox works
According to the announcement, these are Garuda's limits:
- Commands run in an OS sandbox. It uses Seatbelt on macOS and bubblewrap on Linux. A command can write only to the project, temp folders and package caches. SSH keys, cloud credentials and other secrets in your home folder stay unreadable.
- Network is closed by default. If you open it, commands can reach only hosts you list, through Garuda's own proxy.
- Edits ask first. Each file edit shows a diff, and you can allow it once, for the session, or not at all. You can even accept single hunks. Plan mode only reads.
- Team policy a repo can't loosen. A managed file can deny commands and paths, require the sandbox and limit models. A cloned repository can't change it.
- Tamper-evident audit log. Every permission decision and tool run is logged outside the project with secrets redacted, in a hash chain that
/audit verifycan check. - Consent for project content. Hooks, MCP servers, skills and settings that come with a repository ask once, and the answer is pinned to a hash; if they change, Garuda asks again.
The honest corrections
One detail we liked: the author published corrections. On October 10 he updated the post to say that commands inside the sandbox run without asking, so they can change project files within the sandbox's limits. Only edits always ask. On October 11 he added three more points: the sandbox can also write to temp folders and package caches; an allow rule can let a command outside the sandbox run without asking; and /undo restores only files in its snapshot, so ignored files such as build output are not covered.
These are exactly the details that matter for safety, and it's a good sign when a developer states them plainly.
Models: bring your own
Garuda doesn't come with its own AI model. It works with Claude, with OpenRouter, and with local models through Ollama, LM Studio, llama.cpp, vLLM or any OpenAI-compatible server. Garuda itself is free; you pay whatever your chosen model costs. A local model costs nothing and keeps code on your machine. Pairing Garuda with a free laptop model like the one in our Recursive Flint review is one zero-cost setup to try.
How to install Garuda
The announcement lists a three-step setup:
npm install -g @garuda-agent/garuda
garuda setup
garudagaruda setup asks you to pick a provider and model, checks your key with one free request, and stores it in a file only you can read. Commands in the sandbox can't read it. Homebrew install is also documented.
In editors, garuda acp speaks the Agent Client Protocol, so it works in Zed and in VS Code with the ACP Client extension, keeping the same sandbox, policy and audit log.
Testing, according to the developer
The author says about 900 tests run with a fake model and no network, and that each security rule has a test that must fail if the rule is removed. Eval suites track pass rate, steps, tokens and cost, and Garuda can build a benchmark from your own repo's history. Features without a measured gain stay off by default.
Limitations
- No native Windows support. Use WSL.
- Stored keys are in a private file, not yet the OS keychain.
- In editors, terminal commands such as
/undoand/diffaren't available yet. - It is a young solo project, so try it on a throwaway repo first.
Garuda: pros and cons
Pros
- Free and open source (Apache-2.0).
- Limits enforced by the OS, not just the model.
- Network off by default; edits shown as diffs.
- Works with cloud or fully local models.
Cons
- No native Windows.
- Commands inside the sandbox run without asking.
- New project with a single maintainer.
Who should try Garuda?
Developers who are nervous about letting an AI agent loose on their laptop, teams that want enforceable policy, and learners curious about how agents work will all find it interesting. This month's Claude Code extension backdoor is a reminder of why limits matter. If you want a polished, fully managed assistant instead, see our GitHub Copilot Fusion review.
Want to put this into practice? Try our free System Prompt Builder and JSON Formatter & Validator right in your browser, then read Recursive Flint Review and Claude Code Extension Backdoor on Botvana.
Related: Not a coder? See our picks for the best AI app builder for non-coders.
Related: See how Garuda stacks up against Copilot, Claude Code and Cursor in Best AI for Coding 2026.
Sources and further reading
- madhu-sv/garuda repository (GitHub)
- Introducing Garuda: an open-source coding agent with an OS sandbox (Garuda project)
FAQ
Is Garuda free?
Yes, it is open source under Apache-2.0. You pay only for the model you connect, or nothing if you use a local model.
Does Garuda work on Windows?
Not natively. The developer recommends WSL.
Can Garuda read my SSH keys?
According to the developer, commands run in a sandbox that keeps home-folder secrets like SSH keys and cloud credentials unreadable.
Does Garuda ask before every command?
No. Commands inside the sandbox run without asking. File edits always show a diff and ask first.
Which editors support Garuda?
The terminal, Zed, and VS Code with the ACP Client extension, plus other editors that support the Agent Client Protocol.
Comments
Post a Comment