Use case · Cline, Aider, OpenHands · Updated 2026-10-31
Give Cline, Aider and OpenHands a sealed machine to work in.
A sandbox for Cline, Aider or OpenHands keeps an agent with auto-approve switched on away from the rest of your computer. kosa8 has no built-in kit or separately documented integration for these three tools, so this page shows the documented kosa8 pieces that fit: a kit you write for a command-line agent such as Aider, kosa8's MCP server for an MCP client such as Cline, and a plain sandbox with your project and no network.
01What do these tools run on your machine?
- Cline can auto-approve reading and editing files, running commands and using MCP servers. Its docs say YOLO mode "disables all safety checks" and that Cline then "executes whatever it decides without asking permission", and they advise starting in an isolated environment.
- Aider installs with
piporuvand runs in your terminal, as you. - OpenHands runs its agent server in a Docker container by default, which its docs describe as good isolation from your host machine. Its process runtime is labelled "unsafe, but fast", with no container isolation.
02A kit of your own for a command-line agent
A kit is a short YAML file naming the image, what is installed, the one folder the agent sees, the hosts it may reach and the keys it may use. Start from the built-in shell kit, which has the workspace mounted and no network:
kosa8 agent init shell kosa8 agent run --dry-run shell
For Aider, set image to a Python image, add a setup line that installs it, replace egress: deny with an egress_allow list naming your model provider and package index, and set command. A pip install in setup counts as unpinned and needs --allow-unpinned; an image that already contains the tool does not. A key can be brokered under credentials only if the tool can be pointed at a different base URL; otherwise list it under secrets, and it is passed in where the agent can read it.
03Sandboxes as MCP tools for Cline
kosa8 is also an MCP server that any MCP client can use, and Cline supports MCP servers. Add one server whose command is kosa8 with the arguments mcp serve, and the assistant gets tools such as sandbox_create, sandbox_run, sandbox_checkpoint and sandbox_rewind to run risky code in a microVM. Such a sandbox has no network unless the call asks for named hosts. Cline's own terminal commands still run on your computer.
{ "mcpServers": { "kosa8": { "command": "kosa8", "args": ["mcp", "serve"] } } }
04Third-party MCP servers, sealed off
The MCP servers these agents use can run in microVMs of their own behind the same gateway, each with its own network rule and only the tools you expose.
05OpenHands and kosa8
kosa8 serves a Docker-compatible API, and some tools that drive Docker run on it unchanged. OpenHands is not among the tools kosa8 has tested, so using kosa8 as an OpenHands runtime is not documented. The integrations page lists exactly what has been tested.
06How to start
Install kosa8 and start its daemon.
Open your project in a sandbox with no network, or write a kit from the shell kit.
kosa8 agent run shell kosa8 agent init shell
07Questions
Does kosa8 have a built-in kit for Cline, Aider or OpenHands?
No. The built-in kits are claude, codex, gemini, opencode, copilot and shell, plus cursor, which is marked unavailable. For other tools you write a kit, or use kosa8's MCP server.
Does running kosa8 make Cline's YOLO mode safe?
Not by itself. Through kosa8's MCP server, Cline can send risky code to a sealed microVM, but Cline's own terminal commands and file edits still run on your computer.
Can OpenHands use kosa8 as its runtime?
It has not been tested. kosa8 serves a Docker-compatible API, but OpenHands is not on kosa8's list of tested integrations.
Can a kit keep Aider's API key out of the sandbox?
Only if Aider can be pointed at the broker's address instead of the provider's. A key listed under credentials stays on your computer; a key listed under secrets is passed in, and the agent can read it.
08Guides and articles
09Sources
10Try it on your own machine
Install kosa8, start with a sandbox that has your project and no network, and build a kit from there.
Updated 2026-10-31