I built this because even if agents are smart enough not to do destructive commands, they can still ruin the project like deleting project files, botched migrations, etc. The VM can be snapshotted, rolled back, and forked. Claude Code and Codex CLI have built-in launchers that run them inside the VM in bypass-permissions mode. I chose this because frontier models nowadays rarely execute (but sometimes still do) bad commands that put your personal files at risk. The Linux VM also add an additional safety layer/sandbox for your agent. Files live inside the VM by default. If you want a copy of the files, you can do so in cave.toml and push the code to the VM via cave push. Any other agent or tool works through cave shell or cave exec, and there's an MCP server (exec, snapshot, restore, fork) if you want the agent on your Mac. It's a VMM written in Rust directly on Hypervisor.framework, inspired by AWS’ Firecracker, with a minimal virtio device model, direct kernel boot and copy-on-write snapshots. I deliberately didn't use Virtualization.framework, because its memory save/restore is too slow for this. A daemon supervises one VMM process per VM, and a small guest agent handles exec, shells, files and port forwarding over vsock. Coding agents wrote a lot of cave under my review (thank you Opus 5.5) but the concept, choice, and direction are all by me. I’d love feedback, especially on what breaks on your machine and what you think we should add! Thank you!

cave-vm

A fast, lightweight Linux VM for every project

A fast, lightweight Linux VM for every project