Coop

What it does

• A Rust CLI managing disposable VMs where the agent gets full tool access — Docker, git, compilers, package managers — with zero risk to the host machine
• Backends per platform: Firecracker microVMs on Linux, Lima VMs on macOS (Apple Silicon tested), each with its own host requirements
• Shared dotfiles via guest_files and a global post_create hook that preinstalls your tools into every new VM
• Per-agent integrations (Claude Code, Codex, Grok Build), editor integration, multi-instance support, and a documented trust model

When to use it

The setup to reach for when prompt-injection blast radius matters: untrusted repositories, agentic web research, or letting an agent run arbitrary install commands. Complements Claude Code's built-in sandboxing with real VM isolation; the docs include a trust-model page worth reading before you rely on it.

Getting started

curl -fsSL https://raw.githubusercontent.com/trailofbits/coop/main/install.sh | bash

then build the VM template image:

coop setup

On macOS, install Lima first (brew install lima) — setup fails without it; on Linux, coop setup installs Firecracker and fetches a guest kernel. Source builds need Rust + CMake; Nix is supported too. Stay current with coop update.

Things to know

Tested on macOS arm64 and Linux x86_64 only — the README says Linux arm64 builds exist but are untested. A VM is not a policy: whatever the agent touched inside the box still needs review before it reaches your real repositories or cloud. Apache-2.0.