Every command your agent runs is recorded, snapshotted, and restorable. Hardware-isolated Firecracker microVMs by default — or a local backend with the same rewind/diff workflow on machines that can't run one, including macOS.
Record every command. Snapshot VM state after each one. Rewind to any step — memory, variables, and filesystem restore instantly. Not a re-run: an actual restore from a Firecracker snapshot.
from bunkervm import Sandbox with Sandbox(record=True) as sb: sb.run("x = 1") sb.run("x = x + 10") sb.run("x = x * 100") sb.run("print(x)") # 1100 sb.restore(2) # ⏳ rewind to step 2 sb.run("print(x)") # 11
Every command, its output, and a filesystem trace — captured automatically with record=True.
Rewind to any step. Real Firecracker snapshot restore, not a replay — memory and filesystem included.
bunkervm diff session-a session-b — see exactly where two agent runs diverged.
bunkervm compare a b c — rank several agent runs by outcome, risk, and time. No judge model, just what actually happened. See a real example →
Firecracker needs KVM — Linux natively, Windows via WSL2. macOS can't run it at all. The local backend trades isolation for reach: same record/rewind/diff workflow, zero setup, anywhere Python runs.
Never chosen automatically — you ask for it (backend="local", --local), and BunkerVM tells you which one is active every time.
Your AI talks to BunkerVM over MCP. BunkerVM boots a Firecracker MicroVM and relays commands over vsock. The agent never touches your host.
Claude, GPT, LangGraph
Host process
Alpine Linux sandbox
Eight MCP tools give full Linux environment access — including file transfer between host and VM. All commands run inside the VM — never on your host.
Run any shell command — Python, bash, curl, whatever the agent needs.
Create or overwrite files inside the VM filesystem.
Read file contents back from the VM to the agent.
Browse the VM directory tree.
Check VM health — CPU, RAM, disk, uptime.
Upload files from your host into the VM.
Download files from the VM back to host.
Wipe everything. Clean slate in seconds.
Containers share your kernel. A VM escape is orders of magnitude harder than a container escape.
Every line of code Copilot runs — hardware-isolated. No extensions to install. No WSL commands to learn.
Works on Windows, Linux, and WSL. On Windows, vscode-setup auto-installs BunkerVM inside WSL for you.
$ pip install bunkervm $ bunkervm vscode-setup Platform: Windows + WSL2 (Ubuntu) ✓ BunkerVM in WSL: ready ✓ Created .vscode/mcp.json Reload VS Code → Open Copilot Chat → Done.
Windows users: Just run these in PowerShell. vscode-setup creates an isolated Python venv inside WSL, installs BunkerVM there, and generates the config. You never touch WSL directly.
See it in action:
Want internet inside the VM? One command:
Copilot Chat gets 8 sandboxed tools:
Add this to your config file. On first run, BunkerVM downloads the micro-OS automatically.
{
"mcpServers": {
"bunkervm": {
"command": "wsl",
"args": ["-d", "Ubuntu",
"--", "bunkervm",
"server"]
}
}
}
{
"mcpServers": {
"bunkervm": {
"command": "bunkervm",
"args": ["server"]
}
}
}
Full MCP support for any compatible client, plus lightweight single-tool adapters for LangChain and the OpenAI Agents SDK — no separate toolkit to learn.
It works, but it's early.
pip install bunkervm