# kosa8

> kosa8 makes sealed sandboxes for AI coding agents: agents run code unattended, each in a sealed machine of its own, and on your own computer any mistake can be rewound. kosa8 Cloud runs sandboxes on kosa8's hosts, billed per second. Every sandbox is a real microVM with its own kernel, not a container sharing the host's. On your own hardware, save the whole running machine in about 0.7 seconds, rewind it in about a second, or fork it into live copies. Local sandboxes run on Apple-silicon Macs, x86-64 Linux and Windows through WSL2. kosa8 is Docker-compatible and MCP-native, and ships a Claude Code plugin.

Key facts:

- Isolation: one microVM per sandbox, behind a closed network where only allow-listed hosts answer. API keys are injected by an egress broker on the host, so the sandbox never holds them.
- Control: risky actions can wait for one or two named human approvers, and every action lands in a tamper-evident, hash-chained audit log.
- Compatibility: the Docker CLI, Docker Compose, Testcontainers, dockerode, smolagents and the OpenAI Agents SDK Docker sandbox run against kosa8's Docker-compatible API.
- MCP: `kosa8 mcp serve` runs a local stdio MCP server (registry name `io.github.kosa8ai/kosa8`).
- Pricing: commercial software with a free tier after email sign-up (sandboxes, save and undo, dashboard). Forks, local models, Explore, the assistant and governance need a plan: from $29/month, priced by concurrent copies rather than seats, $30 off the first payment (card required at checkout). kosa8 Cloud gives $30 of credit once a card is on file. There is no time-limited trial.
- Privacy: no telemetry in the software; sandboxes, prompts and audit logs stay on the user's machine.

## For AI agents

- [AGENTS.md](https://kosa8.com/AGENTS.md): how an AI agent installs kosa8, signs the person up (they give the email and the code) and runs tasks in sandboxes
- When kosa8 says it needs a plan: with `--json`, every refusal at a plan limit carries `upgrade: {plan, price_usd, url, command}`; relay it to the person, never buy for them (see AGENTS.md)
- `kosa8 prompt "TASK"`: one task, one coding agent (Claude Code by default; codex, gemini, opencode, copilot), one sandbox that is removed afterwards
- [Docs as markdown](https://docs.kosa8.com/llms.txt): every guide and command; add .md to any docs page address
- [The whole manual in one file](https://docs.kosa8.com/llms-full.txt)

## Product

- [Home](https://kosa8.com/): what kosa8 is, in one page
- [Products](https://kosa8.com/products/): sandboxes, save and undo, explore, local models, dashboard, approval gate and signed org policy
- [Features](https://kosa8.com/features/): checkpoint, rewind, fork, sealed sandboxes and local models
- [Every command](https://kosa8.com/commands/): Docker's commands plus checkpoint, rewind, fork, explore, model, policy, approve and audit
- [Trust Center](https://kosa8.com/trust/): security controls in place, SOC 2 and pen-test status, subprocessors, security documents, disclosure
- [FAQ](https://kosa8.com/faq/): 42 answers on isolation vs Docker, API keys, data, SOC 2 status, deploy options, speed, GPUs and pricing
- [Pricing](https://kosa8.com/pricing/): Solo, Pro, Team, Scale and Enterprise plans
- [Download](https://kosa8.com/download/): one-line install for macOS, Windows and Linux
- [Where kosa8 runs](https://kosa8.com/deploy/): local, kosa8 Cloud, your own hosts (BYOC) or air-gapped; who runs what, what leaves the machine, and what each costs
- [kosa8 Cloud](https://app.kosa8.com/): hosted kosa8 sandboxes and functions; sign up, make an API key, call https://api.kosa8.com or the SDKs (`Kosa8Cloud`, `KOSA8_API_KEY`)

## Use cases
- [Give the code your agent framework runs a microVM of its own.](https://kosa8.com/use-cases/agent-frameworks/): Run the code your LangGraph, CrewAI, OpenAI Agents SDK, smolagents or Vercel AI SDK agent writes in a local microVM, with what kosa8 has tested for each.
- [Run Claude Code with the brakes off, inside a sealed machine.](https://kosa8.com/use-cases/claude-code/): A Claude Code sandbox on your Mac, Linux or Windows PC: Claude Code runs in its own microVM, sees one folder, reaches only listed hosts and never holds your API key.
- [Give Cline, Aider and OpenHands a sealed machine to work in.](https://kosa8.com/use-cases/cline-aider-openhands/): How to give Cline, Aider or OpenHands a sealed microVM with kosa8: your own kit, sandboxes as MCP tools, and what is not separately documented yet.
- [Give Codex full access, but only inside one machine.](https://kosa8.com/use-cases/codex-cli/): Run OpenAI's Codex CLI in its own microVM: one project folder, a closed network, and an OpenAI API key that stays on your computer behind an egress broker.
- [Run Cursor's CLI agent inside a microVM, not on your laptop.](https://kosa8.com/use-cases/cursor/): Run Cursor's CLI agent in a kosa8 microVM from a kit you control: one project folder, only Cursor's hosts, and auto-run flags kept off your laptop's own files.
- [Run AI agents on financial code and data inside sealed machines, with a record you can verify.](https://kosa8.com/use-cases/financial-services/): kosa8 runs each AI agent at a bank or fintech in its own microVM: one folder in view, an allow-listed network, keys kept outside and a hash-chained audit log.
- [Run Gemini CLI in a microVM on your Mac, Linux or Windows machine.](https://kosa8.com/use-cases/gemini-cli/): A Gemini CLI sandbox on your Mac, Linux or Windows machine: Gemini CLI runs in its own microVM, sees one folder, and your Gemini API key stays outside behind a broker.
- [Run AI agents on government networks, air-gapped, with FIPS 140-3 builds and signed policy.](https://kosa8.com/use-cases/government-defence/): kosa8 runs AI agents in microVMs on air-gapped networks: offline install, FIPS 140-3 builds, signed org policy, CUI labels and two-person approvals.
- [Let AI agents work near patient and trial data without letting the data out.](https://kosa8.com/use-cases/healthcare/): kosa8 runs AI agents for hospitals and pharma in sealed microVMs on your own hardware, with local models, encrypted snapshots, audit logs and IQ/OQ records.
- [kosa8 gives each AI agent a sealed machine. Here is how, tool by tool.](https://kosa8.com/use-cases/): How kosa8 is used: a sealed microVM for Claude Code, Codex, Cursor, Gemini CLI, MCP servers and agent frameworks, and pages for regulated and security teams.
- [Use AI agents on client matters without putting confidentiality at risk.](https://kosa8.com/use-cases/legal/): kosa8 gives each AI agent at a law firm its own microVM: one matter folder, a closed network, keys held outside, local models and a verifiable record.
- [Run each MCP server in its own microVM, behind one gateway.](https://kosa8.com/use-cases/mcp-servers/): An MCP server sandbox: kosa8 runs each MCP server in its own microVM behind one gateway that pins tool definitions, applies argument rules and logs every call.
- [Give every team a microVM sandbox behind the Docker API they already use.](https://kosa8.com/use-cases/platform-teams/): kosa8 gives platform teams microVM sandboxes behind a Docker-compatible API, a TypeScript SDK and an MCP server, with one signed policy on every machine.
- [Detonate samples, train analysts and run SOC agents on machines that cannot reach out.](https://kosa8.com/use-cases/security-operations/): kosa8 detonates Linux malware in a microVM on a simulated internet, signs the report, resets training ranges and contains the AI agents your SOC runs.

## Security
- [AI agent sandbox for the enterprise](https://kosa8.com/ai-agent-sandbox/): One page on running AI agents safely at enterprise scale: a microVM per agent, closed network, keys kept outside, human approval, rewind, hash-chained audit; ten agent risks (prompt injection, exfiltration, secret theft, excessive agency and more) each with its control; every industry use case; cloud, self-hosted or air-gapped.
- [kosa8 for security teams: contain what a hijacked agent can do](https://kosa8.com/security-teams/): For CISOs and AI security teams: a microVM per agent, keys and network rules on the host, checked tool calls with approvals, a signed audit log, SIEM forwarding, signed MCP policy, an offline evidence verifier and a cyber range.
- [Control map: kosa8 against AI security frameworks (self-assessed)](https://kosa8.com/security-teams/frameworks/): kosa8 controls mapped to OWASP Top 10 for LLM Applications 2025, OWASP Top 10 for Agentic Applications, MITRE ATLAS, NIST AI RMF 1.0, EU AI Act Articles 12 and 15 and ISO/IEC 42001, gaps marked; self-assessed, not a certification.
- [kosa8 security: one sealed machine per agent, with every control on your side](https://kosa8.com/security/): How kosa8 isolates AI agents: a microVM per sandbox, host-side egress and keys, approvals, a hash-chained audit log, signed releases and no telemetry.

## Compliance and evidence
- [Evidence for AI agent governance: what the frameworks ask and what kosa8 records](https://kosa8.com/compliance/): What the EU AI Act, SOC 2, ISO/IEC 42001 and NIST AI RMF ask about logging, oversight and access, and the evidence kosa8 produces for each AI agent.

## Sandbox options
- [Best AI agent sandboxes in 2026](https://kosa8.com/alternatives/): eleven named options (E2B, Daytona, Modal, Vercel Sandbox, Cloudflare Sandboxes, Runloop, Northflank, Blaxel, Docker, Firecracker, kosa8) and the five kinds they fall into: cloud services, self-hosted microVMs, local microVMs, containers and user-space kernels
- [E2B alternatives](https://kosa8.com/alternatives/e2b/): why teams leave E2B, and ten options with full comparisons
- [Daytona alternatives](https://kosa8.com/alternatives/daytona/): why teams leave Daytona, and ten options with full comparisons
- [Modal alternatives](https://kosa8.com/alternatives/modal/): why teams leave Modal, and ten options with full comparisons

## Comparisons

Every fact about another product comes from that vendor's own docs or pricing page, checked on 2026-11-14 and cited on the page; "not documented" means the vendor's pages did not say. kosa8 has no SOC 2 report yet (in progress) and no GPU sandboxes.

- [kosa8 vs other AI agent sandboxes](https://kosa8.com/vs/): every comparison, with isolation, self-hosting and fork at a glance
- [kosa8 vs E2B](https://kosa8.com/vs/e2b/): E2B: Firecracker microVMs with fork, pause and five managed regions. kosa8: microVMs on your machines, air-gapped or kosa8 Cloud.
- [kosa8 vs Daytona](https://kosa8.com/vs/daytona/): Daytona: containers by default, VM sandboxes with fork, GPUs, Windows and macOS. kosa8: a microVM every time, on your machines or kosa8 Cloud.
- [kosa8 vs Modal](https://kosa8.com/vs/modal/): Modal: gVisor or VM sandboxes with GPUs in many regions. kosa8: microVMs on your machines or kosa8 Cloud, with live fork and rewind.
- [kosa8 vs Vercel Sandbox](https://kosa8.com/vs/vercel-sandbox/): Vercel: Firecracker microVMs in 19 regions with a strong egress firewall. kosa8: microVMs anywhere you run them, with live fork and rewind.
- [kosa8 vs Cloudflare Sandboxes](https://kosa8.com/vs/cloudflare-sandbox/): Cloudflare: Firecracker-backed containers started from a Durable Object across its network. kosa8: microVMs on your machines or kosa8 Cloud.
- [kosa8 vs Runloop](https://kosa8.com/vs/runloop/): Runloop: managed VM devboxes, deploy into your AWS, GCP or Azure account. kosa8: microVMs you run anywhere, saving memory as well as disk.
- [kosa8 vs Northflank](https://kosa8.com/vs/northflank/): Northflank: a full platform with microVM and gVisor sandboxes, 17 regions, wide BYOC and GPUs. kosa8: microVMs with live fork and rewind.
- [kosa8 vs Blaxel](https://kosa8.com/vs/blaxel/): Blaxel: microVMs that sleep and resume in under 25 ms, with memory fork in preview. kosa8: microVMs on your machines, air-gapped or kosa8 Cloud.
- [kosa8 vs Docker](https://kosa8.com/vs/docker/): Docker: containers share the host kernel; Docker Sandboxes put agents in local microVMs. kosa8: microVMs with rewind, fork and audit.
- [kosa8 vs Firecracker](https://kosa8.com/vs/firecracker/): Firecracker: the Apache-2.0 VMM behind AWS Lambda, which you build a platform around. kosa8: a finished sandbox product with network, keys, audit and rewind.

## Glossary
- [AI agent security glossary](https://kosa8.com/glossary/): Plain definitions of 46 AI agent security terms, from microVM and gVisor to prompt injection, MCP tool poisoning, egress brokers and hash-chained audit logs.

## Guides

- [All guides](https://kosa8.com/guides/): how-to answers for running AI agents safely
- [How do I run Claude Code safely on a Mac?](https://kosa8.com/guides/run-claude-code-safely-on-mac/): Keep Claude Code in Manual or acceptEdits mode, turn on /sandbox (macOS Seatbelt), and for a hard boundary run it in a microVM with its own kernel.
- [Docker containers vs microVMs: which isolates an AI agent better?](https://kosa8.com/guides/docker-vs-microvm-for-ai-agents/): A microVM isolates an AI agent more strongly: it runs on its own guest kernel behind a hypervisor, while a container shares the kernel of the host it runs on.
- [How do I undo what an AI coding agent did?](https://kosa8.com/guides/undo-ai-agent-changes/): Use git to undo an AI agent's file edits, and a whole-machine checkpoint for what git misses: installed packages, outside files, databases and processes.
- [How do I run untrusted LLM-generated code safely?](https://kosa8.com/guides/run-untrusted-llm-code-safely/): Run it behind a real isolation boundary with no secrets inside, an allow-listed network, CPU and memory caps, rewindable state and an audit log.
- [How do I restrict an AI agent's network access to an allow-list?](https://kosa8.com/guides/ai-agent-network-allow-list/): Deny all outbound traffic by default, allow only listed hosts, and enforce it outside the agent's machine with DNS answered there; DNS or proxy filters leak.
- [How do I give an AI agent API keys without exposing them?](https://kosa8.com/guides/give-ai-agent-api-keys-safely/): Keep the key out of the agent's environment: give it a placeholder and let a host-side egress proxy swap in the real key on the way out to one allowed API.
- [How do I run MCP servers in a sandbox?](https://kosa8.com/guides/sandbox-mcp-servers/): Run each MCP server in its own microVM reaching only the hosts it needs, behind a gateway that pins tool definitions, so a bad server cannot reach your files.
- [How do I run an AI agent sandbox on my own machine instead of the cloud?](https://kosa8.com/guides/local-ai-agent-sandbox/): Install a local sandbox runtime such as kosa8, start its daemon and create a microVM for the agent. Code, data and keys stay on your hardware, even offline.
- [How do I try several AI agent approaches in parallel?](https://kosa8.com/guides/fork-agent-sandbox-parallel/): Fork the agent's sandbox after setup, run one approach per live copy at the same time, compare exit codes and timings, and keep the copy that worked.
- [How do I require human approval before an AI agent runs a risky command?](https://kosa8.com/guides/human-approval-ai-agent-commands/): Hold risky AI agent calls such as force pushes, deploys, payments and deletes until a person approves that exact call, and record each decision in an audit log.
- [How do I run an AI coding agent fully air-gapped?](https://kosa8.com/guides/air-gapped-ai-coding-agent/): Carry the installer, guest image, container images and model across the gap, serve the model on 127.0.0.1, and point the agent at it. Nothing leaves.
- [Is it safe to use claude --dangerously-skip-permissions?](https://kosa8.com/guides/claude-code-dangerously-skip-permissions/): Only inside an isolated machine. The flag turns off Claude Code's permission prompts, so run it in a VM or container that sees one folder and holds no keys.
- [How do I block dangerous commands with Claude Code hooks?](https://kosa8.com/guides/claude-code-hooks-block-dangerous-commands/): Add a PreToolUse hook on Bash that exits with code 2 to block a command, back it with deny and ask rules, and know that text matching can be bypassed.
- [How do I use Cline auto-approve and YOLO mode safely?](https://kosa8.com/guides/cline-auto-approve-safely/): Auto-approve only Cline's project reads at first, keep the all-files and all-commands toggles off, and use YOLO mode only in an isolated VM or throwaway box.
- [How do I point a coding agent at a local model?](https://kosa8.com/guides/coding-agent-with-local-model/): Serve a model with kosa8 model serve and set the agent's base URL to 127.0.0.1:7434. Aider fits, and since v0.11.0 tool-calling agents can use it too.
- [How do I sandbox CrewAI code after CodeInterpreterTool?](https://kosa8.com/guides/crewai-code-execution-sandbox/): CodeInterpreterTool is gone and allow_code_execution is deprecated. Give the agent a custom tool that runs code in a local microVM with no network instead.
- [How do I use Cursor's YOLO mode without risking my machine?](https://kosa8.com/guides/cursor-agent-yolo-mode-safely/): Keep Cursor's sandbox on, commit before each task, and use Run Everything or --yolo only where the agent reaches nothing you would miss, such as a separate VM.
- [How do I sandbox LangChain and LangGraph code execution?](https://kosa8.com/guides/langchain-langgraph-code-execution-sandbox/): Swap PythonREPLTool for a tool that runs code in a sealed microVM with no network, and add a LangGraph interrupt() so a person approves each run.
- [How do I give the OpenAI Agents SDK a local sandbox?](https://kosa8.com/guides/openai-agents-sdk-local-sandbox/): Use the SDK's DockerSandboxClient and set DOCKER_HOST to kosa8's socket: the sandbox becomes a container in a microVM on your own Mac, Linux or Windows machine.
- [How do I run OpenHands in a sandbox safely?](https://kosa8.com/guides/openhands-sandbox-runtime/): Keep OpenHands on its default Docker sandbox, publish the UI on 127.0.0.1 only, mount just the project, and isolate the Docker host the app controls.
- [Is Aider safe? How do I run Aider in a sandbox?](https://kosa8.com/guides/run-aider-safely/): Aider commits each edit to git so /undo works, but it also runs shell commands. Run it in a container or VM with one folder and a limited network.
- [How do I run Claude Code safely on Linux?](https://kosa8.com/guides/run-claude-code-safely-on-linux/): Install bubblewrap and socat for Claude Code's /sandbox, make it fail closed, and for a hard boundary run it in a KVM microVM that sees one folder and no key.
- [How do I run Claude Code safely on Windows with WSL2?](https://kosa8.com/guides/run-claude-code-safely-on-windows-wsl2/): Run Claude Code inside WSL2 and turn on /sandbox, which native Windows and WSL1 lack. For a VM boundary, kosa8 runs a microVM through WSL2 (preview).
- [How do I run Codex CLI safely?](https://kosa8.com/guides/run-codex-cli-safely/): Keep Codex in workspace-write with on-request approvals and the network off. Use danger-full-access or --yolo only inside a VM you are prepared to lose.
- [How do I run a coding agent unattended overnight safely?](https://kosa8.com/guides/run-coding-agents-unattended/): Give the agent its own VM and branch, cap turns and spend, checkpoint as it works, let risky calls wait for a person, and read the audit log before you merge.
- [How do I run Gemini CLI in a sandbox?](https://kosa8.com/guides/run-gemini-cli-in-a-sandbox/): Start Gemini CLI with -s or set GEMINI_SANDBOX (Seatbelt, Docker, Podman). For its own kernel, an allow-listed network and a brokered key, use a microVM.
- [How do I build a self-hosted code interpreter for my LLM?](https://kosa8.com/guides/self-hosted-code-interpreter/): Run model-written code in a VM you control: no network, a read-only input folder, a writable output folder, time limits and a rewind after every run.
- [How do I make smolagents code execution secure locally?](https://kosa8.com/guides/smolagents-secure-code-execution/): Set executor_type="docker" and point DOCKER_HOST at kosa8: CodeAgent's Python then runs in a container inside a microVM on your machine, not in your process.
- [How do I stop an AI agent from deleting my files?](https://kosa8.com/guides/stop-ai-agent-deleting-files/): Commit first, give the agent one folder, hold rm -rf, git clean and git reset --hard for approval, and run it in a VM where the rest of your disk is absent.
- [How do I stop AI coding agents from reading my .env secrets?](https://kosa8.com/guides/stop-ai-agent-reading-env-secrets/): Move real keys out of the folder the agent works in. Ignore files miss shell commands and scripts; a proxy that swaps in the key leaves nothing to read.
- [How do I run Vercel AI SDK agent code in a local sandbox?](https://kosa8.com/guides/vercel-ai-sdk-code-execution-sandbox/): Install @kosa8/ai-sdk-sandbox, create a session and pass session.restricted() as experimental_sandbox: your tools then run in a microVM on your machine.

## Deep dives

- [AI agent sandboxes in 2026: a map of the options](https://kosa8.com/blog/ai-agent-sandboxes-2026-map-of-the-options/): A neutral map of AI agent sandboxes: Docker, gVisor, Firecracker, Kata, E2B, Daytona, Modal, Vercel, Cloudflare and local VMs, sorted by boundary and location.
- [The AI agent security checklist for 2026](https://kosa8.com/blog/ai-agent-security-checklist-2026/): 26 concrete AI agent security checks for isolation, credentials, network, MCP tools, approval, undo, audit and supply chain, mapped to OWASP lists.
- [Why AI coding agents need an undo button for the whole machine](https://kosa8.com/blog/ai-coding-agents-need-a-whole-machine-undo/): Coding agents have deleted databases, home folders and project files. Git covers only part of that. How a memory-and-disk checkpoint gives you a real undo.
- [Prompt injection meets your API keys: why the key should never enter the sandbox](https://kosa8.com/blog/prompt-injection-api-keys-egress-broker/): Injected instructions can make an agent leak env vars and .env files. Keep the key outside the sandbox with an egress broker, then limit what the key can do.
- [What an audit log for AI agents should record (and why hash-chaining matters)](https://kosa8.com/blog/what-an-audit-log-for-ai-agents-should-record/): The fields an AI agent audit log needs, how hash chains expose edits and deletions, how long to keep logs, and what NIST, SOC 2 and the EU AI Act ask for.
- [Memory snapshots vs disk snapshots: what "checkpoint" means for an agent sandbox](https://kosa8.com/blog/agent-sandbox-memory-vs-disk-snapshot/): A disk snapshot saves files; a memory snapshot also saves RAM and running processes. What each restores, why connections drop, and the risk in forking clones.
- [Are domain allow-lists enough? How AI agent egress control really works](https://kosa8.com/blog/ai-agent-egress-control-explained/): A domain allow-list limits where an AI agent can connect, not what it sends. How IP rules, DNS filtering and proxies differ, and where data still gets out.
- [E2B, Daytona, Modal, Vercel Sandbox and local options: how AI sandboxes differ](https://kosa8.com/blog/ai-sandbox-providers-compared/): How E2B, Daytona, Modal, Vercel Sandbox, Cloudflare and local sandboxes differ on runtime, lifetime, state, billing and location, from vendor docs. No ranking.
- [What Claude Code's built-in sandbox covers, and what it doesn't](https://kosa8.com/blog/claude-code-built-in-sandbox-explained/): Claude Code's /sandbox wraps shell commands with Seatbelt or bubblewrap and a domain proxy. What it covers, what runs outside it, and its documented limits.
- [Is a devcontainer enough for AI coding agents?](https://kosa8.com/blog/devcontainer-for-ai-coding-agents/): A devcontainer keeps an AI coding agent's commands off your host, but its keys sit inside. How devcontainers, Docker Sandboxes and microVMs compare.
- [EU AI Act Article 12: what logging means for AI agents](https://kosa8.com/blog/eu-ai-act-article-12-ai-agent-logging/): What Article 12 of the EU AI Act says about logs, when it applies to an AI agent, the six-month retention floor, and the amended 2027 and 2028 high-risk dates.
- [Excessive agency (OWASP LLM03:2026), explained for agent builders](https://kosa8.com/blog/excessive-agency-owasp-llm/): Excessive agency is OWASP's LLM03:2026: an agent with more tools, permissions or autonomy than its task needs. Each mitigation mapped to a concrete control.
- [Firecracker vs gVisor vs Kata Containers: which isolation for AI agents?](https://kosa8.com/blog/firecracker-vs-gvisor-vs-kata-containers/): Firecracker is a microVM monitor, gVisor a user-space kernel, Kata a VM runtime for containers. How they differ for AI agents, and what Mac users do instead.
- [Git worktrees vs sandboxes for running parallel coding agents](https://kosa8.com/blog/git-worktrees-vs-sandboxes-parallel-agents/): Git worktrees give each parallel coding agent its own files and branch; sandboxes give it its own machine. What each isolates, what leaks, and when it's enough.
- [The lethal trifecta: how AI agents leak data, and how to break it](https://kosa8.com/blog/lethal-trifecta-ai-agent-data-exfiltration/): Private data, untrusted content and a way out add up to AI agent data exfiltration. How markdown images and EchoLeak used it, and how to cut the way out.
- [Malicious agent skills and AGENTS.md: the new coding-agent supply chain](https://kosa8.com/blog/malicious-agent-skills-supply-chain/): A SKILL.md or AGENTS.md file is code your agent obeys with its own permissions. What Snyk and OWASP found, and how to shrink what a malicious skill inherits.
- [MCP tool poisoning and rug pulls, explained (and how to prevent them)](https://kosa8.com/blog/mcp-tool-poisoning-rug-pull/): How MCP tool poisoning hides instructions in tool descriptions, how a rug pull changes them after approval, and why pinning needs a sandbox behind it.
- [Can you run Firecracker on a Mac? MicroVMs on Apple silicon explained](https://kosa8.com/blog/microvm-on-apple-silicon-mac/): Firecracker needs Linux KVM, which macOS lacks. How Apple's Virtualization and Hypervisor frameworks run microVMs on Apple silicon, and where nesting helps.
- [Prompt injection in coding agents: repos, issues, and web pages as attack surface](https://kosa8.com/blog/prompt-injection-coding-agents/): A coding agent reads READMEs, issues, web pages and tool output, and any of it can carry instructions. Assume injection will happen and limit what it can reach.
- [Self-hosted AI sandbox options: running an E2B alternative yourself](https://kosa8.com/blog/self-hosted-ai-sandbox-options/): A neutral guide to self-hosted AI code sandboxes: E2B Embed, the archived Daytona repo, microsandbox, Kubernetes agent-sandbox, Docker Sandboxes and kosa8.
- [Does SOC 2 apply to AI agents? What auditors ask](https://kosa8.com/blog/soc-2-ai-agents/): SOC 2 has no AI-agent section, yet its access, change and monitoring criteria reach agents in scope. CC6, CC7 and CC8 mapped to the evidence auditors ask for.
- [What is a microVM? How it differs from containers and full VMs](https://kosa8.com/blog/what-is-a-microvm/): A microVM is a small virtual machine with its own kernel that boots in under a second. How it differs from containers and full VMs, and why AI agents use one.
- [What is an AI agent sandbox? A plain-English definition](https://kosa8.com/blog/what-is-an-ai-agent-sandbox/): An AI agent sandbox is an isolated machine where an agent's commands and code run, apart from your files, network and keys. What it protects, plus a checklist.
- [What is an MCP gateway, and do you need one?](https://kosa8.com/blog/what-is-an-mcp-gateway/): An MCP gateway puts one endpoint between AI clients and many MCP servers for auth, routing, allow-lists and audit. What it cannot do, and where sandboxes fit.

## Docs

- [Documentation](https://docs.kosa8.com): full docs
- [Getting started](https://docs.kosa8.com/guides/install/): install and first sandbox
- [kosa8 Cloud quickstart](https://docs.kosa8.com/guides/cloud/): sign up, payment method, API key, first sandbox from Python, JavaScript or curl; templates, regions and prices
- [Refer and earn guide](https://docs.kosa8.com/guides/refer/): where to find your referral link, the referral and affiliate rules, and the API
- [Integrations](https://kosa8.com/docs/integrations/): tested tools on the Docker-compatible API, with versions and known limits
- [Testcontainers](https://kosa8.com/docs/integrations/testcontainers/): Python, Java and Node
- [OpenAI Agents SDK](https://kosa8.com/docs/integrations/openai-agents/): DockerSandboxClient on kosa8
- [smolagents](https://kosa8.com/docs/integrations/smolagents/): the Docker code executor on kosa8
- [dockerode](https://kosa8.com/docs/integrations/dockerode/): driving kosa8 from Node.js
- [Claude Code plugin and MCP server](https://github.com/kosa8ai/kosa8-claude-plugin): install with `/plugin marketplace add kosa8ai/kosa8-claude-plugin` then `/plugin install kosa8@kosa8`
- [Agent install steps](https://github.com/kosa8ai/kosa8-claude-plugin/blob/main/llms-install.md): for an AI agent setting kosa8 up

## Optional

- [Research report](https://kosa8.com/research/): Sealed Machines for Autonomous Agents, design, threat model, measured results and a comparison with ten agent sandboxes
- [Blog](https://kosa8.com/blog/): daily notes on AI agent security
- [Privacy policy](https://kosa8.com/privacy/): what leaves the machine and what does not
- [Terms of service](https://kosa8.com/terms/): licence, free tier, billing through Polar, refunds, acceptable use
- [Partner program](https://kosa8.com/partners/): for IT services firms, integrators and MSSPs
- [Refer and earn](https://kosa8.com/refer/): give $30, get $30 of kosa8 Cloud credit at the invited team's first payment of $25 or more; 30-day hold, $500 a year cap
- [Affiliate program](https://kosa8.com/affiliates/): 20% of licence and Cloud plan or usage payments for 12 months (not credit packs), approved by hand; payable after a 60-day hold, paid monthly by PayPal or Wise from $50 once a tax form is on file; disclosure required, no brand-keyword bidding