A self-hosted sandbox that boots a real virtual machine for AI agents. Hardware-isolated by Firecracker. No containers. No cloud.
Your AI talks to NervOS over MCP. NervOS boots a Firecracker MicroVM and relays commands over vsock. The agent never touches your host.
Claude, GPT, LangGraph
Host process
Alpine Linux sandbox
Six MCP tools give full Linux environment access. All commands run inside the VM — never on your host.
Run any shell command — Python, bash, curl, whatever the agent needs.
Create or overwrite files inside the VM filesystem.
Read file contents back from the VM to the agent.
Browse the VM directory tree.
Check VM health — CPU, RAM, disk, uptime.
Wipe everything. Clean slate in seconds.
Containers share your kernel. A VM escape is orders of magnitude harder than a container escape.
Add this to your config file. On first run, NervOS downloads the micro-OS automatically.
{
"mcpServers": {
"nervos": {
"command": "wsl",
"args": ["-d", "Ubuntu",
"--", "sudo",
"python3", "-m",
"nervos_server"]
}
}
}
{
"mcpServers": {
"nervos": {
"command": "sudo",
"args": ["python3",
"-m",
"nervos_server"]
}
}
}
NervOS speaks the Model Context Protocol.
This is v0.1.0. It works, but it's early.
One command to install. One config to connect.