Get This Tool
Vmette
Pricing
- Model
- Free
Summary
Coding agents like Claude Code and Cursor will pip install whatever a README tells them to, execute model output directly, and follow instructions embedded in web pages — and if that runs on your laptop, the agent has your files, your tokens, and your network. vmette gives that execution a separate address instead: a hardware-isolated Linux microVM that boots in roughly one second, holds only what you explicitly share in, and vanishes when the session ends.
The threat model vmette solves is concrete: prompt injection on a fetched web page, a malicious package in an AI-suggested install, or model output that does something you didn't intend — all of it lands inside the VM, not on your host. The isolation is hardware-level, not a container namespace that a determined process can escape. Because everything runs on-device, no agent output leaves your machine to a third-party cloud sandbox. The ceiling appears at the edges: vmette is macOS-only, and teams whose agents need to run on Linux servers or in CI pipelines will need a different isolation strategy.
Bottom line: Pick vmette if you are running Claude Code or Cursor locally on a Mac and want the agent's execution to happen somewhere it cannot touch your host filesystem by default — but if your pipeline runs on Linux or you need to isolate agent work inside a cloud CI environment, vmette's macOS dependency is a hard stop.
Community Performance Report Card
No community ratings yet. Be the first to rate this tool!
Community Benchmarks Community
Sign in to submit a benchmarkNo community benchmarks yet. Be the first to share a real-world data point.
Pros
Sign in to edit- Hardware-isolated VM boundary rather than a container namespace, so a misbehaving agent or malicious package cannot reach your host filesystem or credentials through a kernel-sharing escape path.
- ~1-second boot time on macOS, which means the isolation overhead does not force you to batch or pre-warm — each agent invocation gets a fresh, ephemeral environment without a meaningful delay penalty.
- Fully on-device with no cloud dependency, so agent output, file contents, and API tokens passed into the VM never transit a third-party sandbox service.
- MIT-licensed and free with no commercial tier, so teams that would otherwise pay for a hosted sandbox can run unlimited isolated executions without metering or subscription cost.
- MCP integration is documented, which means Claude Code, Cursor, and other MCP-compatible agents can delegate execution directly without a custom integration layer.
Cons
Sign in to edit- macOS-only: teams whose agents run in Linux-based CI pipelines, on Linux developer workstations, or in any cloud environment hit a hard stop — the virtualization layer is Apple-specific, and there is no Linux port described in the repository. Those teams route to a different isolation solution entirely.
- No API surface: external systems cannot programmatically query vmette's state, inspect VM lifecycle, or integrate isolation into orchestration tooling beyond what the MCP interface exposes. Teams building automated pipelines with custom tooling will find the integration surface thin.
- Early-stage project with a single-digit star count and no open issues, which means community-sourced debugging help, third-party tutorials, and documented production war stories are absent — teams encountering edge cases in agent behavior are working from the README and source alone.
Community Reviews
Sign in to write a reviewNo reviews yet. Be the first to share your experience.
About
- Platforms
- macOS 11+
- API Available
- No
- Self-Hosted
- Yes
- Last Updated
- 2026-06-09T10:59:17.387Z
Best For
Who it's for
- Developers running coding agents (Claude Code, Cursor) who want local hardware isolation
- Teams unwilling to send agent execution to third-party cloud sandboxes
- macOS users prioritizing privacy and on-device processing
- AI agent workflows requiring default-deny isolation and ephemeral execution
- Users valuing zero-cost, subscription-free sandboxing
What it does well
- Sandboxing untrusted AI agent code execution locally
- Running Claude Code, Cursor, Cline with hardware-isolated safety boundaries
- Testing malicious or untrusted software in isolation without exposing host data
- Model Context Protocol (MCP) agent integration for secured environments
- Development and testing of local AI workflows without cloud dependency
Integrations
Discussion Community
Sign in to commentNo discussion yet. Sign in to start the conversation.
Compare Vmette
Spotted incorrect or missing data? Join our community of contributors.
Sign Up to ContributeCommunity Notes & Tips Community
Sign in to contributeBe the first to contribute. General notes, observations, gotchas, and tips from people who use this tool day-to-day.
Frequently Asked Questions
- Is Vmette free?
- Yes — Vmette is fully free to use. There is no paid tier.
- Is Vmette open source?
- Yes. Vmette is open source.
- Can I self-host Vmette?
- Yes. Vmette supports self-hosting on your own infrastructure.
- What platforms does Vmette support?
- Vmette is available on: macOS 11+.
Hours Saved & ROI Stories Community
Sign in to contributeBe the first to contribute. Concrete time/cost savings, with context. e.g. "Cut my code review backlog from 4h to 45m per week."
Curated lists that include this category
Coding agents execute code they generate, install packages from model suggestions, and browse URLs that can carry adversarial instructions. vmette intercepts that execution surface by routing agent work into a hardware-isolated Linux microVM that boots in approximately one second on macOS. The VM sees only the files and context you explicitly pass in, has no default access to your host filesystem or credentials, and is destroyed when the session ends — so a compromised execution leaves nothing behind. The core workflow is a local daemon that receives work from external agents (Claude Code, Cursor, Cline) via the Model Context Protocol, runs it in isolation, and returns results to the calling tool.
The differentiating design choice is hardware isolation rather than container-level separation. Container namespaces share a kernel; a kernel exploit or misconfigured permission can reach the host. vmette uses a real VM boundary, which raises the escape bar to hardware-level. The tradeoff is macOS-only support — the virtualization layer it depends on is Apple Silicon and macOS-specific.
vmette fits a specific gap: a solo developer or small team running AI coding agents locally who refuses to route execution through a third-party cloud sandbox and wants zero-cost, subscription-free isolation. It breaks down when the team’s agents run in CI, on Linux workstations, or in environments where standing up a macOS host is not an option. MCP integration is documented, which means agents that already speak MCP can delegate execution to the VM without a custom shim.