AI Sandbox
For your agent’s code
Your coding agent writes and runs code in your name: MCP servers, scripts, and tools, all with access to your files, network, and keys.
Run agent code in a sandbox instead, where every app starts with no access to any of it until you grant it.
Free & local macOS, Windows, Linux
Open source coreCNCF wasmCloud
How it works
Move fast and trust nothing
Most software runs with too much access to your files, keys, network, and more.
Cosmonic sandboxes can only reach what you allow. It isn’t that the code tries something and gets blocked. It has no way to try.
Can reachonly what you granted
Never grantednever requested, never reachable
More on the AI sandbox for agent code →
What you build
Sandbox all the things
Containers give code far more access than it needs, and they get heavy when you run a lot of them. Put AI-generated apps, MCP servers, and other untrusted code in a sandbox instead: usually a few hundred kilobytes to a few megabytes, with only the capabilities you grant.
MCP servers
Give a model a tool without giving it your machine.
Agent-written code
The script your agent just wrote, no trust required.
Functions
One job, small and quick to start.
Workflows
Chain apps into a pipeline; swap a step without a rebuild.
Apps
The whole thing, front to back, running the same way everywhere.
And run thousands at once
Even locally.
Containers
Cosmonic sandboxes
A fresh sandbox per call is cheap, and idle ones cost nothing, so you can sandbox everything you run without taxing your laptop. Real numbers vary with what your workloads do.
Two ways in
Start on your laptop. Ship on your cluster.
Run the sandbox on your own machine
Runs entirely on your machine, online or off. Everything local is free, and stays free.
- Works with any coding agent that speaks MCP: Claude Code, Codex, Gemini, opencode, local models
- Inspect exactly what each app can reach
- The same manifest you deploy to production
- macOS, Windows, and Linux
Ship sandboxes on Kubernetes
The same sandbox and the same manifests as Desktop, now at production scale. Free to start.
- Thousands of sandboxes per node, scaling to zero when idle
- Per-workload capability grants and egress policy
- Declarative workloads, running beside the containers you already have
- EKS, AKS, GKE, OpenShift, VMware, on-prem, air-gapped
Frequently asked questions
What does Cosmonic Desktop actually run?
Anything you want contained: ready-made MCP servers and apps from its built-in catalog, the code your agent writes, functions, workflows, and whole applications. Each one runs in a sandbox that starts with no access to your files, network, or keys until you grant it.
How is this different from a container?
A container starts with broad access to the machine that launched it. A Cosmonic sandbox starts with none: an app can reach only what you granted. Sandboxes are also much smaller and quicker to start, so you can afford to run thousands of them, and they run beside the containers you already have rather than replacing them. The AI sandbox guide compares containers, microVMs, and WebAssembly in depth.
Do I need Kubernetes?
No. Cosmonic Desktop runs entirely on your own machine, with no cluster involved. Kubernetes only enters the picture when you want to ship to production, where Cosmonic Control runs the same sandbox and the same manifests on clusters you already have.
Which AI tools does it work with?
Cosmonic Desktop ships an MCP server, so any coding agent that speaks MCP can build and deploy into the sandbox, including Claude Code, Codex, Gemini, opencode, and local models. Nothing here is tied to one vendor.
Build fast. Run securely.
Put the sandbox on your cluster in an afternoon, or run the whole thing on your laptop for free this evening.