superhq-ai/shuru

What it solves

Shuru provides a secure, isolated environment for AI agents to execute code, install packages, and run tools without risking the host machine's security or stability. It solves the problem of "dirtying" a local system by providing ephemeral, disposable microVMs that reset on every run.

How it works

It boots lightweight Linux VMs using Apple's Virtualization.framework on macOS and a KVM backend on Linux (ARM64). The system uses a tmpfs overlay layer for guest writes to keep the host untouched by default, and supports VirtioFS for directory mounts. It includes a proxy for secrets management, ensuring that real API keys never actually enter the VM guest.

Who it’s for

Developers building AI agents (using tools like Claude Code, Cursor, or Copilot) who need a safe, programmatic way to let their agents execute code in a controlled environment.

Highlights

• Ephemeral Sandboxes: Every run is disposable; the root filesystem resets automatically.
• Checkpoints: Save and reuse disk states to avoid reinstalling dependencies every time.
• Secure Secrets: API keys are substituted by a proxy on HTTPS requests, keeping the real keys on the host.
• Network Control: Fine-grained control over network access, including host-specific allow-lists.
• TypeScript SDK: Programmatic control of sandboxes via a Node.js/Bun package.
• Port Forwarding: Expose guest services to the host via vsock without requiring full network access.