hyperlight-unikraft: Python in a micro-VM for an AI agent
hyperlight-unikraft
The agent runs Python in a local Hyperlight micro-VM with its own kernel: no network or host files, state kept between calls
- 50 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The agent executes arbitrary Python code, and the hluk-arg option can mount host directories or open the network, which weakens isolation
- hluk is installed with a script from the repository through curl, so review the script before running it
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/hyperlight-unikraftDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent executes arbitrary Python code, and the hluk-arg option can mount host directories or open the network, which weakens isolation
- hluk is installed with a script from the repository through curl, so review the script before running it
This is third-party code. Review the repository files before installing.
What it does
The repository ships the hluk CLI and a Rust library: they load the Unikraft kernel into a Hyperlight micro-VM, mount an image with the userland and run a program behind a default-deny host boundary. The filesystem and network open only through flags such as mount and net, and a warmed guest is saved as a snapshot so the next start takes milliseconds. Templates cover Python, Node.js, Bash, C#, Java, Go, Rust and more. The agent connects to mcp-server-hyperlight from the integrations/mcp folder, published on PyPI. The run_python tool executes Python 3.12 and keeps variables and imports between calls, as in a notebook. The reset_sandbox tool replaces the guest with a fresh one from the snapshot in about 60 ms on Linux with KVM. A call that runs longer than 30 seconds is stopped and the guest is replaced.
Who it is for. Agent developers and Claude Code and Cursor users who need to run model-generated Python code in isolation on their own machine
Good fit when
- The agent crunches data or tests an algorithm in Python, and running untrusted code on the host is unwanted
- Variables and imports have to survive between calls, as in a Jupyter notebook
- Cloud sandboxes do not fit because of an account, an API key or sending code off the machine
- Packages such as sympy or pandas are needed and the guest may reach only specific hosts
- You want a fast start: the guest comes up from a snapshot in about 40 ms on Linux with KVM
Not a fit when
- The code is in another language: the MCP server runs only Python, other languages go through the hluk CLI
- There is no hypervisor: KVM or MSHV on Linux, WHP on Windows or HVF on Apple silicon Macs is required
- The task needs parallel computation: the guest has one virtual CPU
- The result must be an image: the server returns text only, and an image comes back as its repr
Example request
Run Python in the sandbox, compute the median and spread of this array of numbers and keep the variables in memory for the next step.MCP
- Transport
- stdio
- Authentication
- not required
Environment variables
HLUK_INSTALL_DIR- The folder where hluk is installed, for clients that start the server with another PATH
Limitations
The server runs only Python and returns only text. Packages installed by the code itself with pip are gone after a reset, while those passed with the package flag are installed again. The guest has one virtual CPU and threads take turns. The first start downloads an image of about 400 MB and saves a snapshot of about 800 MB, which takes from seconds to a few minutes. CI tests the server on Linux and Windows, and it is not yet tested on Apple silicon Macs. The last commit was made on November 6, 2026.
How to disable. Run claude mcp remove hyperlight. Downloaded images and guest snapshots sit in the hluk folders; delete them by hand to free disk space.
FAQ
Does the code see host files and the network?
Not by default. Directories and the network open only through flags, such as hluk-arg for mounts and net-allow for hosts.
Do I need an account or an API key?
No. The server runs locally, and code and data stay on the machine.
What do I need to install besides the server?
The hluk CLI version 0.18.0 or newer and the uv manager for uvx. A hardware hypervisor: KVM or MSHV on Linux, WHP on Windows, HVF on Apple silicon Macs.
What happens when the code fails or hangs?
An error returns as a traceback in the form of a tool error. A call longer than 30 seconds is stopped, the guest is replaced and the model is told the variables are gone.
What licence is the project under?
Apache 2.0; the project belongs to the CNCF sandbox Hyperlight.
Discussion
No questions or reviews yet.
Related
MCP serversA fast MCP server in Rust extended with WebAssembly plugins: plugins load from OCI, files, http(s) and s3, and OCI signatures can be verified
A Python terminal coding agent in the manner of Claude Code: reads the repository, edits files, runs commands, with memory, sub-agents and MCP
A coding agent for the terminal, browser and CI across 38 model providers, with cross-session memory, MCP, skills and hooks.
A coding agent with a Python core and three front-ends: a script CLI, a terminal TUI and an Electron app, for OpenAI-style APIs
A local code graph with version history: an MCP server that tells the agent who calls a function and what an edit breaks
A Rust MCP server where the agent runs JavaScript and TypeScript in a V8 sandbox with one run_js tool and state kept between calls
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| hyperlight-unikraft: Python in a micro-VM for an AI agent (this card) | yes | not required | 50 | |
| LLM Sandbox MCP | no | not required | 1,143 | isolation on Docker containers, while this uses a micro-VM with its own kernel and snapshots |
| sandbox-mcp | no | 422 | a general sandbox server, while this adds hardware isolation and state kept between calls |
README in short
The README covers the hluk CLI, project templates, the hluk.toml manifest, warm guest snapshots and the four steps of operation: load, boot, sandbox, snapshot. A separate section lists integrations with smolagents, MCP, verl, the OpenAI Agents SDK and ClickHouse, and the integrations/mcp folder holds the docs of the server itself.