Capsem Sandboxes AI Coding Agents in Air-Gapped Linux VMs

Summary

Capsem is an open-source security product that runs each AI coding agent session inside a lightweight, air-gapped Linux virtual machine. Its Rust-powered hypervisor uses Apple Virtualization.framework on macOS and KVM on Linux, with a read-only root filesystem, a temporary workspace, no swap, no kernel modules, and no standard services such as SSH or cron. The environment comes preconfigured with Claude Code, Gemini CLI, Codex, MCP tools, Python, Node.js, and more than 30 development packages, and the site says it can boot to a prompt in under 10 seconds. Network access is forced through a host-side man-in-the-middle proxy: Capsem terminates guest TLS with per-domain certificates, inspects HTTP requests and responses, applies domain and method/path rules, and records full bodies in a per-session SQLite database. A native MCP endpoint provides policy-checked access to built-in and custom tools over vsock. Enterprise controls include profile-owned CEL enforcement rules, Sigma-compatible detection rules, and a corporation-level configuration that can lock policies and reporting. Planned features include VM checkpointing, Linux host support, a VS Code extension, and an MCP marketplace. The current packages target macOS 14 or later on Apple Silicon and Debian or Ubuntu Linux with KVM.