fcvm

io.github.carlosbravoaPublished by GitHub account carlosbravoav0.7.0Updated Oct 24, 2026

Disposable Firecracker microVM sandboxes for agents: run code, snapshot, fork. Needs Linux with KVM.

VerifiedSTDIODesktop onlyCloud & InfrastructureDeveloper Tools

Overview

AI-generated overview

Launches fcvm so an AI assistant can create disposable Firecracker microVM sandboxes to run commands, edit files, build images and fork snapshots.

What you can do
Run commands inside disposable microVM sandboxes and read or write files there, each sandbox booting its own kernel from an OCI image in about a second. Build images and commit prepared sandbox states. Snapshot a running VM and fork copies of it in roughly 150 ms. Control network access per sandbox: off, full, or an allowlist of hosts enforced by a logging proxy.
When to use it
Useful when an assistant needs to execute untrusted or experimental code on a Linux machine without touching the host, and when you want to branch from a prepared VM state quickly instead of rebuilding environments.
Requirements
A Linux host with KVM; the fcvm binary must be installed and set up separately, then found on PATH, in ~/.local/bin or /usr/local/bin, or pointed to with FCVM_BIN. The launcher runs via uvx from the fcvm-mcp PyPI package, so Python tooling is needed. Optional settings are environment variables such as FCVM_MCP_NETWORK, FCVM_MCP_TEMPLATE, FCVM_MCP_TTL, FCVM_MCP_IDLE_STOP, FCVM_MCP_SECRETS, FCVM_MCP_FORWARD, FCVM_MCP_CACHE and FCVM_MCP_JAIL.
Before you install
Sandboxes run code the assistant writes, so network policy matters: default to none or an allowlist via FCVM_MCP_NETWORK. FCVM_MCP_SECRETS and FCVM_MCP_FORWARD pass host credentials such as ssh-agent, git or named tokens into every sandbox; only enable them when needed. Sandboxes can write files and build images, and forgotten ones consume resources unless FCVM_MCP_TTL and FCVM_MCP_IDLE_STOP are set.

Installation

In SourceWeft

  1. Open fcvm in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

fcvm-mcp

Starts the MCP server of fcvm, which gives an AI agent disposable Firecracker microVMs as sandboxes. Each sandbox boots its own kernel in about a second from any OCI image. The agent gets tools to run commands, read and write files, build images, commit prepared states, and snapshot a VM to fork running copies in about 150 ms. Network access is off, full, or an allowlist of hosts enforced by a logging proxy.

This package is only a launcher: it finds the installed fcvm and runs fcvm mcp. fcvm itself needs a Linux host with KVM:

sh
curl -fsSL https://raw.githubusercontent.com/carlosbravoa/fcvm/main/install.sh | shfcvm setup

Then register the server with your MCP client. With Claude Code:

sh
claude mcp add fcvm -- uvx fcvm-mcpclaude mcp add fcvm -e FCVM_MCP_NETWORK=@pypi,@github -- uvx fcvm-mcp   # agents can only reach PyPI and GitHub

In a client's JSON configuration:

json
{"mcpServers": {"fcvm": {"command": "uvx", "args": ["fcvm-mcp"]}}}

The launcher looks for fcvm on PATH, then in ~/.local/bin and /usr/local/bin. Set FCVM_BIN to use another one. Running fcvm mcp directly works the same way and needs no Python package.

Settings are environment variables: FCVM_MCP_NETWORK pins the network policy, FCVM_MCP_TEMPLATE picks the default template, FCVM_MCP_TTL and FCVM_MCP_IDLE_STOP stop forgotten sandboxes, FCVM_MCP_SECRETS and FCVM_MCP_FORWARD hand credentials to sandboxes without the agent seeing them. The agents guide covers the tools and every setting.

Apache License 2.0.

Source: sdk/mcp/README.md at commit 82d29c2

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.7.0LatestOct 12, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts