macOS · Windows · Linux — x86_64 and ARM

A sandbox for AI runs.

Every agent task gets its own microVM. It's claimed warm in milliseconds, runs whatever the agent wrote behind a real hypervisor boundary, and is thrown away when the task ends. One install, no account, no cloud.

Get started Connect your agent

curl -fsSL https://release.flashvmm.com/dist/flashvmm/stable/install.sh | sudo bash

PowerShell as Administrator. Enable the hypervisor once and reboot, then run the rest. It picks x64 or ARM64 and verifies the checksum.

dism /online /enable-feature /featurename:HypervisorPlatform /all   # once, then reboot

$arch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'x64' }
$base = 'https://release.flashvmm.com/dist/flashvmm/stable'
$rel  = Invoke-RestMethod "$base/bootstrap-windows-$arch.json"
$msi  = Join-Path $env:TEMP $rel.msi
Invoke-WebRequest "$base/$($rel.msi)" -OutFile $msi -UseBasicParsing
if ((Get-FileHash $msi -Algorithm SHA256).Hash.ToLower() -ne $rel.sha256) { throw "checksum mismatch" }
Start-Process msiexec -ArgumentList "/i `"$msi`" /quiet /norestart" -Verb RunAs -Wait

Then see all of it in one command: flash demo — 23 short scenarios, one feature each: what it does in plain words, the exact command, and the result. It sets up everything it needs.

What it's for

Let the agent run anything. Keep your machine.

Run code an agent wrote

Scripts, package installs, test suites, Docker builds — inside a VM with its own kernel. Cap CPU, memory, disk and network only when you want to, and decide what it may reach with --egress. Nothing touches the host.

The isolation model →

Give your agent a computer

flash-mcp hands Claude, Cursor or any MCP client the whole lifecycle in 21 tools: create, run commands, copy files, fork, limit what it can reach, call APIs without holding the key, watch, snapshot, restore, tear down.

For AI agents →

Start clean, every time

Warm pools keep spares already running, so a task claims one instead of booting. Snapshots restore a prepared environment in milliseconds, and flash fork branches a running VM into copies that carry on from where it was.

How it works →

Share the GPU

A GPU pool loads an AI model on the host's GPU once and every VM you allow sends it requests. No VM touches the GPU or needs a driver, and snapshots and warm pools keep working. Metal on Apple Silicon, Vulkan on Linux and Windows.

GPU pools →

How a run works

Claim. Run. Discard.

1
Claim
The task takes a warm spare from the pool, or restores a snapshot. No kernel boot on the hot path.
2
Run
The agent's commands run in the guest with flash exec — exit code, stdout and stderr come back structured. Files go in and out with flash cp; logs, metrics and events stream back live.
3
Discard
The VM is removed when the task ends. Nothing it did carries into the next run, unless you snapshot it.

flash run --bundle /opt/flashvmm/bundles/current --id spare1 --vcpus 1 --mem-mib 256 --pool --detach
flash claim spare1 --entry /your/workload
flash logs spare1
flash rm spare1

Same CLI, same HTTP API and same MCP tools on every OS. Bundle paths: Linux /opt/flashvmm/bundles/current, macOS /opt/flashvmm/bundles/default, Windows "C:\Program Files\FlashVMM\guest". Full walkthrough →

Give it a run.

No accounts, no dashboard. A CLI, a hypervisor, and an MCP server.

Get started Explore the technology