Use case

Coding agents

Let Claude Code, Codex or OpenCode work on your repository without giving it your machine. Each run gets its own microVM, and the agent can push only to the branches you allow.

Run an agent in a sandbox

Create a sandbox, then run the harness in it and stream its events back:

$ smx create --session dev $ smx agent run dev --harness claude "fix the failing test" $ smx agent logs <run-id> -f

--harness takes claude, codex, opencode, hermes or shell. The sandbox is kept between turns, so the harness continues its own session.

Network: model hosts only

A new sandbox starts on the offline profile plus DNS and its harness's model hosts. Everything else is refused and listed at the end of the run. Add hosts with --allow api.example.com:tcp/443, or pick another profile with --security-profile.

Push to agent/** only

A Git policy says what the sandbox may do per repository. Here it may read the local repo and push only to agent/** branches:

# git-policy.yaml providers: here: {kind: local} repos: "here:.": {read: true, push: {branches: ["agent/**"]}}
$ smx vc policy set api-agent git-policy.yaml $ smx create --session fix1 --security-profile offline --git-policy api-agent --repo ~/src/api $ smx vc log fix1 # every git operation and refusal

Plain git works unchanged in the guest; the gateway inspects every push before forwarding it. Whatever the policy says, a protected or default branch is never pushed, and CI files such as .github/** need an explicit allow.

Credentials stay on the host

Git tokens and model sign-ins stay on your machine. When the policy allows a push, the host performs it; the token never enters the sandbox. Every turn lands in a hash-chained log; read it with smx agent logs.