coop CLI
A CLI that creates separate virtual machines for coding agents, keeping their development tools away from the main host system.
- 807 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Inside the VM the agent has broad permissions, and forwarded secrets become available to the guest.
- Files pulled from the VM can contain code that is unsafe to execute on the host without inspection.
Install
- Works in
Manual install
curl -fsSL https://raw.githubusercontent.com/trailofbits/coop/main/install.sh | bashInstalls the prebuilt CLI. Inspect the installer and platform prerequisites first; macOS needs Lima already installed.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Inside the VM the agent has broad permissions, and forwarded secrets become available to the guest.
- Files pulled from the VM can contain code that is unsafe to execute on the host without inspection.
This is third-party code. Review the repository files before installing.
What it does
coop runs Claude Code and Codex in disposable virtual machines. Docker, compilers and package managers are available inside, giving the project a separate environment. Linux uses Firecracker and macOS uses Lima. The CLI first prepares a template image, then creates an instance for the current project and launches the chosen agent. Shared dotfiles and setup commands can be configured separately. Multiple instances separate parallel work.
Who it is for. For developers who want to let an agent build and test inside a separate virtual machine.
Good fit when
- Let an agent install dependencies and invoke compilers in a separate environment.
- Give parallel tasks independent project instances.
- Prepare the same tools for each new VM.
- Test agent workflows with Docker without installing project dependencies on the host.
Not a fit when
- You need a supported Windows environment for this tool.
- The host cannot use virtualization or install the selected VM backend.
- Credentials must never be exposed to the guest, even by explicit choice.
Example request
Prepare a separate coop VM for this project’s tests and show which files and credentials would enter it.Limitations
Tested platforms are Apple Silicon macOS and Linux x86_64; Linux arm64 builds are available but untested. Agents act without their usual approval prompts inside the VM by default; `--ask` restores prompts. Dotfiles and secrets you explicitly forward to the VM are available to the guest agent, so choose them before launch. Code copied back from the VM can be unsafe on the host; inspect the changes before executing it even when guest tests passed.
How to disable. Exit the agent and run `coop stop my-project`, replacing the example with your instance name. Preserve needed results before deleting a VM; they may not yet have been copied to the host.
FAQ
What is coop’s isolation boundary?
The guest from the host. The VM user has passwordless sudo, so the protection depends on the virtual-machine boundary.
Can shared dotfiles be copied?
Yes. `guest_files` supplies files for new VMs. Select only data the guest agent is authorized to see.
How do I configure environment preparation?
Use a global `post_create` command to install the chosen tools when new instances are created.
How is coop updated?
Use `coop update` for installer-based setups. Homebrew installations use `brew upgrade trailofbits/coop/coop`.
Is Grok Build supported?
Yes. Besides Claude Code and Codex, the CLI can launch Grok Build inside a prepared VM.
Discussion
No questions or reviews yet.
Related
CLI toolsCoi is an Incus container CLI that preserves edits on the host under the file owner, even after the environment is removed.
Claude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
VibeKit runs Claude Code, Codex and other CLI agents through a proxy that masks secrets in replies, keeps a log and can hold the agent in Docker
cli sandbox for ai agents without containers or daemons: runs Claude Code, Codex, or OpenCode with restricted access to files, network, and credentials
The safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| coop (this card) | no | 807 | |
| LLM-in-Sandbox | no | 247 | runs an agent loop in a Docker container for the supplied task |
| Coi | no | 777 | A CLI runs a coding agent in a separate Incus system container with root, Docker and configurable access boundaries. |
README in short
Workspace transfers use dedicated synchronization commands. Host-side coop settings can run commands on the host, so inspect what an unfamiliar configuration does before using it.