agentkernel CLI
CLI that runs commands and AI agents in isolated microVMs that boot in under 125 ms and keeps API keys out of the sandbox itself.
- 62 ★ on the repository
- Last commit
Broad access
Why this level
- Creates sandboxes and runs arbitrary code in them, and the `permissive` profile mounts the home directory.
- Keeps secrets in a vault and injects them into network requests.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/agentkernelDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Creates sandboxes and runs arbitrary code in them, and the `permissive` profile mounts the home directory.
- Keeps secrets in a vault and injects them into network requests.
This is third-party code. Review the repository files before installing.
What it does
agentkernel runs code in a sandbox: `agentkernel run npm test` creates a temporary environment, executes the command and removes it. The image is picked from the command or project files: `node` for `package.json`, `rust` for `Cargo.toml`. Linux uses Firecracker microVMs that boot in under 125 ms, macOS uses Apple Containers, Docker or Podman. There are persistent sandboxes, templates, snapshots and sessions with Claude, Codex, Gemini and OpenCode agents. The `permissive`, `moderate` and `restrictive` profiles set network, mounts and write access. API keys never enter the sandbox: a host-side proxy injects them into requests to a given domain and blocks other hosts. It can be driven through an HTTP API and SDKs, and a plugin exists for Claude Code.
Who it is for. Developers who run agent code and untrusted dependencies and want hardware isolation instead of a plain container.
Good fit when
- An agent will run `npm install` and tests of a repository you do not trust.
- You need an environment with no network and a read-only file system: the `restrictive` profile.
- An OpenAI key must reach only `api.openai.com` without being placed in the sandbox.
- Each git branch needs its own persistent sandbox created with `--branch`.
Not a fit when
- You need simple isolation without KVM: full Firecracker microVMs require Linux with KVM.
- Plain Docker without extra setup is enough.
- You need a mature product with a stable interface: the plugin version is 0.1.0.
Example request
Run this repository tests through `agentkernel run --profile restrictive npm test` and show that the network was unavailable.Limitations
Firecracker and Hyperlight need KVM, meaning Linux, and full Firecracker state saving needs exactly version 1.16.1 on a compatible x86_64 host. macOS uses Apple Containers on macOS 26 or Docker and Podman with about 220–300 ms latency, not microVMs. The default `moderate` profile leaves the network on. `agentkernel setup` must be run to download components. Installing through `curl | sh` means reading the script first, and the HTTP API needs protection if exposed.
How to disable. Stop and remove sandboxes with `agentkernel sandbox` commands and remove the package: `brew uninstall agentkernel` or `cargo uninstall agentkernel`. The Claude Code plugin is removed with the standard plugin command.
FAQ
How do I run a command in a sandbox?
Run `agentkernel run <command>`, for example `agentkernel run pytest`. The environment exists for the run and is removed, and `--keep` leaves it for debugging.
How do I hide a key from the agent?
Create a sandbox with `--secret OPENAI_API_KEY:api.openai.com`. A placeholder stays inside while the host proxy injects the real key, for that domain only.
How do the security profiles differ?
`permissive` enables network, mounts and environment passthrough, `moderate` keeps the network without mounts, and `restrictive` disables the network and makes the file system read-only.
Where do microVMs work?
Firecracker works on Linux x86_64 and aarch64 with KVM. macOS 26 on Apple Silicon has Apple Containers, and other Macs use Docker and Podman.
Which agents are supported?
Claude Code, Gemini, Codex and OpenCode: the preferred agent is set with `preferred`, and a session starts with `agentkernel session start --agent claude`.
Discussion
No questions or reviews yet.
Related
CLI toolsBrig runs Claude Code and other coding agents inside an isolated microVM on your machine with access to one project only.
Nehemiah gives agents Firecracker Linux microVMs over MCP: launch, run commands, preview URLs, fork and templates.
A Docker sandbox for coding agents: a Debian image with Copilot CLI, Codex and Pi, and SSH, RDP and Docker enabled by flags.
Containarium: isolated boxes for AI agents
Containarium
A platform on your own server that gives each agent its own Linux box with SSH and MCP tools for commands and files
AgentBox runs Claude Code, Codex and Open Code in separate virtual machines on your PC, a self-hosted server or a cloud.
A CLI that runs Claude Code and Codex in isolated Docker containers with a firewall, worktrees and a no-Dockerfile image.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| agentkernel (this card) | no | 62 | ||
| yoloAI | no | 255 | a sandbox with a project copy and changes applied after a diff; agentkernel isolates in microVMs and injects keys at the network layer | |
| Agent-Sandbox | no | key is optional | 232 | a Kubernetes agent sandbox with an API and E2B compatibility; agentkernel works locally on a single machine |
README in short
The document gives three install options and a quick start, then covers the `run` command, environment detection, persistent sandboxes, profiles, SSH, templates, snapshots, secret isolation, the HTTP API and SDKs.