kosa8

Customers

Real workflows. No made-up logos.

No customer has gone public yet. Until one does: how a team would use kosa8, with the real commands.

Start freeShare your story

$30 free credit

Card needed; no charge until the $30 is used.

Customer stories

Be our first story

Running agents in kosa8? Tell us what you run and what changed. We publish only what you approve, with your name and logo only if you say so.

Tell us your storyGive $30, get $30

Measured, not claimed

  • 74 msrestore a sandbox, median
  • 2.5 sfork 100 sandboxes
  • 1.9 msCloud create from the warm pool
  • 192/192cross-org attempts refused, 64 clients

kosa8's own benchmark: Linux engine, AMD Ryzen 7 7700, 1 vCPU and 256 MiB sandboxes, 3 Nov 2026. One machine, not a guarantee, and not a customer's figure.

Example workflows

Scenarios, not customers. Every command is real.

Example workflowLocal

Unattended coding agents

The problem
A team wants Claude Code or Codex to work a backlog with permission prompts off, without handing over the laptop.
With kosa8
kosa8 prompt makes a fresh microVM, shares one folder at /work, runs the agent headless and removes the VM when it exits.
kosa8 prompt
Unattended coding agents
kosa8 prompt "add a test for parseConfig and make it pass"
kosa8 prompt -w ~/src/api -a codex "why does TestLogin flake? fix it"
git diff main | kosa8 prompt -
kosa8 prompt --dry-run "upgrade lodash"   # the plan; creates nothing

Example workflowLocalFree tier

Rewind a destructive command

The problem
An agent drops a table or deletes the wrong folder. Git cannot bring back a database or a running dev server.
With kosa8
A checkpoint saves disk, memory and processes. kosa8 rewind goes back to one and resumes the processes. Agents get the same as MCP tools.

74 msmedian restore, Linux engine, 1 vCPU, 3 Nov 2026. kosa8 benchmark, not a customer figure.

Save and undo
Rewind a destructive command
kosa8 checkpoint web --label "before migration"
kosa8 checkpoint ls web
kosa8 rewind web -y --to "before migration"

Example workflowLocalForks: Solo plan up; Explore: Pro

Fork to compare approaches

The problem
There are three plausible fixes. Trying them one after another means undoing each by hand.
With kosa8
kosa8 explore forks a running sandbox once per variant, runs each, keeps the winner and removes the rest. kosa8 fork makes plain copies.

25 msper clone: 100 forks in 2471 ms, Linux engine, 3 Nov 2026. kosa8 benchmark, not a customer figure.

Explore
Fork to compare approaches
kosa8 explore web --image node:22 \
    --variant "npm test" \
    --variant "npm test -- --experimental-vm-modules"
kosa8 fork web -n 3 --prefix trial

Example workflowLocal

Keys never enter the sandbox

The problem
An agent that can read its API key can leak it: into a log, a commit, or a prompt-injected request.
With kosa8
Each kit names the keys it needs. kosa8's broker keeps them on the host and swaps the placeholder only on requests to the allowed host, method and path.
Credentials
Keys never enter the sandbox
kosa8 agent run --dry-run claude
kosa8: brokering ANTHROPIC_API_KEY -> api.anthropic.com
       (the sandbox holds a placeholder, never the key)
# your own API, in a kit file:
credentials:
  - name: weather
    upstream: https://api.example.com
    secret: WEATHER_API_KEY
    methods: [GET]
    paths: [/v1/forecast]

Example workflowLocal

Egress allowlists

The problem
A prompt-injected agent tries to send your code to a server nobody has heard of.
With kosa8
The allowlist is enforced on the host, outside the VM, so nothing inside can turn it off. Every allow and deny is logged, and a pcap records every frame.
Network
Egress allowlists
kosa8 sandbox create dev --egress-allow registry.npmjs.org
kosa8 sandbox egress dev
kosa8 sandbox pcap dev ./dev.pcapng

Example workflowLocal

An audit log you can verify

The problem
After an incident, or for an auditor: what did the agent run, what did it reach, and could anyone have changed the record?
With kosa8
Every state-changing action goes into a hash-chained, signed log with secrets redacted. kosa8 audit verify checks the chain; CEF export feeds a SIEM.
Audit log
An audit log you can verify
kosa8 audit ls
kosa8 audit verify
kosa8 audit export --format cef

Example workflowLocal

MCP servers in a sandbox

The problem
An MCP server is someone else's code holding your tokens, and its tool descriptions can change under you.
With kosa8
kosa8 mcp add runs the server in its own sandbox with its own allowlist and tool list. Tool definitions are pinned; a changed one is held until you approve it.
MCP servers
MCP servers in a sandbox
kosa8 mcp add github --image node:22-alpine \
    --egress-allow api.github.com --egress-allow registry.npmjs.org \
    -e GITHUB_TOKEN=… \
    --allow-tool list_issues --allow-tool create_issue \
    -- npx -y @modelcontextprotocol/server-github
kosa8 mcp serve
kosa8 mcp pins diff github

Example workflowLocal

A person approves the risky step

The problem
Some calls, like a deploy tool or deleting a sandbox, should never run on an agent's say-so.
With kosa8
A tool rule can require a person: the call is held, kosa8 mcp asks lists it, and approving lets exactly that call through. Org policy can require signed approvals.
Tool rules
A person approves the risky step
kosa8 mcp asks
kosa8 mcp approve 3f2a9c0d1e4b5a67
kosa8 approve request sandbox-rm runner --reason "end of sprint"
kosa8 approve status REQUEST

Example workflowLocalTeam plan

One signed policy for the team

The problem
Fifty laptops, fifty agent configs. Security needs one rule set nobody can quietly loosen.
With kosa8
Write the policy once, sign it with the org key and install it everywhere. A tampered file fails verification and every call is denied.
Governance
One signed policy for the team
kosa8 policy keygen
kosa8 mcp-policy sign key.txt policy.json > signed.json
kosa8 policy trust <PUBLIC_KEY>
kosa8 mcp-policy install signed.json
kosa8 mcp-policy check github delete_repo
DENIED: github/delete_repo for scope engineering

Example workflowLocalForks: Solo plan up

Evals and RL rollouts

The problem
Every rollout needs the same starting state, and one episode must never see another's changes.
With kosa8
Prepare a base sandbox once, fork it per episode, let the agent work through sandbox tools, then grade with hidden tests the agent never saw.
RL and evals
Evals and RL rollouts
from kosa8 import Kosa8Client
client = Kosa8Client()
base = client.create_sandbox(name="task-base",
    egress_allow=["pypi.org", "files.pythonhosted.org"])
f = client.fork(base["id"], 8, prefix="ep-")
episodes = [x["id"] for x in f["forks"]]
# run the agent in each, grade, then:
for sid in episodes: client.delete_sandbox(sid)

Example workflowLocal

Analysis on private files

The problem
An analyst wants an agent to clean and chart a spreadsheet export without giving it the home folder or the open internet.
With kosa8
-w shares one folder and nothing else; the network is closed except the agent's own API. Your own script can run with no network at all.
First sandbox
Analysis on private files
kosa8 prompt -w ~/exports "clean sales.csv, chart revenue by month to report.png"
kosa8 sandbox create analysis --egress deny -v ~/exports:/data:ro
kosa8 sandbox run analysis python:3.12 python3 /data/summary.py

Example workflowLocal

Malware and exploit labs

The problem
A security team needs to run a suspicious binary and see what it tries to reach, without it reaching anything.
With kosa8
kosa8 lab detonate runs the sample in a sandbox that can only see a simulated internet, then writes a signed report you can verify and diff.
Security operations
Malware and exploit labs
kosa8 lab detonate sample.bin --image alpine:latest \
    --cmd "sh {sample}" --timeout 2m --out report.tar
kosa8 lab verify report.tar
kosa8 lab diff report-a.tar report-b.tar

Example workflowLocalQuoted

Air-gapped sites

The problem
A classified or regulated network has no way out, so nothing can phone home to activate or update.
With kosa8
Images move in as files. A signed site licence works offline, with no activation and no expiry check against a server.
Air-gapped guide
Air-gapped sites
# on a connected machine
kosa8 save node:22 -o node22.tar
# inside the gap
kosa8 license install site.lic
kosa8 load -i node22.tar
kosa8 sandbox create build --egress deny

Example workflowLocalSolo plan up

Local models

The problem
Code and prompts must not leave the building, but the team's tools speak the OpenAI or Anthropic API.
With kosa8
kosa8 model serve puts a local model behind both APIs on localhost, so existing tools only need a base URL.
Local models
Local models
kosa8 model pull Qwen/Qwen2.5-0.5B-Instruct-GGUF:q4_k_m
kosa8 model serve qwen2.5-0.5b-instruct-q4_k_m
export OPENAI_BASE_URL=http://127.0.0.1:7434/v1
export ANTHROPIC_BASE_URL=http://127.0.0.1:7434

Example workflowLocalFree tier

Desktop app and dashboard

The problem
Not everyone who needs to see what the agents did lives in a terminal.
With kosa8
The Mac app and the Windows and Linux desktop packages wrap the dashboard; kosa8 desk opens it in a browser on localhost.
Dashboard
Desktop app and dashboard
kosa8 desk
kosa8 desk on 127.0.0.1:7444
kosa8 desk --no-open   # print the URL only

Example workflowLocal

Mac, Linux and Windows

The problem
A mixed team: Apple-chip Macs, Linux workstations and Windows PCs.
With kosa8
Macs with Apple chips and x86-64 Linux run sandboxes natively; Windows 11 runs them in WSL2 (preview). Other machines connect to one that can.
Download
Mac, Linux and Windows
curl -fsSL https://kosa8.com/install | sh
irm https://kosa8.com/install.ps1 | iex
kosa8 wsl setup
kosa8 doctor

Example workflowCloud

Cloud sandboxes, per second

The problem
A hosted agent or CI job has no local engine, and an idle sandbox should not cost compute.
With kosa8
Create from the SDK or plain HTTP. Billed per second while running ($0.048 per vCPU-hour, $0.0154 per GB-hour); asleep it costs only snapshot storage.

1.9 mscreate from the warm pool, host API, 3 Nov 2026. kosa8 benchmark, not a customer figure.

kosa8 Cloud
Cloud sandboxes, per second
from kosa8 import Kosa8Cloud
cloud = Kosa8Cloud()  # reads KOSA8_API_KEY
box = cloud.sandboxes.create(template="python", sleep_after_s=600)
print(box.exec(["python3", "-c", "print(6 * 7)"]).stdout)
box.sleep()                 # snapshot storage only
box.exec("ls /workspace")   # wakes it, files and all
box.delete()

Example workflowCloud

Functions

The problem
Run untrusted or per-customer code on demand, with no state carried between calls.
With kosa8
PUT a handler, then invoke it, fan it out over a list, put it on a schedule or behind a web endpoint.

170 msPython function end to end, idle host, 3 Nov 2026. kosa8 benchmark, not a customer figure.

kosa8 Cloud
Functions
curl -s -X PUT https://api.kosa8.com/v1/functions/hello \
    -H "Authorization: Bearer $KOSA8_API_KEY" -H 'Content-Type: application/json' \
    -d '{"runtime":"python3.12","code":"def handler(event):\n    return {\"hi\": 1}\n"}'
curl -s -X POST https://api.kosa8.com/v1/functions/hello/invoke \
    -H "Authorization: Bearer $KOSA8_API_KEY" -d '{"event":{}}'
curl -s -X POST https://api.kosa8.com/v1/functions/hello/map \
    -H "Authorization: Bearer $KOSA8_API_KEY" -d '{"events":[{},{}]}'

Example workflowCloud

Webhooks

The problem
The on-call channel should hear when a sandbox fails or the month's spending cap is hit.
With kosa8
Register a URL and the events you want. Every delivery carries an HMAC signature and timestamp; a test event and recent deliveries are one call away.
Webhooks
Webhooks
curl -s -X POST https://api.kosa8.com/v1/webhooks \
    -H "Authorization: Bearer $KOSA8_API_KEY" -H 'Content-Type: application/json' \
    -d '{"url":"https://hooks.example.com/kosa8",
         "events":["sandbox.error","spending_cap.reached"]}'
curl -s -X POST https://api.kosa8.com/v1/webhooks/wh_…/test \
    -H "Authorization: Bearer $KOSA8_API_KEY"

Example workflowCloud

An MCP server for your agent

The problem
An agent should create and use cloud sandboxes itself, without custom glue code.
With kosa8
kosa8 Cloud is a remote MCP server. Add it to the agent with an API key and it gets sandbox tools.
Cloud MCP
An MCP server for your agent
claude mcp add --transport http --scope user kosa8-cloud \
    https://api.kosa8.com/mcp \
    --header "Authorization: Bearer $KOSA8_API_KEY"

Example workflowCloud

Sandboxes from CI

The problem
A pull request from a stranger should not run its tests on the runner that holds the deploy secrets.
With kosa8
The job creates a sandbox with a time limit, runs the command there and deletes it. Only the API key is a secret.
GitHub Actions
Sandboxes from CI
- env: { KOSA8_API_KEY: "${{ secrets.KOSA8_API_KEY }}" }
  run: |
    H="Authorization: Bearer $KOSA8_API_KEY"
    id=$(curl -s -X POST https://api.kosa8.com/v1/sandboxes -H "$H" \
      -d '{"template":"python","ttl_s":900}' | jq -r .sandbox.id)
    curl -s -X POST https://api.kosa8.com/v1/sandboxes/$id/exec -H "$H" \
      -d '{"cmd":["python3","-c","print(6 * 7)"]}'
    curl -s -X DELETE https://api.kosa8.com/v1/sandboxes/$id -H "$H"

Example workflowCloud

Your own hosts (BYOC)

The problem
Data must stay on the company's own servers, but the team wants the Cloud API and dashboard.
With kosa8
Make a registration token, run the installer on a KVM Linux server, and it joins over an outbound tunnel. Only your org's sandboxes and functions run there.
Where kosa8 runs
Your own hosts (BYOC)
curl -s -X POST https://api.kosa8.com/v1/byoc/tokens \
    -H "Authorization: Bearer $KOSA8_API_KEY" -d '{"name":"rack-1"}'
# on the server, as root:
KOSA8_REG_TOKEN=k8r_… KOSA8_URL=https://h1.example.com \
    KOSA8_REGION=eu-fra1 sh byoc-install.sh

Example workflowCloud

Members and single sign-on

The problem
People join and leave. Access to the org, and every key they made, must follow.
With kosa8
Owner, admin, developer and viewer roles. OpenID Connect SSO on verified domains; removing someone ends their session and revokes their keys.
kosa8 Cloud
Members and single sign-on
curl -s -X POST https://api.kosa8.com/v1/members \
    -H "Authorization: Bearer $KOSA8_API_KEY" \
    -d '{"email":"[email protected]","role":"developer"}'
curl -s -X PUT https://api.kosa8.com/v1/sso -H "Authorization: Bearer $KOSA8_API_KEY" \
    -d '{"issuer":"https://example.okta.com","client_id":"…",
         "client_secret":"…","domains":["example.com"]}'
curl -s https://api.kosa8.com/v1/audit/verify -H "Authorization: Bearer $KOSA8_API_KEY"

Each is an example of how a team would use kosa8, not a customer account. Output is shortened.

Share your story

  1. 1. Write to usWhat you run in kosa8, and a number you measured, if you have one. [email protected]
  2. 2. You approve itEvery word, your name and your logo, in writing, before anything goes up.
  3. 3. It goes liveWith the date and way you agreed recorded beside it. Ask and it comes down.

Give every agent a sealed box.

Start free

$30 free credit

Give $30, get $30Refer →