MCP server for coding agents
A local MCP endpoint that lets Claude Code, Codex, Cursor or any other client create, run, snapshot and destroy machines — inside a blast radius you set.
Why it matters
An agent that can run shell commands is only as safe as the machine it runs them on. Giving it a real VM it is allowed to destroy is cheaper than reviewing every command it wants to run, and it stops being a question of trust.
What changes
Without it
- The agent runs against your actual Mac, so every destructive command is a judgement call you have to make in advance.
- Sandboxing means a container that shares your kernel, or a cloud VM that costs money and minutes to reach.
- Cleaning up after a run is your job, and half-finished machines accumulate.
With 1VMTool
- The agent gets a disposable VM over MCP, with a token scoped to machines it created itself.
- Twenty-four tools cover the whole lifecycle — list, create, start, exec, snapshot, restore, delete.
- `1vm agent gc` deletes every stopped machine the agent left behind, in one command.
How it works
Off until you turn it on
`1vm mcp enable` starts a loopback listener. It binds 127.0.0.1 and refuses any request whose Host header is not a loopback address, so nothing is reachable from your network.
Tokens carry a level
Every token is minted at read, operate, create or destroy, and scoped to agent-owned machines or a named list. A read token cannot stop a machine; a create token cannot delete one.
One command per client
`1vm mcp install-snippet claude-code` writes the config form that client expects. Snippets ship for Claude Code, Claude Desktop, Codex, Cursor, Gemini, opencode, Windsurf, Cline, VS Code and Grok, plus generic HTTP and stdio.
The work outlives the client
`1vm mcp serve` proxies to the running app rather than owning the machines itself, so closing your editor does not kill a long task.
What it covers
- 24 MCP tools across machines, snapshots and tasks
- Bearer tokens at read, operate, create or destroy
- Per-token machine scoping — agent-owned, all, or a named list
- `1vm mcp audit` lists recent tool calls with the token that made them
- Loopback-only HTTP, plus stdio for clients that prefer it
- `1vm agent gc` reclaims machines an agent abandoned
What you get out of it
- Let an agent break something real without it being your Mac
- Revoke an agent's access without touching the rest of your setup
- Audit exactly what an agent did, after the fact
Try it on your own Mac
Every screen states its limits before you commit to anything.