Grok Build

Why it's ranked here

The engineering is more serious than a typical agent CLI: kernel-level sandboxing applied at startup, a six-layer configuration system that supports centrally managed enterprise policy down to macOS MDM, and a shared circuit-breaker library reused across server and client retry paths. That depth cuts against openness, though. The repository takes no external pull requests, the root manifest is machine-generated from a private monorepo, and Windows builds are explicitly untested from this tree. Read it to see production-grade agent infrastructure, not to contribute to it.

What's good

The sandbox is genuinely restrictive by default: it blocks subprocess network access via seccomp even though the agent process itself needs the network to reach the model, and the code deliberately fails closed rather than trusting an unconfirmed sandbox as active. Tool output sent back to the model is hard-capped, so a runaway command output cannot blow up context. Configuration merges six layers, letting an IT department push signed, tamper-resistant policy on top of a user's own settings. Retry and circuit-breaking logic is shared, not duplicated, between the client and any server components.

Tradeoffs

Development happens entirely inside a private monorepo and gets synced out; this repository states plainly that it takes no outside patches, so treat it as read-only unless you're willing to fork and diverge. Building from source needs an extra tool-fetching utility on top of the Rust toolchain, and Windows builds are called best-effort and untested here, so Linux or macOS is the safer bet. One internal crate exists purely to keep two incompatible versions of an HTTP client library from colliding, a sign of real dependency-management overhead as the project has grown.

How to use it well

Reach for this if you want an agent CLI with strong isolation defaults for running shell commands and edits against real codebases, and if you already work inside an organization that wants central policy control, including on managed Mac fleets. Install the prebuilt binary rather than building from source unless you specifically need to inspect or patch the code, since patches cannot go upstream anyway. Use the headless mode for CI and scripted pipelines, and remember the sandbox restricts what child processes can reach on the network, not the agent's own model calls.

Observed

License

Apache License 2.0 for first-party code; vendored third-party components (a Mermaid diagram stack) keep their original licenses

Language

Rust, organized as a multi-crate workspace

Distribution

Prebuilt binaries for macOS, Linux, and Windows via a shell or PowerShell installer, plus build-from-source with Cargo

Interfaces

Interactive terminal UI, a headless mode for CI and scripting, and editor integration via the Agent Client Protocol

Protocol support

Model Context Protocol (MCP) client, plus support for skills, plugins, and hooks

Contribution model

Repository does not accept external pull requests or patches; published for source transparency and local builds only

Security reporting

Vulnerabilities are reported through a HackerOne program, not public GitHub issues

Sandboxing

OS-level sandbox (Landlock on Linux, Seatbelt on macOS) applied once at process startup

Build requirement

Building from source requires a separate hermetic tool-fetching utility in addition to the Rust toolchain and protoc