Shepherd is a Python framework where a task is a bodiless function whose signature and docstring define what a sandboxed agent (e.g. Claude via the claude CLI) must do. Agent output is held as a retained changeset that you inspect, then select, apply, release or discard. Write permissions come from type annotations such as May[GitRepo, ReadOnly], enforced by macOS Seatbelt or Linux Landlock. The project is in early alpha.
Who it is for: Engineers building supervised, sandboxed agent workflows in Python
Strengths
Agent writes land as retained outputs; nothing touches your files until you accept
Per-repository ReadOnly/ReadWrite grants declared in the signature, enforced at the syscall
Offline quickstart with a deterministic provider needs no API key
Three-way merge of a candidate onto a workspace that has moved on
Weaknesses
Early alpha; README warns APIs may change between releases
Windows unsupported; WSL required
Linux Landlock enforcement runs only in a privileged container
Grants are whole-profile per binding; sub-path grants not supported yet
What it needs
Python, Claude (via claude CLI, subscription or ANTHROPIC_API_KEY), deterministic offline provider
Needs Python 3.11+, claude CLI (for the agent quickstart)
Docker
env example file
Quick answers
Is shepherd open source?
Yes. Its code is on GitHub under the MIT license.
Can you run shepherd with Docker?
Yes. Its repository has a Docker setup: a Dockerfile, a Compose file or a published image.