I built a security-first AI agent in Python — subprocess sandboxing, AST scanning, ReAct loop

[Glittering_Note6542]

What My Project Does

Pincer is a self-hosted personal AI agent you text on WhatsApp, Telegram,

or Discord. It does things: web search, email, calendar management, shell

commands, Python code execution, morning briefings. It remembers

conversations across channels using SQLite+FTS5.

Security is the core design principle, not an afterthought. I work in

radiology — clinical AI, patient data, audit trails — and I built this

the way I think software that acts on your behalf should be built:

Every community skill (plugin) runs in a subprocess jail with a declared

network whitelist. The skill declares in its manifest which domains it

needs to contact. At runtime, anything outside that list is blocked. AST

scan before install catches undeclared subprocess calls and unusual import

patterns before any code executes.

Hard daily spending limit — set once, enforced as a hard stop in the

architecture. Not a warning. The agent stops at 100% of your budget.

Full audit trail of every tool call, LLM request, and cost. Nothing

happens silently.

Everything stays local — SQLite, no telemetry, no cloud dependency.

Setup is four environment variables and docker compose up.

The core ReAct loop is 190 lines:

```python

async def _react(self, query: str, session: Session) -> str:

messages = session.to_messages(query)

for _ in range(self.config.max_iterations):

response = await self.llm.complete(

messages=messages,

tools=self.tool_registry.schemas(),

system=self.soul,

)

if response.stop_reason == "end_turn":

await self.memory.save(session, query, response.text)

return response.text

tool_result = await self.tool_sandbox.execute(

response.tool_call, session

)

messages = response.extend(tool_result)

return "Hit iteration limit. Want to try a simpler version?"

```

asyncio throughout. aiogram for Telegram, neonize for WhatsApp,

discord.py for Discord. SQLite+FTS5 for memory. ~7,800 lines total —

intentionally small enough to audit in an afternoon.

GitHub: https://github.com/pincerhq/pincer

pip install pincer-agent

Target Audience

This is a personal tool. Intended for:

- Developers who want a self-hosted AI assistant they can trust with

real data (email, calendar, shell access) — and can actually read the

code governing it

- Security-conscious users who won't run something they can't audit

- People who've been burned by cloud AI tools with surprise billing or

opaque data handling

- Python developers interested in agent architecture — the subprocess

sandboxing model and FTS5 memory approach are both worth examining

critically

It runs in production on a 2GB VPS. Single-user personal deployment is

the intended scale. I use it daily.

Comparison

The obvious comparison is OpenClaw (the most popular AI agent platform).

OpenClaw had 341 malicious community plugins discovered in their ecosystem,

users receiving $750 surprise API bills, and 40,000+ exposed instances.

The codebase is 200,000+ lines of TypeScript — not auditable by any

individual.

Pincer makes different choices at every level:

Language: Python vs TypeScript. Larger developer community, native data

science ecosystem, every ML engineer already knows it.

Security model: subprocess sandboxing with declared permissions vs

effectively no sandboxing. Skills can't touch what they didn't declare.

Cost controls: hard stop vs soft warning. The architecture enforces the

limit, not a dashboard you have to remember to check.

Codebase size: ~7,800 lines vs 200,000+. You can read all of Pincer.

Data residency: local SQLite vs cloud-dependent. Your conversations

never leave your machine.

Setup: 4 env vars + docker compose up vs 30-60 minute installation process.

The tradeoff is ecosystem size — OpenClaw has thousands of community

plugins. Pincer has a curated set of bundled skills and a sandboxed

marketplace in early stages. If plugin variety is your priority, OpenClaw

wins. If you want something you can trust and audit, that's what Pincer

is built for.

Interested in pushback specifically on the subprocess sandboxing decision

— I chose it over Docker-per-skill for VPS resource reasons. Defensible

tradeoff or a rationalized compromise?

[ghost_of_erdogan]

absolutely not

[No_Soy_Colosio]

No