Private beta · Linux + WSL2

Run untrusted AI agents safely on any computer.

Portable sandboxes with enforceable permissions. Every agent gets its own microVM and a policy you control.

Linux and Windows (WSL2) today; macOS planned

One microVM per agent.

Its own kernel, your directory mounted in. Snapshot, pause and resume with memory, disk and processes.

$ smx create -c sandbox.yaml
$ smx agent run <name> \
    --harness claude "prompt"

sandboxesillustrative

Sandbox	State	Harness	Policy	Denials
api-refactor	running	opencode	acme-api	1
docs-sweep	running	claude	docs-ro	0
migrate-tests	paused	codex	acme-api	0
triage-bot	snapshot	opencode	read-only	0

The agent asks. The policy decides.

Short YAML you review like code, enforced by the gateway outside the agent.

$ git push origin main
remote: vc-serve: push refused
 ! [remote rejected] main

git policyyaml

github:acme/api: read: true push: {branches: ["agent/**"]}

push to mainblocked

filesystem policyyaml

fs: allow: [rw:~/app=/workspace/app] deny: [~/app/.env]

secret accessblocked

Credentials stay on the host.

Git tokens and SSH keys never enter the sandbox. The gateway uses them on the agent's behalf, only where policy allows.

$ cat /workspace/app/.env
cat: /workspace/app/.env: Permission denied

credentials · api-refactorillustrative

Credential	Held by	Inside sandbox	Used for
Git token	host gateway	no	github:acme/api · agent/**
SSH key	host gateway	no	allowed hosts, commands
~/app/.env	your disk	no	fs deny

Every refusal, on the record.

Every refusal is recorded in the agent log; one command streams it.

$ smx agent logs <run-id> -f

denials.jsonljsonl

{"op":"read","path":"/workspace/app/.env","reason":"denied by fs policy"}

smx agent logs <run-id>recorded

Bring your harness.

Run the agent you already use. The policy applies the same way to each one.

Claude Code

Codex

OpenCode

Your harness

Security

Sandbox isolation isn't enough.
We govern what agents do.

microVM · api-refactorown kernel
egress rules
no credentials

microVM · docs-sweepown kernel
egress rules
no credentials

Isolation

Each agent runs in its own microVM, from a laptop to a fleet you own.

Request	Decision
read /workspace/app/src	allow
push agent/fix-auth	allow
push main	deny
read /workspace/app/.env	deny

Permissions

Files, Git and SSH, decided per agent and enforced outside it.

runningsnapshotpausedresumed

memory · disk · processessmx snapshot

Snapshots

Pause and resume with full state. Restore it on another machine.

{"op":"read","path":"/workspace/app/.env","reason":"denied by fs policy"}

$ smx agent logs <run-id>recorded

Audit log

Tamper-evident. Ship denials anywhere.

Illustrative previews

Compare

Isolation plus governance.

Pick a capability to see who covers it.

File, Git, SSH permissions

Directories, repos and branches, hosts and commands, decided per agent.

Public docs, Oct 2026. Partial and limited are shown as half bars. See every column →

Give your next agent a microVM and a policy.

Private beta. smx runs on Linux and Windows (WSL2) today; macOS planned.

Get started → Docs

$ smx create -c sandbox.yaml $ smx agent run <name> --harness claude "prompt"