Your agent wrote the code. But do you trust it? Where does it run? What can it access?
For a lot of us, the answers are, "On my machine" and "Everything I can access." AI agents run code in our names. They carry all of our credentials and tokens, our file and network access.
And it isn't only the code they write. Every MCP server you install is third-party code wired straight into a model's tool-use loop — it takes model-shaped input, it usually holds credentials, and it can usually reach the network. You add one with a copied command, and it runs with everything you have. It's one of the toughest problems of the agentic era so far: how do we move quickly with guardrails we can trust?
Cosmonic Desktop is our answer: a free, cross-platform desktop app for running, managing, and creating sandboxed apps.
Built on open standards and designed for the agentic era, it gives your AI agents a way to run the code they generate inside a capability-driven sandbox, isolated from your files, your network, or your keys unless you explicitly allow it, and ready to deploy to the infrastructure you already run.
Cosmonic Desktop is free and available in public beta today on macOS, Linux, and Windows. It runs entirely on your machine, with no login or cloud connection required.
Prompt to a sandboxed app, instantly
Cosmonic Desktop includes an integrated MCP server that gives your coding agent the skills it needs to compile your apps and deploy them into your local sandbox. It's on by default, and Desktop detects the agents already on your machine and offers to set them up for you: Claude Code, Codex, Gemini CLI, Antigravity, OpenClaw, Hermes, OpenShell, Kiro, Pi, OpenCode, LM Studio, and Claude Desktop all have an integration of their own, and any other MCP client works the same way.
Open the Builder drawer, describe the app you want, and hand it to your agent.
Whatever the agent builds is deployed into the sandbox, and Cosmonic Desktop hands you back a local URL running your app.
Sandbox the MCP servers too
Your agent drives Desktop, and the MCP servers your agent calls can run inside Desktop, as sandboxed workloads.
A tool server sits at the most exposed point in an agentic system, and installed the ordinary way it inherits ambient authority: whatever your user account can reach, a compromised or simply over-curious server can reach too. Sandboxing the tool enables you to use it easily and securely without sacrificing speed.
On Desktop, an MCP server starts with no outbound network access at all. Every host it may call is allow-listed in its own spec, so exfiltration has nowhere to go. Its image is digest-pinned when you apply it and checked against your signature policy on every start. Its secrets stay references that the host resolves at startup, never plaintext in a config file, and you see all of it before anything runs.
Paste an OCI reference into Start workload and Desktop drafts the spec, then hands it back for review with the exact capabilities and network reach it's asking for. Or browse the Launchpad catalog, which makes it easy to discover useful new MCP tools. Every entry shows its capabilities on the card.
Move quickly with guardrails you can trust
Most everyday isolation tools like containers, bubblewrap, and seccomp run under a model of ambient authority: a program automatically inherits the permissions of whatever launched it (your files, your network, your credentials), and nothing stops it from using them. That's a bad fit for code that an AI agent wrote on the fly, which is exactly what makes agent sandboxing such a hard, important problem.
Cosmonic Desktop starts from the other end of the spectrum. You or your agent writes ordinary code (Rust, Go, JavaScript, Python, and more). Then your code is compiled to a WebAssembly component: a tiny, portable binary that begins with no authority at all. It can't reach the filesystem, the network, the clock, or anything else unless the host explicitly grants it that one capability (say, "make HTTP requests to this host").
Outbound network calls are denied by default, and the host mediates every grant, so sandboxed code reaches nothing until you say so. Better still, a component declares everything it wants from the outside world right in the binary. Open any component in Desktop's Inspect view and that whole picture is laid out for you:
This is the capability-driven security model for the agentic era.
From prompt to production
A component ships as a standard OCI artifact, using the same packaging and registries you already use for container images, and it deploys through Kubernetes-style resources (CRDs), the same kind of declarative manifest you'd use to run anything else on Kubernetes. (Kubernetes isn't required to run your workloads, but this enables you to use the same manifest locally and in production.)
Your sandboxed code moves through your pipeline like any other build. The runtime at the heart of Desktop is the same one that runs on Kubernetes and cloud-native infrastructure you already operate: wasmCloud, the open source platform we contributed to the Cloud Native Computing Foundation (CNCF) and continue to invest in.
Everything you build with Cosmonic Desktop deploys to open-source infrastructure on open standards, starting with the W3C WebAssembly standards, so adopting secure, capability-driven components never locks you into a proprietary platform.
And if you're also running in production, the same components deploy across environments, with policy, rollout, and observability, through Cosmonic Control. The boundary you trusted in development is the boundary that ships to production.
Get started
Cosmonic Desktop is free and in public beta today:
- Download Cosmonic Desktop for macOS, Windows, or Linux. Desktop opens to Workloads; the built-in Academy, under Explore, is the guided path and works offline.
- Build something in the Builder drawer, or launch an app from the Launchpad catalog next to it.
- Read the docs at cosmonic.com/docs/desktop — install guides, every agent we support, and the walkthroughs.
- Tell us what breaks. Beta feedback goes to product.feedback@cosmonic.com.
Cosmonic Desktop has changed the way we work, and we can't wait to see what you do with it.