jingkaihe/matchlock

What it solves

Matchlock addresses the security risks associated with allowing AI agents to execute code on a local machine. It provides a secure, isolated environment where agents can install packages, write files, and run commands without risking the host system's integrity or leaking sensitive API keys.

How it works

Matchlock launches AI agents inside ephemeral microVMs (using Firecracker on Linux or Virtualization.framework on macOS) that boot in under a second. It employs several security layers:

• Network Isolation: It implements network allowlisting, blocking all traffic except to explicitly permitted hosts.
• Secret Injection: Instead of passing API keys into the VM, Matchlock uses a MITM proxy to inject credentials in-flight. The agent only sees a placeholder, so keys never actually enter the sandbox.
• Storage Isolation: It uses volume overlay mounts and FUSE for isolated snapshots that vanish after the session.
• SDKs: It provides Go, Python, and TypeScript SDKs to programmatically manage VM lifecycles, execute commands, and stream output.

Who it’s for

Developers building AI agents that require a full Linux environment to perform tasks, run code, or interact with external APIs securely.

Highlights

• Fast Boot: MicroVMs start in less than a second.
• Zero-Leak Secrets: API keys are injected via proxy, ensuring they never reside within the guest VM.
• Symmetric Experience: Consistent CLI behavior across Linux and macOS (Apple Silicon).
• Flexible Networking: Supports full offline mode, specific host allowlists, and network interception hooks for mutating requests and responses.
• OCI Compatible: Works with any OCI image (e.g., Alpine, Ubuntu).