AI sandboxes (Tech Preview)

Coding agents such as Claude Code, Codex and Goose work best when they can run commands without asking first. On your Mac that is risky: the agent can read your files and keys, reach your network, and change your code directly.

An AI sandbox gives the agent a VM of its own. It can install and run anything there, and its changes reach your project only after you've reviewed them.

How it works

A sandbox has three parts:

• Your Mac keeps everything that matters: your project, your API keys (in the Keychain) and any local models, running on the Mac's GPU.
• MacVisor sits in the middle. It forwards the agent's model requests to a local model or a cloud provider, adds your API key on the way out, lets the agent reach only the sites you allow, and shows you what the agent changed.
• The sandbox VM (Linux or macOS 27) holds a copy of your project and the agent. It has no access to your files, no keys, and no direct route to the internet, your network or your Mac.

A sandbox goes through five steps:

1. Create. MacVisor makes the VM, copies in your project's current files (without git history or ignored files), installs the agent and points it at MacVisor for models. The sites the installer needs are allowed only while it installs. MacVisor then saves a checkpoint you can always return to.
2. Run. The agent works inside the VM. Its model requests go to the model you chose. Its downloads go through if the site is on the sandbox's allow list.
3. Review. MacVisor collects the changed files and shows you the diff on your Mac, using your own git. Files that could run code later are flagged: scripts, git hooks, CI and build files, and files that configure an AI agent on your Mac (such as .claude/, .mcp.json or AGENTS.md).
4. Apply. You bring the changes into your project, or onto a new branch. Nothing in your project changes before this step.
5. Clean up. Discard the VM, or roll back to a checkpoint and try again.

Quick start

In the app, click New AI Sandbox.... It's the sparkles button beside + in the sidebar, and also sits next to New VM.... Choose the project folder, agent, model and internet access. Terminal opens to show the setup. When it finishes, the sandbox's Overview has buttons to run the agent, review and apply its changes, and take or restore checkpoints.

From the command line:

mvz sandbox create ~/src/app --agent claude --model claude-sonnet-4-5
mvz sandbox run app-1 -- "fix the failing test in parser.swift"
mvz sandbox diff app-1
mvz sandbox apply app-1              # or --branch for a new branch
mvz sandbox discard app-1

A Linux sandbox is ready in about a minute. Add --os macos for a macOS 27 sandbox when the agent needs Xcode or macOS itself. The first one takes longer, because macOS has to be installed.

Choose the top folder of a git repository. A sandbox always gets the whole repository, so if you choose a folder inside a larger one, such as one service in a monorepo, every other file in that repository is copied too. The app then shows the repository's path and asks you to tick Copy the whole repository. mvz sandbox create refuses such a folder unless you add --whole-repo.

Agents

MacVisor installs each agent with its official installer and configures it.

• mvz sandbox run gives the agent a task and streams its output.
• mvz sandbox attach opens the agent interactively.
• mvz sandbox shell opens a shell in the project folder.

Models

The model name decides where a request goes:

• claude-* goes to Anthropic. gpt-*, o3, o4 and codex-* go to OpenAI.
• A prefix picks the provider explicitly: local/, anthropic/, openai/ or openrouter/.
• Any other name goes to the model server on your Mac.

Models on your Mac

MacVisor finds a model server already running on its usual port: Ollama, LM Studio, oMLX, llama.cpp, mlx_lm.server, vLLM or Docker Model Runner. If you run more than one, choose:

mvz ai status --probe              # servers found, and their models
mvz ai local omlx                  # or ollama, lmstudio, llamacpp, a URL, or auto
mvz ai default-model qwen3-coder:30b

If the server needs an API key (oMLX can require one), choose it as above, then store the key with mvz ai keys set local or in Settings → AI → Local Models → API Key. The key stays in the Keychain and is sent only to that server.

No server yet? MacVisor can install and run one:

mvz models                          # coding models, and which fit this Mac
mvz models server install ollama    # or llama.cpp or omlx, installed with Homebrew
mvz models server start ollama
mvz models pull qwen3-coder-30b-a3b

Models run on the Mac, not in the VM. There they get the Mac's full memory and GPU, and one model serves every sandbox. A rough guide for 4-bit models with one or two sandboxes running:

mvz ai status shows the memory left after your VMs and loaded models. mvz sandbox create warns you when a new VM won't fit.

Cloud models

Add a key with mvz ai keys set anthropic (or openai, openrouter), or in Settings → AI. The key stays in the Keychain. MacVisor adds it to each request as it leaves the Mac, so the agent never sees it.

• --no-cloud limits a sandbox to local models.
• To sign in inside the VM with a Claude or ChatGPT subscription instead, create the sandbox with --egress open and don't store that provider's key on the Mac.

mvz ai log <sandbox> lists a sandbox's model requests with the model, time taken and tokens used. Request contents are never logged.

Internet access

With allowlist, the sites the agent's installer and the system's package manager need (GitHub, Anthropic's download servers, the Ubuntu mirrors and so on) are allowed only while create installs the agent. They come off the list before the pristine checkpoint. To install packages later, allow the system's mirrors, for example mvz sandbox allow app-1 ubuntu.

Change the list while the sandbox runs:

mvz sandbox allow app-1 registry.npmjs.org      # a site
mvz sandbox allow app-1 pypi                     # a preset: github, npm, pypi, ubuntu, debian, homebrew...
mvz sandbox deny app-1 registry.npmjs.org
mvz sandbox log app-1 --egress                   # what was allowed and blocked

*.example.com covers every name under it. With allowlist and none, a sandbox can't reach your Mac or your local network, whatever the list says. With open, it reaches them like any other VM. Sandboxes on the allow-list network can reach each other, so don't run two sandboxes you need kept apart at the same time.

These sandboxes run on the host-only network MacVisor Sandboxes, with its firewall denying traffic in and out. If that network was changed (made shared, its firewall turned off, or traffic allowed in or out), mvz sandbox create puts those settings back and tells you. It doesn't make a sandbox while the network's firewall isn't in force, for example when MacVisor's admin helper isn't approved.

A sandbox's own settings can undo its isolation too: its network adapter, shared folders, clipboard and USB devices. Its Settings pages for these warn you, and its Overview shows Not isolated when they no longer match how the sandbox was set up.

Reviewing and applying changes

mvz sandbox diff app-1               # changed files, flags and totals
mvz sandbox diff app-1 --patch       # the full patch
mvz sandbox apply app-1              # into your working tree, all or nothing
mvz sandbox apply app-1 --branch     # onto a new branch, sandbox/app-1

apply brings in exactly the changes diff showed you. If you kept working on the project meanwhile, MacVisor merges the two. On a conflict it refuses and changes nothing. Nothing is staged or committed for you.

Only file contents come back from a sandbox, so nothing the agent ran or set up in its own git can run on your Mac. create copies your project without its history. Add --history if the agent needs the git log.

Checkpoints

A checkpoint saves the whole VM, including what's running. Rolling back takes seconds. Every sandbox gets a checkpoint called pristine right after setup.

mvz sandbox checkpoint app-1 before-refactor
mvz sandbox rollback app-1                # to the latest checkpoint
mvz sandbox rollback app-1 pristine

For agents on your Mac: MCP

mvz mcp serve is an MCP server. It lets an agent on your Mac, such as Claude Desktop or Claude Code, work through sandboxes: run commands, read and write files, review changes, and take and restore checkpoints. In a macOS sandbox it can also take screenshots, click and type. It works only with sandboxes, never with your other VMs. Add --allow-create to let it create sandboxes.

{ "mcpServers": { "macvisor": { "command": "mvz", "args": ["mcp", "serve"] } } }

Limits

• A Mac can run two macOS VMs at a time, so at most two macOS sandboxes. Linux sandboxes have no such limit.
• Run models on the Mac, not in a macOS sandbox. A VM has no access to the Neural Engine and only part of the GPU's features.
• A new macOS sandbox takes a few extra minutes while MacVisor installs its tools after macOS.
• A macOS sandbox has no git until you install the Command Line Tools in it. The project goes in as plain files, and review works as usual.
• Windows VMs can't be sandboxes yet.