Skip to main content

​
What is FTL?

FTL is a zero-trust control plane for AI coding agents. Run Claude Code, Codex, Aider, or Kiro inside an isolated Docker sandbox with shadow credentials, parallel adversarial testing, and human-in-the-loop approval — without ever giving the agent access to your real secrets or filesystem.

Quickstart

Get up and running with FTL in under 5 minutes

Installation

Detailed installation and setup instructions

How it works

Learn about FTL’s architecture and security model

CLI reference

Complete command-line interface documentation

​
Why FTL?

AI coding agents are powerful but untrustworthy by construction. FTL provides the safety layer that makes them practical:

Isolated execution

Agents run in Docker containers with no access to your host filesystem or real credentials

Shadow credentials

Your real API keys never enter the sandbox — agents work with safe placeholder values

Human approval

Every change requires explicit review before touching your project

Adversarial testing

Tests generate in parallel while the agent codes, catching issues immediately

Credential linting

Automatic scanning for leaked secrets and dangerous operations

Multi-agent support

Works with Claude Code, Codex, Aider, and Kiro

​
How it works

When you run a task, FTL executes an 8-stage pipeline:
1

Snapshot

Rsync your project state to ~/.ftl/snapshots/<id>
2

Boot

Reuse a persistent container or start fresh (per project)
3

Inject

Shadow credentials replace real keys inside the sandbox
4

Agent ∥ Tests

The coding agent runs while adversarial tests generate in parallel
5

Run tests

Pre-generated tests execute the moment the agent finishes
6

Lint

Diff scanned for credentials and dangerous operations
7

Diff

Computed on demand; file-level review of all changes
8

Approve

You review, ask questions, and merge or reject
The agent runs entirely inside Docker. It never sees your real API keys or your host filesystem. Nothing touches your project without explicit approval.

​
Key features

FTL operates on the principle that agents are untrustworthy by construction. Every layer is designed to prevent credential leaks and unauthorized filesystem access:
  • Shadow credentials generated for each session
  • Optional network proxy that swaps shadow values for real ones at the HTTP layer
  • Bedrock Guardrails integration for hard-blocking merges with detected secrets
While your agent writes code, FTL simultaneously generates adversarial tests using your chosen LLM model:
  • No wall-clock time added — tests run immediately when the agent finishes
  • Supports Anthropic, AWS Bedrock, and OpenAI via LiteLLM
  • Manual test re-runs available in interactive mode
FTL maintains one container per project path to eliminate cold-start overhead:
  • Workspace wiped and restored from snapshot on each task
  • Installed packages persist in /home/ftl/.local/
  • Agent conversation history preserved across tasks
  • Node.js pre-warmed in background during boot
Optional AWS-backed capabilities for production use:
  • S3 snapshot storage
  • CloudWatch session tracing
  • Secrets Manager for credential management
  • Bedrock Guardrails for diff safety

​
Supported agents

FTL works with four popular AI coding agents:

Learn more about agents

See detailed configuration and authentication for each agent

​
Philosophy

Agents are untrustworthy by construction. FTL is the layer that makes them safe to use anyway.
The agent cannot have skin in the game. The human must. Every change requires explicit approval before it touches the real filesystem.

​
Next steps

Run your first task

Complete the 5-minute quickstart guide

Configure for production

Set up AWS integration for S3, CloudWatch, and Guardrails

Interactive shell

Learn about follow-up instructions and session management

Shadow credentials

Deep dive into credential security