AI coding agent

Run OpenAI Codex safely on your Mac, in a sandbox VM

Create a MacVisor AI sandbox with --agent codex and the Codex CLI runs with approvals and its own sandbox off, inside a disposable Linux or macOS VM with a copy of your project. Your OpenAI key stays in the Mac's Keychain, and the changes reach your project only when you apply the diff.

Apple Silicon (M1 or later)
macOS 27 on the Mac
An OpenAI key or a local model

Download the free trial Pricing, from $59 once

30 days free, no key or payment details. Apple Silicon with macOS 27.

A stylised MacVisor window with a Linux sandbox running the Codex CLI, its model requests passing through MacVisor's gateway to OpenAI or a local server on the Mac.

The Codex CLI has its own approval prompts and its own sandbox. In a MacVisor sandbox both are off, because the whole VM is the sandbox: Codex can install packages, run builds and edit any file there, and none of it touches your Mac until you apply the diff.

Create the sandbox

mvz ai keys set openai
mvz sandbox create ~/src/app --agent codex --model gpt-5

Or in the app: New AI Sandbox…, then Codex as the agent. Add --os macos for a macOS 27 sandbox.

MacVisor downloads Codex's release binary from GitHub (the Linux or macOS build for Apple Silicon) and writes ~/.codex/config.toml in the VM with:

a macvisor model provider pointing at MacVisor's gateway, on the Responses API;
approval_policy = "never" and sandbox_mode = "danger-full-access";
analytics off, and a web search setting that fits the sandbox's internet access (below).

Run, review and apply

mvz sandbox run app-1 -- "fix the flaky retry test in client_test.go"
mvz sandbox attach app-1                 # Codex, interactively
mvz sandbox diff app-1
mvz sandbox apply app-1

run starts codex exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check on your prompt and streams its output. attach, or Run Agent in the app, opens Codex interactively with the same bypass. --model on run picks another model for one run. A change to AGENTS.md or .codex/ is flagged when you review, because Codex on your Mac reads them.

Models

Model	How to set it up
OpenAI	`mvz ai keys set openai`, then a `gpt-`, `o3`, `o4` or `codex-` model
OpenRouter	`mvz ai keys set openrouter`, then `--model openrouter/<model>`
A local model	A server that speaks the Responses API (Ollama, LM Studio, llama.cpp, oMLX)

Codex speaks only the Responses API. Anthropic doesn't serve it, so Codex can't use Claude models through MacVisor. mvz ai status shows whether your local server speaks it.

Web search

Codex asks OpenAI for live web search, which opens any page from OpenAI's servers, around the sandbox's allow list. So with allowlist and none:

MacVisor sets Codex's web_search to cached, OpenAI's cached search, which can't be pointed at a page.
On an OpenRouter model, which keeps no cache, web search is off.
If a request still asks for live search, the gateway sends it on with the cached search instead.

mvz sandbox run, attach and Run Agent pass the right setting each time, including for a sandbox made with an earlier MacVisor. To allow live search and the provider's other tools for one sandbox, run mvz sandbox set app-1 --provider-tools on. An --egress open sandbox allows them by default.

ChatGPT sign-in instead of a key. Create the sandbox with --egress open, don't store an OpenAI key on the Mac, and sign in inside the VM.

Codex on your Mac instead

To give Codex on the Mac MacVisor's VMs through MCP, run mvz mcp install codex. It adds [mcp_servers.macvisor] to ~/.codex/config.toml, which the Codex CLI, IDE extension and app share. See Connect an agent.

AI sandboxes are a Tech Preview, in every license and the free 30-day trial. The full reference is AI sandboxes.

FAQ

Common questions

More in the documentation and known limitations.

Why does MacVisor turn off Codex's own sandbox?

The VM is the boundary. Inside a MacVisor sandbox, Codex runs with approval_policy never and sandbox_mode danger-full-access, so it can install and run anything in the VM without asking. The VM has no access to your Mac's files or keys, and its changes come back only as a diff you review.

Can Codex use a local model in a MacVisor sandbox?

Yes, if the model server on your Mac speaks OpenAI's Responses API, which Codex needs. Ollama, LM Studio, llama.cpp and oMLX do. A local model whose name starts with gpt-, such as gpt-oss:20b, needs the local/ prefix, or MacVisor sends it to OpenAI.

Can Codex use Claude models through MacVisor?

No. Codex speaks only OpenAI's Responses API, and Anthropic doesn't serve it. Use an OpenAI model, an OpenRouter model, or a local server that speaks the Responses API.

Does Codex web search work in the sandbox?

With the default allow list, Codex uses OpenAI's cached web search, which can't be pointed at a page. Live web search, which can open any page from OpenAI's servers, is turned off unless you allow the provider's tools for that sandbox. On an OpenRouter model, web search is off.

Can I sign in with ChatGPT instead of an API key?

Yes. Create the sandbox with open internet access, don't store an OpenAI key on the Mac, and sign in inside the VM. That sandbox then reaches the internet like any other VM.

Also with MacVisor

AI coding agent Run Claude Code safely on your Mac, in a sandbox VM Claude Code without permission prompts, in a VM that never sees your Anthropic key. AI coding agent Run OpenCode safely on your Mac, in a sandbox VM OpenCode's terminal agent with permissions allowed, sharing and updates off.