For everyone building with AI

Your AI can build anything. It shouldn’t see everything.

Your AI agent gets the keys to the room, not the house.

Watch the demo View on GitHub
Tini is planning the fence

Tini builds the fence The Agent builds the house Tina checks it all

The problem

AI doesn’t just answer anymore. It acts.

84%

of developers use or plan to use AI tools

33%

trust the accuracy of what AI produces

Usage is up. Trust is down.

Stack Overflow Developer Survey 2025, 49,009 respondents

What an agent can reach

Illustration
  • StudentClass project next to an ID scan.
  • InternCompany code beside a passwords file.
  • FreelancerClient photos that reveal locations.
  • First-time vibe coderApproves everything, can’t read the prompts.

One small website: 19 to 23 actions on your computer. in our four latest recorded builds

Meet the family

Three characters, one job each.

The app is drawn as a yard, so you can see what your agent is doing at a glance.

Tini the builder

Reads your prompt and builds a fence around only what the job needs.

Tina the inspector

Checks folders before they come in and the work after every turn. She is allergic to red.

The Agent Claude Code

Your AI coding agent. It builds the house inside the yard, one brick at a time.

How it works

One prompt, one fence, one green light.

  1. Step 1

    You ask.

    Type what you want, like a work order.

    Build a website for Rivera Construction with a gallery of this year’s projects. Use the photos in ~/Clients/Rivera/Photos.

  2. Step 2

    Tini fences only what’s needed.

    Only the folders and sites the job needs. One Approve replaces dozens of “Yes” clicks.

    Tini’s plan

    Allowed

    • ~/Clients/Rivera/Photos
    • ~/Clients/Rivera/About
    • ~/Clients/Rivera/Services
    • registry.npmjs.org

    Removed first

    31 photos contain GPS locations, removed before Claude sees them.

    Everything else on your Mac stays outside the fence.

  3. Step 3

    The Agent builds inside the fence.

    It works on copies. Every step is checked; anything outside the fence is blocked.

    Blocked simulated attack

    ~/.ssh/id_rsa

    Outside the fence. Nothing was read.

    Next request? You only hear from Tini when access changes.

  4. Step 4

    Tina inspects. Red, fixed, green, launch.

    Tina scans every turn. A problem turns its segment red, with a one-click fix. Launch waits for all green.

    Needs a fix Fixed

    Google Maps key is visible in your website’s code

    Fix: swap in a map that needs no key, then Tina scans again.

Safety

Three layers between the agent and your files

  1. 1

    Copies, not originals

    The agent works on copies. Your files stay untouched.

  2. 2

    Every step checked

    Each open, save or command is checked before it runs.

  3. 3

    The Mac’s own lock

    Commands run inside macOS’s sandbox, even disguised ones.

    Tested Stopped a disguised read in our tests.

Privacy

Private by design

Who sees what
The agent (Claude)The helper AI (Gemini)
Files you approvedSees themNames and counts only
Everything else on your MacBlockedNever
Hidden photo locationsRemoved firstNever
  • Rules decide, not AI: code alone grants access
  • Tina’s checks run on your Mac: nothing uploaded
  • Tested: a tricked AI couldn’t add a single folder

Demo

See it build a real website.

Tina checks a folder of 1,212 files and narrows it to the 12 job-site photos the site needs.
A leaked key and hidden photo details get fixed before launch.

Questions

Fair questions.

Doesn’t Claude Code already do this?

It has the parts: rules, hooks and a sandbox. They’re optional and technical, and by default programs can still read your whole home folder. Tini sets all three up from one request, and Tina checks the work.

What if the AI is wrong?

Rules decide, not AI. The AI only suggests labels and matching files; code checks every suggestion. If both AI providers are down, the fence, inspection and fixes still work.

Is this a chatbot?

No. It’s a workspace with a fence: a prompt bar, a yard that shows what the agent does, and a timeline of turns. No coding needed; every card is in plain words.

Does it only build websites?

Websites are tested end to end, prompt to launch. Fence planning is also tested on charting a spreadsheet, renaming photos and a follow-up that needs nothing new.

What’s simulated in the demo?

The ~/.ssh attack: a harness sends that read through the real fence check, labeled “simulated”. The file is never opened. The client, photos and key are fake data.

What’s next

  • Working inside folders you already have
  • Several projects at once
  • Approving new websites the agent wants to reach
  • Gemini photo checks, with your consent
  • Windows and Linux

Built with

AI and agents

  • Claude Code
  • Claude Agent SDK
  • Claude API
  • Google Gemini 3.8 Flash
  • Google Gen AI SDK
  • Google AI Studio

Security

  • macOS kernel sandbox (Seatbelt) via Claude Code sandboxing
  • Action check: blocks ../ and symlink escapes
  • Website allowlist for commands
  • API keys hidden from commands
  • Hard-block list: ~/.ssh, ~/.aws, keychains, .env
  • gitleaks plus our own key patterns
  • ExifTool: reads and strips photo data
  • PDF.js: finds ID documents in PDFs
  • Luhn check: real card numbers only
  • zod: strict checks on AI answers
  • 100/100 fault-injection test of the AI fallback

Engine

  • Node.js
  • TypeScript (by Microsoft)
  • Express + Socket.IO real-time event stream
  • tsx
  • sharp, pdf-lib and piexifjs for the fake demo world

App

  • React, Vite
  • Three.js with React Three Fiber, drei, postprocessing
  • Framer Motion
  • Phaser (2D fallback)
  • Google Chrome app mode (runs as a desktop window)

Web and infra

  • Vercel
  • GoDaddy domain
  • GitHub (by Microsoft)

Team

Built in a weekend at ShellHacks 2026.

Adilet Sultanbek

FIU student | CSBA

Altair Ibysh

FIU student | BBA