fcvm MCP server

fcvm: disposable, isolated microVMs with container ergonomics, for people and agents

fcvm runs workloads in Firecracker microVMs, each with its own kernel, with the convenience of a container tool: images, layers, volumes, published ports, exec, snapshots and fork. It is self-hosted, starts VMs without root, and puts a real virtual-machine boundary around code you don't trust. On top of that come optional jailing, network isolation and egress allowlists. Drive it from the command line, a browser console, an HTTP API, or your coding agent over MCP.

fcvm import python:3.13-slim
fcvm run python-3.13-slim --allow @pypi -- pip install requests   # a throwaway VM that can reach only PyPI

Why fcvm

Containers are convenient but share the host's kernel. Full VMs isolate properly but are slow to start and clumsy to manage. fcvm gives you both: Docker-style workflows, where every workload boots its own kernel in about half a second behind hardware virtualization.

It's built for:

run commands, copy files and fork prepared environments. Each sandbox is jailed and network-restricted by the policy you set.

• Sandboxes for AI coding agents. Agents get tools to create sandboxes,

downloaded tool, a build from someone else's repository.

• Running code you don't trust. A dependency's install script, a

identical running copies in about 150 ms each.

• Throwaway and parallel environments. Prepare once, snapshot, then fork

source tree mounted live, or containers that stay up across crashes and reboots.

• Dev machines and small services. Full Ubuntu VMs with systemd and your

What it isn't: a cluster orchestrator, a macOS or Windows tool (it needs Linux with KVM), or a way to run desktop GUIs.

What it can do

or your own Dockerfile. Or use full-OS system images that boot systemd, with Ubuntu 26.04 included.

• Any image. Run OCI images from any registry, a local docker save,

named volumes, live host directories, commit to layered images, restart policies, and templates: saved launch recipes such as "Python sandbox, PyPI only, 2 GB".

• Container ergonomics. run, exec, cp, logs, published ports,

from a snapshot takes about 150 ms.

• Speed. A new VM takes 0.1 s to create and about 0.5 s to boot. A fork

(separate uid, chroot, cgroups, network namespace).

• Isolation.
• A VM boundary per workload, with an optional Firecracker jailer

pins each VM to its own address.

• VMs can't reach each other or your host's services, and anti-spoofing

from the host and from inside the guest, with its processes and 24 h of history;

• Egress allowlists through a logging proxy.
• A web console. A cloud-console-like GUI for your host:
• a live dashboard, and per-VM charts for CPU, memory, disk and network,

• launch forms, browser terminals and a file browser with an editor;
• image imports and Dockerfile builds;
• snapshots and forks.

Anything you can do from the CLI, you can do from the browser.

clients, an MCP server for agents, and a Prometheus endpoint.

• Other ways in. The CLI, an HTTP API for scripts with Python and Node

reboots.

• Stays up. A boot-time service brings VMs back after crashes and

init in C, and a guest kernel you build yourself from kernel.org sources.

• Small and auditable. Bash and standard-library Python, a small static

Requirements

Shortened. The full README is on GitHub.