Cadenya
Freemium
Developers building agentic workflows
Vmette
FreeOpen SourceSelf-Hosted
Coding agents like Claude Code and Cursor will pip install whatever a README tells them to, execute model output directly, and follow instructions embedded in web pages — and if that runs on your laptop, the agent has your files, your tokens, and your network. vmette gives that execution a separate address instead: a hardware-isolated Linux microVM that boots in roughly one second, holds only what you explicitly share in, and vanishes when the session ends.
Similar tools
CadenyaFreemiumCadenya is an agent runtime built around a layered model: tools connect once through MCP…
WorldsFreemiumWorlds spins up a sealed twin of the external systems your agent touches — Stripe and Zendesk…
Brain MemoryFreeBrain Memory stores agent decisions as Markdown files with YAML frontmatter, organized in a…
JevProxyFreemiumThe proxy sits in front of your Cursor or Claude Code agent fleet and classifies incoming tool…
Get This Tool
License: MIT Any use incl. commercial
Local-run terms: Full source code and binaries available under MIT license. Users may build, modify, and deploy locally without restrictions.
Screenshots 1
Pricing
- Model
- Free
Summary
The threat model vmette solves is concrete: prompt injection on a fetched web page, a malicious package in an AI-suggested install, or model output that does something you didn't intend — all of it lands inside the VM, not on your host. The isolation is hardware-level, not a container namespace that a determined process can escape. Because everything runs on-device, no agent output leaves your machine to a third-party cloud sandbox. The ceiling appears at the edges: vmette is macOS-only, and teams whose agents need to run on Linux servers or in CI pipelines will need a different isolation strategy.
Bottom line: Pick vmette if you are running Claude Code or Cursor locally on a Mac and want the agent's execution to happen somewhere it cannot touch your host filesystem by default — but if your pipeline runs on Linux or you need to isolate agent work inside a cloud CI environment, vmette's macOS dependency is a hard stop.
Find your fit
Before you choose Vmette
More options in Agent Frameworks. Compare pricing, platforms, and features side by side.
Brain Memory
Free · Open source
Long-term continuity in multi-session coding projects
Pros
- Hardware-isolated VM boundary rather than a container namespace, so a misbehaving agent or malicious package cannot reach your host filesystem or credentials through a kernel-sharing escape path.
- ~1-second boot time on macOS, which means the isolation overhead does not force you to batch or pre-warm — each agent invocation gets a fresh, ephemeral environment without a meaningful delay penalty.
- Fully on-device with no cloud dependency, so agent output, file contents, and API tokens passed into the VM never transit a third-party sandbox service.
- MIT-licensed and free with no commercial tier, so teams that would otherwise pay for a hosted sandbox can run unlimited isolated executions without metering or subscription cost.
- MCP integration is documented, which means Claude Code, Cursor, and other MCP-compatible agents can delegate execution directly without a custom integration layer.
Cons
- macOS-only: teams whose agents run in Linux-based CI pipelines, on Linux developer workstations, or in any cloud environment hit a hard stop — the virtualization layer is Apple-specific, and there is no Linux port described in the repository. Those teams route to a different isolation solution entirely.
- No API surface: external systems cannot programmatically query vmette's state, inspect VM lifecycle, or integrate isolation into orchestration tooling beyond what the MCP interface exposes. Teams building automated pipelines with custom tooling will find the integration surface thin.
- Early-stage project with a single-digit star count and no open issues, which means community-sourced debugging help, third-party tutorials, and documented production war stories are absent — teams encountering edge cases in agent behavior are working from the README and source alone.
About
- Platforms
- macOS 11+
- API Available
- No
- Self-Hosted
- Yes
- Last Updated
- June 9, 2026
Best For
Who it's for
- Developers running coding agents (Claude Code, Cursor) who want local hardware isolation
- Teams unwilling to send agent execution to third-party cloud sandboxes
- macOS users prioritizing privacy and on-device processing
- AI agent workflows requiring default-deny isolation and ephemeral execution
- Users valuing zero-cost, subscription-free sandboxing
What it does well
- Sandboxing untrusted AI agent code execution locally
- Running Claude Code, Cursor, Cline with hardware-isolated safety boundaries
- Testing malicious or untrusted software in isolation without exposing host data
- Model Context Protocol (MCP) agent integration for secured environments
- Development and testing of local AI workflows without cloud dependency
Integrations
Frequently Asked Questions
- Is Vmette free?
- Vmette offers a free option. Hosting, model usage, or optional services may have separate costs; check the pricing details and official terms.
- Is Vmette open source?
- Yes. Vmette is open source.
- Can I self-host Vmette?
- Yes. Vmette supports self-hosting on your own infrastructure.
- What platforms does Vmette support?
- Vmette is available on: macOS 11+.
Curated lists that include this category
Coding agents execute code they generate, install packages from model suggestions, and browse URLs that can carry adversarial instructions. vmette intercepts that execution surface by routing agent work into a hardware-isolated Linux microVM that boots in approximately one second on macOS. The VM sees only the files and context you explicitly pass in, has no default access to your host filesystem or credentials, and is destroyed when the session ends — so a compromised execution leaves nothing behind. The core workflow is a local daemon that receives work from external agents (Claude Code, Cursor, Cline) via the Model Context Protocol, runs it in isolation, and returns results to the calling tool.
The differentiating design choice is hardware isolation rather than container-level separation. Container namespaces share a kernel; a kernel exploit or misconfigured permission can reach the host. vmette uses a real VM boundary, which raises the escape bar to hardware-level. The tradeoff is macOS-only support — the virtualization layer it depends on is Apple Silicon and macOS-specific.
vmette fits a specific gap: a solo developer or small team running AI coding agents locally who refuses to route execution through a third-party cloud sandbox and wants zero-cost, subscription-free isolation. It breaks down when the team’s agents run in CI, on Linux workstations, or in environments where standing up a macOS host is not an option. MCP integration is documented, which means agents that already speak MCP can delegate execution to the VM without a custom shim.
Contribute
- Work on Vmette? Claim this listing.
- Embed a badge for your README or site.
Sign in to rate this tool or suggest an edit.