The dashboard
Everything you are running, in one window.
An AZMX AI project
macOS, Windows and Linux · or pick your platform
The dashboard
# 1 · install it checksum verified · installed kosa8 0.1.7 13 checks · all clear # 2 · find a model on Hugging Face pulling Qwen/Qwen2.5-0.5B-Instruct-GGUF:q4_k_m: 38% (178MiB/468MiB) pulling Qwen/Qwen2.5-0.5B-Instruct-GGUF:q4_k_m: 91% (427MiB/468MiB) pulled qwen2.5-0.5b-instruct-q4_k_m NAME SIZE SOURCE PULLED qwen2.5-0.5b-instruct-q4_k_m 468MiB hf.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF 2026-07-29 # 3 · serve it on your own GPU starting llama-server for qwen2.5-0.5b-instruct-q4_k_m… kosa8 model gateway on http://127.0.0.1:7434 OpenAI: POST /v1/chat/completions Anthropic: POST /v1/messages MTL0: Apple M4 (12124 MiB free) · layers: auto # 4 · talk to it, in the dialect you already use {"role":"assistant","content":"Kosa8 works."} 40 prompt + 6 completion · 175 tok/s · $0.00 # the same server, the same port, speaking Claude {"type":"message","role":"assistant","content":[{"type":"text","text":"Hello!"}], "stop_reason":"end_turn","usage":{"input_tokens":35,"output_tokens":3}} # 5 · ship it to a registry you already run kosa8: published 5000/tcp -> 0.0.0.0:5000 checksum 100% (468MiB/468MiB) · manifest 100% (751B/751B) pushed to 127.0.0.1:5000/models/qwen2.5:0.5b-q4 weights sha256:74a4da8c9fdbcd15bd1f6d01d621410d31c6fc0098… (468MiB) artifactType application/vnd.kosa8.model.v1+json ↑ a stock registry:2 stored it. No plugin, nothing kosa8-specific. # 6 · get it back, byte for byte weights 100% (468MiB/468MiB) serve it with `kosa8 model serve from-registry` 74a4da8c9fdbcd15… qwen2.5-0.5b-instruct-q4_k_m.gguf 74a4da8c9fdbcd15… from-registry.gguf ↑ same bytes · nothing left the machine · $0.00
Everything in the box
Local models are the front door. Behind it is everything you need to let an AI assistant actually work on your machine without you holding your breath.
Pull from Hugging Face, serve locally. OpenAI- and Claude-compatible, no token cost.
Model runner →A sealed machine per assistant. You name the folder and the hosts; the machine enforces it.
Your first sandbox →Checkpoint before the risky step. Rewind in about a second, processes still running.
Checkpoint & rewind →Fork a machine per idea, run them at once, keep the one that worked.
Fork and compare →A Mac app showing every machine and the tree of what was copied from what.
Open the dashboard →Signed policy per team. Edit it on a laptop and that laptop locks itself out.
How policy works →Shows you the exact command first. Destructive actions are always confirmed.
Meet the assistant →What you get
Nothing here is a mockup. Each demo is a command that was run and the output it produced, replayed at roughly the speed the real thing takes.
Its own kernel, its own network. You name the folder it can see and the hosts it may reach; the machine enforces the rest. A tool that tries anywhere else does not get a polite refusal — it gets a dead socket.
sandbox web ready in 960ms HTTP/1.1 404 Not Found ← it got there wget: can't connect to remote host (104.20.23.154): Connection refused
kosa8 saves memory and running processes, not just files. A restored machine is not a fresh one you have to set up again — it is the same machine, mid-task, as it was a moment earlier. A database still holding its connections is still holding them.
checkpoint web-ckpt-1 (before the risky bit) saved in 2281ms rewind with `kosa8 rewind web` Rewind web to web-ckpt-1 — before the risky bit? Everything since 2m ago will be lost. [y/N] y web is back at web-ckpt-1 (1065ms) processes resumed from 2m ago
The slow part of any environment is the setup. Copies resume from the finished state with their programs still running, so four approaches cost about what one costs — and you find out in parallel instead of in sequence.
forked 3 branches in 6379ms BRANCH RESULT TIME VARIANT web-explore-624461 failed 356ms npm test *web-explore-624462 ok 371ms --experimental-vm-modules web-explore-624463 ok 1360ms --babel winner: web-explore-624462 other branches removed; --keep-all keeps them for inspection
Approve MCP servers and individual tools per team. Anything nobody approved is refused — not because a rule forbids it, but because no rule permits it. And the policy is signed: edit it locally and kosa8 refuses everything, including what you were allowed to do a moment before.
Company-wide rules →allowed: allowed by rule allow_tools "list_*" DENIED: denied by rule deny_tools "delete_*" DENIED: the installed MCP policy failed verification: signature does not match (tampered or wrong key)
Every action an assistant proposes is sorted by what it would actually do. Reading a log runs freely. Deleting a machine is always confirmed — and cannot be waved through, whatever you put in the settings. A switch that turns off every safeguard is not a safeguard.
How the gate decides →sandbox-rm web touches the kosa8 daemon on this host touches target web risk destructive why removes state permanently; there is no snapshot to rewind to afterwards "sandbox_rm" is destructive, and destructive actions are always confirmed
One command opens a dashboard on your own computer: sandboxes, containers, images, save points — and the tree of what was forked from what, which is the part no other container UI can draw. Loopback only, with a token that dies when you stop it.
kosa8 desk on 127.0.0.1:7444 http://127.0.0.1:7444/?t=3f9c… the token in that URL is this run only — stop with ctrl-c # the tree it draws, that a container list cannot: sealed ├─ sealed-ckpt-1 before the risky bit ├─ sealed-explore-712651 ok echo one ├─ sealed-explore-712652 error false └─ sealed-explore-712653 ok echo three ← winner
Install
One command, or one icon. No account, no sign-up, nothing to configure. Prefer
a package manager? There are signed builds for macOS, Windows and
Linux — Homebrew, Scoop, .deb and .rpm.
Works out which Mac you have, checks the download against the published fingerprints, and puts it on your PATH.
The background service takes about a second. Your first container takes about two hundred milliseconds after that.
The part no other container tool does: the copies resume with their programs still running, so the slow setup happens once.
Pricing
Someone running one assistant and someone running forty get very different value from the same licence, so the meter is how many copies you run at once.
One person, one assistant at a time.
4 at once · 40 hours · 25 GB
Start free trialOne person running a fleet of assistants.
16 at once · 200 hours · 100 GB
Start free trialA team with someone responsible for security. From 3 people.
48 shared · 600 hours · 250 GB
Start free trialNo card for the trial, and everything already on your own computer keeps working either way. Each plan carries a named set of the seven products — see what is in each, or buy one on its own.
Questions
For most day-to-day work, yes — 42 of the 48 docker commands run unchanged,
and you can point the real docker CLI at kosa8's socket. But Docker runs on
Windows and Linux and has an image marketplace, and kosa8 does neither. If you need those,
keep Docker.
The isolation is built on Apple's Virtualization framework, which is what makes saving a running machine possible at all. On Windows and Linux you get the command-line tool as a remote control for a Mac. A Cloud Hypervisor backend for Linux exists in the source but has not been run against real hardware yet, and this page will not claim otherwise until it has.
No. kosa8 runs entirely on your computer and has no cloud component. If you use a hosted
model your prompts go to that provider, exactly as they would otherwise — or run a model
locally with kosa8 model serve and nothing goes anywhere.
git saves your files. kosa8 saves the whole running machine — the processes that are open and what they were part-way through doing. A rewound machine does not restart anything: a server that was serving is still serving, from the moment you saved it.
Nothing is deleted and nothing stops on your own computer. There is no permanently free tier, and paid plans are not switched on yet, so at the moment the honest answer is that the trial simply expires.
Yes. kosa8 is an MCP server, so an assistant can take its own checkpoints and make its own copies. Anything that changes state runs through an approval gate that shows you the exact command first, and destructive actions can never be auto-approved.
One sealed machine per assistant, saved before anything risky and back in about a second. Fourteen days free, no card.