instavm/coderunner

What it solves

CodeRunner provides a secure, local sandbox environment for AI agents to execute code and perform actions without risking the host system's data or security. It prevents accidental data loss or exfiltration when running agents like Claude Code or other LLM-based assistants that require the ability to run scripts and manipulate files.

How it works

It uses a containerized environment with VM-level isolation (via apple/container) to run a Jupyter kernel and a set of pre-packaged tools. An MCP (Model Context Protocol) server acts as the bridge, allowing AI models to communicate with the sandbox and execute Python code, manage sessions, or use specialized "skills."

Who it’s for

Developers and AI researchers using agentic LLMs (such as Claude Code, OpenAI agents, or Gemini) who want to run generated code locally but safely.

Highlights

• VM-Level Isolation: Uses isolated containers to protect the host system from malicious or buggy agent-generated code.
• MCP Server Integration: Compatible with Claude Desktop, OpenCode, Gemini-CLI, and Kiro by Amazon.
• Persistent Sessions: Supports multiple named Python sessions to keep state isolated between different agents.
• Built-in Skills System: Includes pre-packaged tools for tasks like PDF text replacement and image cropping, with support for custom user-defined skills.
• Network Control: Option to disable outbound network access to prevent data exfiltration.