kosa8 gives each AI agent a sealed machine. Here is how, tool by tool.

kosa8 is secure infrastructure for AI agents: each agent gets its own microVM, with its own kernel, on your own Apple silicon Mac or x86-64 Linux machine. These pages show what that means for a specific coding agent, tool server or framework, and for teams in regulated and security-sensitive work. Each one names what kosa8 has tested and what is not separately documented.

01By agent or tool

Claude Code: the built-in claude kit, a pre-run check on every tool call, and the Claude Code plugin.
Codex CLI: OpenAI's Codex CLI in its own microVM, with the OpenAI key brokered.
Cursor: Cursor's CLI agent from a kit you finish, and why the built-in kit is unavailable.
Gemini CLI: Gemini CLI in a microVM, with the Gemini key kept outside.
Cline, Aider and OpenHands: patterns using your own kit and kosa8's MCP server.
MCP servers: one microVM per server, pinned tool definitions and argument rules.
Agent frameworks: LangGraph, CrewAI, OpenAI Agents SDK, smolagents and Vercel AI SDK.

02By team or industry

Financial services: agents near customer financial data, with audit trails and approvals.
Healthcare: agents near patient data, kept on your own hardware.
Government and defence: disconnected operation and evidence for assessors.
Legal: client confidentiality and a record of what an AI touched.
Security operations: analysis in machines that can be rewound.
Platform teams: a Docker-compatible API, SDKs and organisation-wide policy.

03What every use case shares

A microVM per agent. Its own Linux kernel behind a hypervisor, seeing only the folder you share.
An allow-listed network. Only the hosts you name, enforced on your side of the boundary.
Keys kept outside. An egress broker adds API keys to requests on the way out; the sandbox holds a placeholder.
Undo. Checkpoint the whole running machine, rewind it, or fork it into live copies.
Approvals and an audit log. Risky calls wait for a person; every action goes into a hash-chained log.

04Questions

What is kosa8?

kosa8 is commercial software that gives each AI agent its own sealed microVM on your own Mac or Linux machine, with an allow-listed network, API keys kept outside the machine, checkpoint and rewind, human approval gates and a hash-chained audit log.

Which coding agents have built-in kits?

Claude Code, OpenAI Codex CLI, Gemini CLI, OpenCode and GitHub Copilot CLI, plus a plain shell. The cursor kit is listed but marked unavailable until its installer can be verified.

Where does kosa8 run?

kosa8 runs its microVMs on an Apple silicon Mac (Apple's Virtualization framework) or on x86-64 Linux (KVM). On an Intel Mac it installs as the command-line tool only and drives sandboxes on one of those machines.

05Guides and articles

06Try it on your own machine

Install kosa8 and run your first agent in a sealed machine. Plans start at $29 a month.

Download kosa8 See plans

Updated 2026-10-31