A sandbox for AI runs: every agent task gets its own FlashVM. It's claimed warm in milliseconds, runs whatever the agent wrote behind a real hypervisor boundary, and is thrown away when the task ends. One install, no account, no cloud. We built our own virtual machine for this: FlashVM, leaner and faster than a conventional microVM.
PowerShell as Administrator. It enables the hypervisor if needed, picks x64 or ARM64 and verifies the checksum.
irm https://flashvmm.com/install.ps1 | iex
Then jail the agent you already use, unchanged: flash agents setup, then cd my-project && claude. It runs in its own VM and sees only that folder. The full tour: flash demo.
What it's for
Let the agent run anything. Keep your machine.
Run code an agent wrote
Scripts, package installs, test suites, and Docker builds run inside a VM with its own kernel. Cap CPU, memory, disk and network only when you want to, and decide what it may reach with --egress. Nothing touches the host.
flash-mcp hands Claude, Cursor or any MCP client the whole lifecycle in 21 tools: create, run commands, copy files, fork, limit what it can reach, call APIs without holding the key, watch, snapshot, restore, tear down.
Warm pools keep spares already running, so a task claims one instead of booting. Snapshots restore a prepared environment in milliseconds, and flash fork branches a running VM into copies that carry on from where it was.
A GPU pool loads an AI model on the host's GPU once and every VM you allow sends it requests. No VM touches the GPU or needs a driver, and snapshots and warm pools keep working. Metal on Apple silicon, Vulkan on Linux and Windows.
The task takes a warm spare from the pool, or restores a snapshot. No kernel boot on the hot path.
2
Run
The agent's commands run in the guest with flash exec; exit code, stdout and stderr come back structured. Files go in and out with flash cp; logs, metrics and events stream back live.
3
Discard
The VM is removed when the task ends. Nothing it did carries into the next run, unless you snapshot it.
flash claim spare1 --entry 'npm test' # a warm spare from the pool
flash logs spare1
flash rm spare1
Same CLI, same HTTP API and same MCP tools on every OS. Full walkthrough →
Give it a run.
No accounts, no dashboard. A CLI, a hypervisor, and an MCP server.