kosa8

kosa8 plugin for Claude Code

[kosa8]

kosa8: Secure infrastructure for AI agents.

Give Claude a sealed machine to work in. This plugin connects Claude Code to kosa8, secure infrastructure for AI agents: every agent gets its own sealed machine, a real microVM with its own kernel, not a container sharing the host's kernel.

With the plugin enabled, Claude can:

• run untrusted or agent-written code in a sealed microVM that sees one folder (the workspace) and nothing else on the host;
• work behind a closed network, where only hosts on an allow-list you write are reachable and anything else gets a refused connection;
• use API keys without holding them: an egress broker on the host injects them on the way out, and the sandbox holds only a placeholder;
• checkpoint the whole running machine, memory and processes, in about 0.7 seconds before a risky step, and rewind it, still running, in about a second when something goes wrong;
• fork a running machine into live copies to try approaches in parallel and keep the one that works;
• wait for one or two named human approvers on risky actions (the two-person rule), with every action written to a hash-chained, tamper-evident audit log.

The plugin has four parts:

• An MCP server (.mcp.json) that starts kosa8 mcp serve through scripts/kosa8-mcp as a local stdio process.
• A skill (skills/kosa8-sandbox) that tells Claude when to reach for a sandbox and how to use checkpoints, rewind, fork, egress allow-lists and approvals safely.
• Commands: /kosa8:status, /kosa8:sandbox <task>, /kosa8:checkpoint, /kosa8:rewind (asks before rewinding) and /kosa8:explore (try several commands in parallel forks).
• Agents: sandbox-runner runs untrusted or generated code in a sealed microVM and reports what it did; fork-explorer compares approaches in parallel forks of one running sandbox.

Prerequisites

• Claude Code.
• kosa8 installed on the same machine, with kosa8 on your PATH. kosa8 runs on Apple-chip Macs and x86-64 Linux, and on Windows through WSL2 (preview). Install it from kosa8.com/download. Releases are signed and notarised. Check the install with kosa8 version.
• The kosa8 daemon running. The plugin is a thin launcher: the sandboxes are microVMs run by kosa8d on your machine, so nothing works until it is up.

Before you start: install kosa8 and start the daemon

The plugin does not install kosa8 and cannot run without it. On a new machine:

# 1. Install kosa8 (macOS on Apple silicon, x86-64 Linux, or WSL2)#    from https://kosa8.com/download/, then check it:kosa8 version
# 2. Start the daemon that runs the microVMs:kosa8 daemon start
# 3. Confirm both halves are up:kosa8 version          # prints "kosa8 daemon <version> (up Ns)"kosa8 mcp tools        # lists the tools this plugin exposes

If kosa8 version reports kosa8 daemon: not running, run kosa8 daemon start again. The MCP server starts without the daemon, but every sandbox tool then answers cannot reach kosa8d.

Agents installing this server for a user can follow llms-install.md.

Install

In Claude Code, add this repository as a marketplace and install the plugin:

/plugin marketplace add kosa8ai/kosa8-claude-plugin/plugin install kosa8@kosa8

Or from your shell:

claude plugin marketplace add kosa8ai/kosa8-claude-pluginclaude plugin install kosa8@kosa8

Restart Claude Code (or run /reload-plugins). Run /mcp to confirm the kosa8 server is connected, and ask Claude to "check kosa8 status".

Sharing host folders

By default, agents cannot share any host directory into a sandbox. To let them share a project folder, start the server with --allow-mount DIR (read-only) or --allow-mount DIR:rw. You can do that by adding your own MCP server entry, for example in a project's .mcp.json:

{  "mcpServers": {    "kosa8-workspace": {      "command": "kosa8",      "args": ["mcp", "serve", "--allow-mount", "/Users/you/code/api:rw"]    }  }}

Network and keys

Network access for a sandbox is set when it is created. To give a sandbox access to one API and nothing else, create it from your terminal:

kosa8 sandbox create sealed --egress-allow api.anthropic.com

Tools

kosa8 mcp serve exposes these tools (as reported by kosa8 mcp tools in kosa8 0.5.0):

Run kosa8 mcp tools to see the list for your installed version.

What this plugin runs

The plugin's only executable is scripts/kosa8-mcp, a short shell script that finds the kosa8 already installed on your machine and runs kosa8 mcp serve. It downloads and installs nothing. The plugin itself sends no data anywhere, contacts no server and reads no credentials.

Other MCP clients

The same server is published to the official MCP Registry as io.github.kosa8ai/kosa8 (see server.json). It is distributed as an MCP bundle, kosa8-mcp.mcpb, attached to each GitHub release: a manifest and the same short launcher as scripts/kosa8-mcp. It does not download or install anything, so install kosa8 first.

Any MCP client that can start a stdio server can also run kosa8 mcp serve directly.

Privacy

The kosa8 MCP server runs locally and talks to the kosa8 daemon on the same machine. Under the kosa8 privacy policy, the tool calls your agent makes, their arguments and their results stay on your machine and never reach kosa8. The policy lists everything the kosa8 software sends and when, including licence checks for paid licences, and how to turn all outbound calls off with KOSA8_OFFLINE=1.

Full policy: https://kosa8.com/privacy/

Pricing

kosa8 is commercial software. The plugin files in this repository are free and MIT licensed, but kosa8 itself needs a licence: it comes with a free 14-day trial with every feature, no account and no card. Plans start at $29 a month. See https://kosa8.com/pricing/.

Support and contact

• Email: [email protected]
• Issues: https://github.com/kosa8ai/kosa8-claude-plugin/issues
• Website: https://kosa8.com

License

The files in this repository are released under the MIT License. The license covers only the files in this repository (the Claude Code plugin: its manifest, marketplace file, MCP configuration, skill, commands, agents, launcher, README and logo). It does not cover the kosa8 software itself, which is commercial software distributed separately under its own terms.