Use case · Claude Code · Updated 2026-10-31

Run Claude Code with the brakes off, inside a sealed machine.

A Claude Code sandbox gives the agent a machine where a bad command or a prompt injection cannot reach the rest of your computer. kosa8 runs Claude Code in its own microVM on your Mac or Linux machine with one command, kosa8 agent run claude: it sees one project folder, reaches only the hosts its kit names, and holds a placeholder instead of your Anthropic API key. If you keep Claude Code on the host, the kosa8 Claude Code plugin gives it sealed sandboxes as MCP tools instead.

01Why does Claude Code need a sandbox?

Claude Code runs shell commands, edits files and starts MCP servers as you. Anthropic's documentation says bypassPermissions, the mode --dangerously-skip-permissions turns on, should only be used in isolated environments like containers, VMs, or dev containers without internet access, and that it offers no protection against prompt injection or unintended actions.

Claude Code's built-in /sandbox helps, but it wraps the Bash commands Claude Code runs (Seatbelt on macOS, bubblewrap on Linux). Its own Read, Edit and Write tools, hooks and local MCP servers run outside it, and it is off by default. Your API key, SSH keys and the rest of your home directory are on the same machine as the agent.

02One command: the built-in claude kit

kosa8 agent run claude starts a fresh microVM from node:22-alpine with 4 vCPUs and 4096 MiB, installs @anthropic-ai/claude-code pinned to version 2.1.296 and checked against its SHA-512 digest, mounts your current folder at /work, and runs claude there. Nothing else on your computer is visible. When Claude Code exits, the sandbox is removed; your folder keeps its changes.

Options go before the kit name; anything after it is passed to Claude Code itself.

03Your Anthropic API key never enters the machine

The sandbox gets ANTHROPIC_API_KEY set to a placeholder and ANTHROPIC_BASE_URL pointed at an egress broker on your side. The broker adds the real key only to requests bound for api.anthropic.com. The network is otherwise closed except for registry.npmjs.org and statsig.anthropic.com; a request anywhere else is refused before it leaves your computer, and recorded.

04Each tool call checked before it runs

The claude kit installs a PreToolUse hook in Claude Code's managed settings, so a project's .claude/settings.json cannot switch it off. Every tool call is checked against kosa8's rules before it runs: a download piped into a shell, or an edit to the assistant's own settings, is refused; a force push, a package publish or a terraform destroy waits for you. If the check cannot be made, the call is refused.

terminal

kosa8 mcp asks
kosa8 mcp approve ID

05The kosa8 Claude Code plugin

To keep Claude Code on your host and give it sandboxes to use, install the plugin from github.com/kosa8ai/kosa8-claude-plugin. It starts kosa8 mcp serve locally, so Claude can run untrusted code in sandboxes and checkpoint, rewind and fork them through tools such as sandbox_create, sandbox_run and sandbox_checkpoint. Type these in Claude Code, then run /reload-plugins and check the connection with /mcp:

A sandbox the assistant creates this way has no network unless it asks for specific hosts.

06Checkpoint, rewind and an audit log

Name the sandbox when you start it, and from a second terminal save the whole running machine, memory and processes included, before a risky step. kosa8 rewind puts it back. A checkpoint does not roll back the shared project folder, which is your real folder; keep git for that.

terminal

kosa8 agent run --name api-claude claude
kosa8 checkpoint api-claude --label "before refactor"
kosa8 audit ls
kosa8 audit verify

Every request through the broker, allowed or refused, and every tool call is written to a hash-chained audit log that kosa8 audit verify checks.

07How to start

Install kosa8 and start its daemon.
Set your key on your computer, preview the plan, then run Claude Code from your project folder.
terminal
```
export ANTHROPIC_API_KEY=sk-ant-...
kosa8 agent run --dry-run claude
kosa8 agent run claude
```

08Questions

Is it safe to use --dangerously-skip-permissions inside a kosa8 sandbox?

Anthropic's documentation says to use it only in isolated environments such as containers or VMs without internet access. A kosa8 microVM is isolated, though its network is limited to the kit's hosts and the broker rather than closed. Inside the claude kit, Claude Code sees only the shared folder, reaches only the kit's hosts, and holds a placeholder instead of your API key. It can still change anything in that folder, including .git, so commit before you start.

How is this different from Claude Code's /sandbox?

/sandbox limits the Bash commands Claude Code runs using the operating system's own sandboxing, on your kernel. A kosa8 microVM puts a separate Linux kernel and a hypervisor around all of Claude Code: its file tools, the packages it installs and any MCP server it starts are inside the boundary too.

Does the sandbox ever hold my Anthropic API key?

No. The sandbox holds a placeholder. A broker on your computer adds the real key to requests for api.anthropic.com and refuses requests to hosts the kit does not list.

Which machines can run Claude Code in a kosa8 microVM?

kosa8 runs its microVMs on an Apple silicon Mac (Apple's Virtualization framework) or on x86-64 Linux (KVM). On an Intel Mac it installs as the command-line tool only and drives sandboxes on one of those machines.

09Guides and articles

10Sources

11Try it on your own machine

Install kosa8 on an Apple silicon Mac or x86-64 Linux machine and run Claude Code in its own microVM today.

Download kosa8 See plans

Updated 2026-10-31