superhq-ai/shuru

What it solves

Shuru provides a secure, local-first microVM sandbox for AI agents to execute code, install packages, and run tools. It prevents agents from accidentally or intentionally damaging the host system by providing an ephemeral, disposable environment that resets on every run.

How it works

It boots lightweight Linux VMs using Apple's Virtualization.framework on macOS and a KVM backend on Linux ARM64. The system uses a tmpfs overlay layer for guest writes to keep the host filesystem untouched by default, and supports VirtioFS for directory mounts. It includes a proxy for secrets management, where real API keys are substituted only during HTTPS requests to specific hosts, ensuring keys never actually enter the VM.

Who it’s for

Developers building AI agents (using tools like Claude Code, Cursor, or Copilot) who need a safe, isolated environment for their agents to perform system-level tasks without risking the host machine.

Highlights

• Ephemeral Sandboxing: Rootfs resets on every run for a clean state.
• Checkpoints: Save and reuse disk state across different runs.
• Secure Secret Injection: API keys are substituted via proxy so they never enter the VM.
• Network Control: Fine-grained control over network access and allowed hosts.
• TypeScript SDK: Programmatic control of sandboxes via a dedicated package.
• Agent Skill: Ships as an agent skill for automatic integration with AI agents.