Skip to content
SCC CLI

SCC vs Running Agents Locally

This guide compares running AI coding agents (Claude Code, Codex) through SCC’s container sandbox versus running them directly on your local machine.

Quick Comparison

Section titled “Quick Comparison”
AspectSCC CLILocal Agent
Execution environmentOCI container (Docker Engine, OrbStack, Colima, etc.)Your host machine
File accessOnly mounted pathsFull filesystem
Git protectionBuilt-in safety engine + optional safety-net pluginRelies on agent’s built-in behavior
Network controlTopology-enforced egress or full lockdownNo restriction
ConfigurationCentralized org/team profilesPer-user local settings
Plugin controlOrg-approved plugins onlyAny plugin
Provider choiceClaude Code or Codex through same pipelineSingle agent
Setupscc setup + scc startAgent CLI directly

What SCC Adds

Section titled “What SCC Adds”

Container Isolation

Section titled “Container Isolation”

With SCC, the agent runs inside an OCI container. The AI can only access files in paths you explicitly mount, typically your project directory.

Terminal window
# SCC mounts only the workspace
scc start ~/my-project
# The agent sees /home/user/my-project inside container
# Cannot access ~/.ssh, ~/.aws, or other host paths

Running an agent locally gives it access to your full filesystem within the permissions of your user account.

Git Safety Rails

Section titled “Git Safety Rails”

SCC’s Safety Net plugin blocks commands that can cause data loss:

Blocked CommandRisk
git push --forceOverwrites remote history
git reset --hardDiscards uncommitted changes
git branch -DForce-deletes branches
git clean -fdDeletes untracked files

Local agents rely on their own judgment and your confirmation prompts.

Team-Managed Configuration

Section titled “Team-Managed Configuration”

SCC lets organizations define:

  • Approved plugins: Only whitelisted plugins can run
  • MCP servers: Control which external services the agent can access
  • Security policies: Network posture, blocked patterns
  • Team profiles: Consistent defaults across developers

Developers run scc setup once to inherit all team settings.

With local agent setups, each developer manages their own provider configuration independently.

Git Worktree Integration

Section titled “Git Worktree Integration”

SCC provides built-in worktree management for parallel AI tasks:

Terminal window
scc worktree create ~/project feature-auth
# Creates isolated branch scc/feature-auth
# Claude experiments don't touch main branch

This keeps AI work isolated from your main development branch.

When to Use Each

Section titled “When to Use Each”

Choose SCC When

Section titled “Choose SCC When”
  • Your team needs consistent agent configurations
  • You want container isolation between AI and host system
  • You need to prevent destructive git operations
  • Org admins must control which plugins are allowed
  • Multiple developers need standardized setups

Choose Local Agent When

Section titled “Choose Local Agent When”
  • You’re a solo developer with simple needs
  • You need maximum speed (no container startup)
  • You trust your agent’s built-in safety measures
  • You don’t need team-wide governance

Hybrid Approach

Section titled “Hybrid Approach”

Some teams use both:

  • Local agent execution for quick, trusted tasks
  • SCC for experimental work or when working with sensitive code

Next Steps

Section titled “Next Steps”
Quick Start Try SCC in minutes
Security Model Understand SCC's isolation layers
Why Sandbox AI Coding Agents Detailed reasons for sandboxing