apache 2.0macos + linuxgithub.com/tinylabscom/mvm
Run code you can’t fully trust.
A secure execution layer, built security-first for AI agents.
macOS 13+ (libkrun on 13–25, HVF on 26+) or Linux with /dev/kvm.
ai is proliferating. so are exploits.
non-deterministic
LLMs don't do the same thing twice. The creativity that makes agents useful is exactly what makes them dangerous.
hands-off
Teams want to lean on agents harder — and fear what happens when nobody is watching.
exploitable
Exploits and CVEs are growing as fast as the AI that ships the code.
With MVM Security first isn’t a tier, it’s the default.
The contract
the box is table stakes. the contract is the product.
Before anything runs, you declare what’s allowed — what’s in the box, what it can reach, what it can do — and sign it. What runs is what you approved: proof, not hope. Six layers, enforced and witnessed.
01
Signed admission
Nothing boots without a signed, audited ExecutionPlan — validity window, nonce, chain-signed lifecycle.
02
Pinned artifact
What runs is pinned to its exact hash — checked at download and again right before boot, so nothing can be swapped in between.
03
Granted authority
Network access, host services, and credentials must each be spelled out in the signed plan — deny-all by default, raw secrets never in the guest.
04
No bypass path
The guest has no network device. Every byte exits over one vsock channel the host can refuse.
05
Sealed, immutable production behavior
The filesystem is cryptographically sealed — tamper with it and it won't boot. No shell, no terminal, no debug commands: the program you approved is the only thing that can run.
06
Verifiable record
Every admission and policy decision lands in a chain-signed audit log. Tampering breaks the chain.
The operators
control for the people who own the risk.
Visibility and control aren’t just for builders. The contract gives admins and security teams the levers — and the evidence trail underneath them.
turn it off
Workloads run at your pleasure
Start and stop workloads on command. If something violates the contract, kill the box — it's gone.
everything on the record
Logging and traceability underneath it all
Admission, launch, and every policy decision land in a chain-signed audit log. Tampering breaks the chain.
proof on demand
Evidence you can hand to compliance
What ran, and what it was allowed to do — a verifiable record, not a claim. Check it with mvmctl trust audit verify.
Quickstart
file in.
running microVM out.
mvmctl reads the decorator statically, builds a rootfs inside a builder VM, and boots the workload in its own kernel — nothing you run here ever executes on your host.
Read the full quickstart guide1@mvm.app(2 image=mvm.python_image(python="3.12"),3 resources=mvm.resources(cpu=1, memory_mb=256),4 env={"NAME": "danny"},5 before_start="export FOO=1",6)7def main() -> None:8 print(f"hello {os.environ['NAME']}")The boundary
Why A MicroVM
Every mvm workload boots its own guest kernel under a real hypervisor, on its own root filesystem — a hardware-assisted boundary, not a shared one.
- its own Linux kernel — booted fresh, under a real hypervisor
- its own root filesystem — not a view onto the host's
- no network device — on any backend — HVF, libkrun, Firecracker
- one channel out — vsock, deny-all until policy admits it
Performance
measured, not asserted.
The dispatch window — an admitted execution plan to the guest command running. The arc is the budget CI enforces on every launch; the fill is what one named host actually did, revalidated sample by sample before it was allowed onto the page.
p50
86% of ceiling171.5ms
ceiling 200 ms
p95
70% of ceiling176.0ms
ceiling 250 ms
p99
59% of ceiling178.0ms
ceiling 300 ms
- lane
- prepared_cold
- backend
- Firecracker v1.14.1
- host
- Linux 6.8.0-137 x86_64, Intel i7-7700
- storage
- rotational md-RAID (ROTA=1)
- samples
- 20 (+2 warm-ups)
- date
- 2026-08-19
Measured on spinning media, where a large fixed fraction of the window is fsync cost that disappears on NVMe — so this is a pessimistic reading, not a favourable one. Budgets, disqualification rules, and the raw report digest are on the launch performance page.
Deployment
one contract. four places to run it.
01 / Local
Local Development
libkrun/HVF-backed VMs on your macOS or Linux machine. Same workload contract.
02 / Hosted
Design partnersHosted Standard
Firecracker on Linux/KVM fleet infrastructure. High-density, short-lived workloads.
03 / Edge
RoadmapEdge & Private
Your VPC or your metal. The same signed contract, forward-deployed into your infrastructure.
04 / Confidential
RoadmapHosted Confidential
AMD SEV-SNP and Intel TDX. Hardware attestation is out of scope of today's shipped runtime.
Local runs today with the open-source CLI. Tier status is tracked on the capability status page; what’s enforced right now — with named test witnesses — is in the CI-enforced claims.
Backends
the backend is an implementation detail.
The same signed image, decorated execution plan, policy bundle, and audit chain runs across every backend MVM supports.
Linux / KVM
Firecracker
macOS 13–25
libkrun
macOS 26+
HVF
Dev / test
QEMU
Shipped, preview, and roadmap capabilities are tracked on the capability status page.
Questions worth asking
faq
Why not just use a container?
A container is namespaces and cgroups around processes that still call straight into the host kernel — one kernel, shared by everything on the box. Every mvm workload boots its own Linux kernel under a real hypervisor, with no guest network device on any backend. The isolation is hardware-assisted, not namespace-assisted.
Which languages are supported?
The CLI (mvmctl) drives any workload from a shell. The decorator SDK, for declaring workloads in source, is available for Python and TypeScript. The runtime SDK, for driving a sandbox imperatively, is partial in Python and TypeScript today; a Rust lifecycle client is planned, not shipped.
Is it open source?
Yes — Apache-2.0, source at github.com/tinylabscom/mvm.
What does it run on?
macOS 13–25 on libkrun, macOS 26+ Apple Silicon on the in-house HVF backend, and Linux with /dev/kvm on Firecracker. mvmctl reads your OS, chip, and macOS version and picks one for you.
What is the security posture?
Fifteen-plus numbered claims, each backed by a named test or CI job — not adjectives in a doc. The host itself is trusted; a malicious host, mutually distrusting guests in one VM, and hardware key attestation are explicitly out of scope.
Request access
run the workload. isolate the tenant. enforce the policy. audit the execution.
Working with a small group of design partners building agent platforms, code interpreters, secure workflow runners, multi-tenant SaaS, and edge AI workloads.
ai may never be fully predictable. its boundaries should be.
That’s mvm. One install command. No daemon, no SSH, and no network until policy admits it.