What people ask before they trust it.

A container shares your computer's kernel, so one kernel bug or one careless mount and the agent is on your host. kosa8 gives each agent a microVM with its own kernel, its own disk and its own network, and you keep your Docker habits: the Docker CLI and Compose keep working. Docker vs a microVM for AI agents.

The whole agent. kosa8 agent run claude starts the agent's own CLI inside the VM, so its file tools, MCP servers and hooks are inside the boundary too, not only its shell commands. That is the difference from an agent's built-in command sandbox. What Claude Code's built-in sandbox covers.

That is the situation kosa8 is built for. With the prompts off, the agent can do anything inside its VM and nothing outside it: no access to your files beyond the folder you share, and only the network you allow. Run Claude Code with prompts off, sealed.

Inside the sandbox, nothing you cannot get back: save the running machine with a snapshot and restore it in under a second. The one exception is a folder you share from your computer, which is writable unless you add :ro, so share read-only or let the agent work on a copy inside. Stop an AI agent deleting files.

No. One line installs it and every feature works for 14 days with nothing to sign up for. You need an account only for kosa8 Cloud, or when you buy a plan.

Sandboxes run ordinary Linux images (Debian, Ubuntu, Alpine, the official Node and Python images), so Go, Rust, Python, Node and their package managers work as on any Linux machine, and a sandbox can pull and run container images itself. Tools that only run on macOS, such as Xcode builds, do not run in a Linux sandbox.

Those are hosted services first. kosa8 runs the same sandbox on your laptop, on kosa8 Cloud, on your own servers or with no network at all, and adds the parts an agent needs around it: undo, an egress broker that keeps API keys out, MCP policies and a signed audit log. How kosa8 compares.

It is a smaller attack surface: each sandbox is hardware-virtualised with its own Linux kernel, on Apple's Virtualization framework on a Mac or Cloud Hypervisor on KVM on Linux. Smaller is not zero, and kosa8 says so: a hypervisor escape would break the boundary. Firecracker vs gVisor vs Kata.

Not brokered ones. The key stays with the egress broker on the host; the sandbox gets a placeholder that is worthless anywhere else, and the real key is added only after a request has left, for the one service it belongs to. The placeholder can still be spent along that route while the sandbox runs, so scope the key at the provider too. Give an agent API keys safely.

Yes, and that is the honest limit of any allow-list: a site that accepts uploads is a way out. kosa8 keeps the list short and enforced on the host, answers DNS only for listed names, writes every refused connection to the audit log, and can record the sandbox's traffic to a file.

Sandboxes an agent creates, and brokered ones, start closed. A sandbox you create by hand with no network flag is open, unless your organisation's policy sets a default; add --egress deny to close it. Network allow-lists.

No. kosa8 installs no certificate in the sandbox and decrypts nothing: brokered calls go to the broker, which makes its own verified TLS connection upstream, and other allowed sites pass through as ordinary encrypted tunnels.

The agent can read anything in a folder you share, so keep secrets out of it and give them to the broker instead. Stop an agent reading your .env.

No product can stop a model from reading hostile text. kosa8 bounds what a hijacked agent can then do: its files, its network, its keys and its risky actions. The threat model lists what it does not protect against.

Yes. Every state change, network decision, MCP tool call and approval goes into a signed audit log; kosa8 sandbox egress shows what was passed and refused; and the Dashboard shows every sandbox live.

Yes. A signed organisation policy can make sandboxing mandatory, set a default network rule, and require named people to sign off escalating actions. Destructive actions ask every time. Human approval for agent commands.

No, it is commercial software. The isolation itself rests on Apple's Virtualization framework and Cloud Hypervisor, whose code is public, and every release is signed, checksummed and, on a Mac, notarised by Apple. How releases are built and checked.

Not with kosa8 on your own computer or servers: code, files, prompts and audit logs stay there, and the software has no telemetry. A paid licence reports aggregate counts once a day for billing, never what ran; an offline licence sends nothing. On kosa8 Cloud your sandboxes run on kosa8's hosts, by design.

No. kosa8 does not use your data to train models, and on your own machines it never sees your code at all.

Not yet: kosa8 has no SOC 2 report and has not had an external penetration test, and we would rather you read that here. What exists today is a published threat model and research paper, signed releases, and FIPS 140-3 builds with a bill of materials for government. For a security questionnaire or a DPA, write to [email protected].

kosa8 Cloud runs today in the EU, in Helsinki. To keep sandboxes on machines you control, join your own servers as hosts, or run kosa8 entirely on your own infrastructure.

Yes: kosa8 audit export --format cef feeds a SIEM, and kosa8 evidence export writes a signed package an assessor can check offline. kosa8 audit verify proves the log was not edited.

A snapshot can be encrypted with a key kept on that machine, and an organisation policy can require it for every snapshot. Disk encryption of the host itself is the host's job, as with any software.

kosa8 Cloud does: Okta, Microsoft Entra ID or Google Workspace, at no extra charge. The software on your own machines has no central console; its organisation policy is a signed file you deliver to each machine.

Your organisation. Tool calls through the kosa8 MCP gateway are allowed, denied or held for a person by your signed rules, and each decision is logged. Sandbox and govern MCP servers.

Yes, two ways: join your Linux servers to kosa8 Cloud as hosts, at $0.20 per host per hour with no compute charge, or run the kosa8 software on them yourself. Local, cloud, your own hosts or air-gapped.

Yes. Enterprise uses a signed site licence with no activation and no check-ins, from a private signed release channel. An air-gapped coding agent.

Apple-silicon Macs and x86-64 Linux run sandboxes themselves, and Windows 11 on x86-64 does through WSL2 (preview). An Intel Mac, Windows 10, Windows on ARM or JioOS drives one of those. Pick your platform.

Run them on kosa8 Cloud or on a Linux server you own; the SDKs and the API are the same. Run coding agents unattended.

Sandboxes run ordinary container images, and snapshots are files you can push to your own storage. The SDKs talk to your own machine and to kosa8 Cloud the same way, so moving between them is a change of address.

A container starts in 178 ms and a running sandbox restores in 897 ms, measured on real hardware with the method published. The exception: a folder shared from your computer reads at about a third of native speed, so keep heavy builds inside the sandbox.

Not today. kosa8's local models run on the host, outside the sandbox, and use its GPU when llamay is installed. Local models.

On your own machine, until you stop it; sandboxes an agent creates stop themselves after 30 idle minutes. On kosa8 Cloud an idle sandbox goes to sleep on your timer, and the next command wakes it.

On a plan, how many copies run together (4 on Solo up to 160 on Scale), with overage or a Burst Pass if you need more. On kosa8 Cloud you can set a spending cap. Plans and limits.

No permanent one. Every feature is free for 14 days with no card; plans start at $29 a month. On kosa8 Cloud a new organization gets $50 of credit once it adds a payment method.

Yes. Each plan comes with kosa8 Cloud credit every month: $10 on Solo, $25 on Pro, and $40 or $50 a person on Team and Scale. Usage past it is billed per second on the same subscription, so there is one invoice. kosa8 Cloud prices.

Not for compute. A sleeping sandbox pays only for its snapshot, $0.08 per GB-month. Running time is billed per second.

Yes, set a spending cap in the dashboard's settings. On a plan, nothing above your limits is billed unless you turn overage on.

Ready-made kits run Claude Code, Codex and Gemini CLI with one command, and any agent that speaks MCP can create and use sandboxes itself. By agent and team.

Python (pip install kosa8), JavaScript and TypeScript (npm install @kosa8/sdk, with an adapter for the Vercel AI SDK), Go and Java, plus a REST API for kosa8 Cloud. Developer docs.

Yes, as their code-execution sandbox: LangChain and LangGraph, CrewAI, OpenAI Agents SDK, and more integrations.

Yes. Write to [email protected] and a person answers, or book 30 minutes.