Capsem: Open-Source Rust Hypervisor Sandboxes AI Coding Agents in Air-Gapped VMs

Capsem is an open-source, Rust-powered hypervisor designed to securely sandbox AI coding agents by running each session in its own air-gapped Linux VM. The tool supports major agents including Claude Code, Gemini CLI, and Codex, providing a pre-configured environment with Python, Node.js, and over 30 packages that boots in under 10 seconds.

Security and Isolation

The system uses Apple Virtualization.framework on macOS and KVM on Linux to create lightweight, ephemeral VMs with a read-only rootfs and no kernel modules. Networking is strictly air-gapped; all traffic is forced through a host-side MITM proxy that terminates TLS using per-domain minted certificates. This allows for deep inspection of HTTP requests and responses, which are logged to a per-session SQLite database for post-hoc analysis.

Policy and Control

Capsem offers enterprise-grade control through profile and corporate configuration layers. Users can define CEL enforcement rules and import/export Sigma detection rules to manage allowed domains and HTTP methods. Corporate-level configs can lock down policies and reporting, preventing users from bypassing security constraints. The architecture includes a native MCP endpoint for policy-checked tool access over vsock.