Skip to main content
meow models the host as a set of capabilities. Two layers govern them:
  1. Ambient determinism — the system clock, randomness, and environment variables. In strict-web mode these start as deterministic stand-ins and you grant the real source explicitly. This is source selection (deterministic ↔ real), not allow/deny: denying a program a clock outright would break ordinary code, so the safe default is a reproducible substitute.
  2. The filesystem & network sandbox — real allow/deny enforcement for untrusted code. meow x runs freshly downloaded packages sandboxed by default; your own project (meow run) is trusted by default.

​
The grants

All run-style commands (run, dev, task, x) accept the same flags:
Environment grants are scoped allowlists, not all-or-nothing. --allow-env=A,B exposes exactly A and B; every other lookup returns undefined. Bare --allow-env is the widest grant and exposes everything.

​
Filesystem & network sandbox

Ephemeral packages — the ones meow x downloads and runs — are the npm supply chain’s sharpest edge, so meow runs them in a real sandbox by default. Your own installed project is your code, so meow run is trusted by default. The write confinement, network denial, and subprocess/native-code blocks are the three ways untrusted code would otherwise persist, phone home, or escape the sandbox. Reads stay open because exfiltration needs the (denied) network, and denying reads breaks almost everything.
The sandbox is orthogonal to mode. meow x still runs in node-compat (the full Node API surface is present) — the sandbox governs what those APIs may touch, not which APIs exist.
Every denial names the exact bypass, so you’re never stuck. To give one run full access, add --trust:
Because the network is denied by default, scaffolders that fetch templates or registries (create-next-app, create-vite, etc.) need --trust. This is the intended trade-off — you approve network access for the tool, once.

​
Persistent opt-out (and opt-in)

For machines where you always want full host access, set an environment variable instead of typing flags:
This is equivalent to passing --trust on every run — the training wheels off, one line, as easy as installing meow. Power users work nag-free; security-conscious CI stays locked down by simply not setting it. (The older MEOW_DANGEROUSLY_DISABLE_SECURITY=1 still works as an alias.) To go the other way and sandbox every meow run on a machine:
An explicit --trust (or MEOW_TRUST_ALL) always wins over --sandbox / MEOW_SANDBOX; on meow x, --sandbox re-asserts the sandbox even when MEOW_TRUST_ALL is set.

​
Mode interacts with grants

The determinism starting point depends on your mode:
Clock, randomness, and environment all start as deterministic stand-ins. You grant real sources with the flags above. Environment is fully invisible until granted (and there is no process global at all).

​
The ephemeral-execution envelope

meow x (and the npx/bunx shims) print a one-line security envelope before running a freshly downloaded package, so you always know what access it has:
Under --trust (or MEOW_TRUST_ALL) it instead reads:
You can pass grants after the package name — they’re parsed out of the trailing arguments, so this works as you’d expect:

​
Scope

What the sandbox does and doesn’t guarantee.meow x enforces a real filesystem + network sandbox by default (deny network, confine writes, block subprocesses and native addons), on top of the determinism seam (clock/randomness/environment). meow run is trusted by default and opts into the same sandbox with --sandbox.Enforcement is process-level, layered over the Node stack’s permission model and meow’s own network gate — not an OS/VM boundary like a hardened container. Anything you run under --trust (or MEOW_TRUST_ALL) has full host access by design, and the per-package permissions block in meow.config.json remains a forward-looking schema placeholder (parsed, not yet enforced).Bottom line: meow x is safe-by-default for casual use of untrusted tools, and every denial teaches the bypass. For running genuinely adversarial code, still prefer an OS-level sandbox — and remember --trust turns all of this off.

See determinism for the mechanics

Exactly what the clock, RNG, and env stand-ins do.