MicroVM control planes and cloud-native harnesses outpace chat wrappers

earendil-works

Local Linux micro-VMs with a TypeScript control plane for programmable network, filesystem, and secret injection policies.

Use caseUse it to wrap agent tool calls in disposable QEMU or krun VMs while keeping credentials and egress on the host.

stacklok

Cloud-native open-source agent harness with provider-agnostic loop, durable state, permissions, gRPC/HTTP APIs, and optional local microVM execution.

Use caseUse it to run the same agent loop locally or on Kubernetes with Redis-backed sessions and deny-dominant permissions.

zerocore-ai

Open-source local-first hardware-isolated sandboxes with instant startup and OCI compatibility for agent workloads.

Use caseUse it as an embeddable microVM backbone for untrusted code execution in agent pipelines.

Prime Intellect

Hardware-isolated Linux microVMs for agentic RL at scale with large immutable environment catalog and high concurrency.

Use caseUse it to train or evaluate agents against reproducible microVM environments at thousands of concurrent instances.

Vercel AI SDK

Experimental HarnessAgent plus sandbox session interfaces for network-aware agent loops in the AI SDK.

Use caseUse it to bootstrap typed harness sessions with Vercel or E2B sandboxes and schema-backed outputs.

msaleme

CI action that runs protocol-level adversarial tests against MCP/A2A endpoints with PASS/FAIL/INCONCLUSIVE verdicts.

Use caseUse it as a gate to probe live agent endpoints for policy violations without false PASS on unreachable targets.

e2b-dev

E2B sandbox backend for Vercel AI SDK so HarnessAgent code runs inside microVMs.

Use caseUse it to wire E2B sessions into AI SDK tools and harnesses with restricted surfaces.

RyanAlberts

Category-ranked top harnesses regenerated weekly from live star and capability data.

Use caseUse it to shortlist progressive-disclosure, coding, or research harnesses by current metrics.

Fernando Dingler / AWS

Strands Box combines OS isolation with Dogwood policies, Strands Shell, and Monty so agents face fine-grained action controls rather than YOLO mode. It is Apache-2.0, macOS-first, and works with any harness.

Shipped

Craig McLuckie

Stacklok argues agent runtimes must be distributed systems with durable state, leases, and replaceable execution planes. Mecatl ships as the open reference that keeps the loop independent of clients and infrastructure.

Read