new macOS sandboxes now resume in seconds

A zoo for your AI agents

Self-hosted Linux, macOS and Windows sandboxes. Every agent gets its own computer in its own microVM. You hold the keys to every gate.

Get started

~/agents — zsh

zoo.local/sandboxes

research booting
invoicerunning
scraperrunning
coderstopped

booting microVM…

agent driving — ms

admit one agent № 0014

~14 ms

warm tool call, round trip
admit one agent № 0125

≈125 ms

sandbox create → first command
admit one agent № 0025

25 cmds

in one exec/batch request
admit one agent № 0379

379 MB

slim code image for tool-call work

p50 on Docker, measured with the public sandbox benchmark suites · methodology

⌖ park map

Five enclosures. One API.

Pick the habitat that fits the job. Start one from the dashboard, an MCP call, or zoo.create(), and every one speaks the same tools.

desktop

The penguin house

display: XFCE · 1280×720
tools: all tools
runs on: Linux · Kata VM

Firefox, terminal, file manager. Full computer use.


zoo.create(kind="desktop")

browser

The fox den

display: XFCE · 1280×720
tools: observe · mouse · keyboard
runs on: Linux · Kata VM

Firefox opens on start. No shell, browser only.


zoo.create(kind="browser")

code

The reptile house

display: headless
tools: shell · files · fetch_url
runs on: Linux · Kata VM

Python 3.12, Node, git. Claude Code preinstalled.


zoo.create(kind="code")

macos

The savanna

display: macOS · 1280×800
tools: all tools
runs on: Apple Silicon host

Suspends on stop, resumes in seconds with memory intact.


zoo.create(kind="macos")

windows

The elephant yard

display: Windows · 1280×800
tools: all tools
runs on: Hyper-V host

Native Windows guests on a Hyper-V server.


zoo.create(kind="windows")

gift shop

Keep the good stuff between visits

Snapshots. Capture persistent sandbox data through lifecycle jobs; macOS keeps saved-state slots.
App profiles. Save logins, cookies and settings from Firefox, Chromium, Chrome or VS Code and load them before boot. Encrypted and versioned.
Persistent user data survives restarts on every kind.

live from the enclosure

Watch every move. Grab the wheel anytime.

The dashboard streams any sandbox's screen in your browser. When the agent wanders off, your mouse and keyboard drop straight into the machine. Try it below.

zoo.local/sandboxes/research/live agent

Applications · Places12:04

about:blank

new tab

chann44 / zoo ★ Star

Self-hosted sandboxes for AI agents.

apps/go/sdk/install.shREADME.md

agent you x 0 · y 0

gateway stream · 1280×720 · no client install

Then move and click inside the screen. audit log · 1,284 calls

⚡ feeding time

Any agent can get in. Nothing gets out.

Every tool is registered once and exposed the same way over MCP, REST and the SDKs. Point your agent at any of them and it can create, drive and tear down its own sandboxes.

mcp.json

// any MCP client: Claude, Cursor, your own
{
  "mcpServers": {
    "zoo": {
      "type": "http",
      "url": "http://localhost:8000/mcp/",
      "headers": {
        "Authorization": "Bearer zoo_..."
      }
    }
  }
}

# every tool is an HTTP endpoint
curl -X POST localhost:8000/v1/sandboxes/$ID/tools/type_text \
  -H "Authorization: Bearer $ZOO_API_KEY" \
  -H "content-type: application/json" \
  -d '{"text": "hello"}'

# 25 commands, one request
curl -X POST localhost:8000/v1/sandboxes/$ID/exec/batch ...

from zoo_sdk import Zoo

zoo = Zoo()  # reads ZOO_API_KEY and ZOO_URL
box = zoo.create("research", kind="desktop")

box.open_app(command="firefox-esr")
box.click(x=640, y=360)
box.type_text(text="hello")
print(box.exec("ls ~")["stdout"])
open("screen.png", "wb").write(box.screenshot())

import { Zoo } from "@zoo/sdk"

const zoo = new Zoo() // ZOO_API_KEY, ZOO_URL
await using box = await zoo.sandbox({ kind: "desktop" })
// deleted when the scope ends

for await (const chunk of box.execStream("pip install requests"))
  if (chunk.stream !== "exit") process.stdout.write(chunk.data)

works with Claude CodeCursorCodexOpenCodeyour own agent

Claude Code is preinstalled in every code sandbox. Inject your Anthropic key as an encrypted secret, clone a repo and run box.exec("claude -p 'inspect this repository'"). Zoo brings the machine and the policy; you bring the model.

⚠ do not feed the agents

Built like it might bite

Agents are powerful and wrong in surprising ways. Zoo assumes both and builds the fences to match. Every fence is yours, on your hardware.

Kernel isolation

Linux sandboxes run in Kata VMs; Mac and Windows guests use their native hypervisors. Tools and screens go through an authenticated gateway, never a public desktop port.

Policies outside the guest

Tool permissions, network rules and app blocking per sandbox. Deny everything, then open one domain at a time.

box.set_network("deny")
box.add_rule("domain", "github.com")

Secrets

Encrypted at rest with ZOO_SECRETS_KEY or your own KMS: AWS, Google Cloud or Vault. Injected on start, never shown again.

Audit log

Every tool call is recorded with who, what and when.

zoo.local/sandboxes/coder/policy

github.com pypi.org evil.example pastebin.com

egress · default deny

github.com
pypi.org
evil.example
pastebin.com

passed 0 blocked at the fence 0

🎟 ticket booth

One command builds the whole park

Debian, Ubuntu, macOS or Windows. Mac and Windows need Docker Desktop running. Add more hosts later under Remote Servers.

$ curl -fsSL https://github.com/chann44/zoo/releases/latest/download/install.sh | sudo bash -s -- --admin-email you@example.com

PS> powershell -ExecutionPolicy Bypass -c "& ([scriptblock]::Create((irm https://github.com/chann44/zoo/releases/latest/download/install.ps1))) -AdminEmail 'you@example.com'"

1
It builds the park

The script checks for KVM, configures Docker with Kata VMs, generates fresh secrets and installs the pinned stack.
2
Open the gates

Open the dashboard URL the installer prints, sign in, create a sandbox and grab an API key from your profile.
3
Let the agents in

MCP, REST or the SDK. From there an agent can create, drive and tear down its own sandboxes.

Outgrow one machine? Opt into Kubernetes for Linux sandboxes, and enroll Mac and Windows hosts for native guests. It's all managed from one dashboard.

ⓘ visitor information

Questions, answered plainly

What is Zoo, exactly?

A self-hosted service that gives AI agents disposable computers: Linux, macOS and Windows desktops, browsers and code shells, each in its own microVM with its own kernel. Agents drive them over MCP, REST or an SDK; you watch and take over from the dashboard.

What do I need to run it?

A Debian or Ubuntu server with KVM (bare metal, or a cloud VM with nested virtualization), or macOS / Windows with Docker Desktop running. macOS sandboxes need Apple Silicon; Windows sandboxes need Hyper-V.

How do agents connect?

One MCP server at /mcp/ with an API key, plain REST endpoints, or the Python and TypeScript SDKs. Every tool is registered once and exposed identically over all of them, so switching is cheap.

Can I watch what agents are doing?

Yes. Live view streams a sandbox's screen in the browser with mouse and keyboard control, and tool calls land in the activity log.

Where does my data live?

On your servers. Sandboxes, dashboard, database and secrets all run on your hardware. Secrets are encrypted at rest, with optional AWS, Google Cloud or Vault KMS.

Does it work with Claude Code?

Code sandboxes ship with Claude Code installed. Supply your own credentials as an encrypted secret and run it through the sandbox's shell tools. Zoo does not supply a model or a planner.

Can it run on more than one server?

Yes. Kubernetes distributes Linux sandboxes across nodes, and Mac and Windows hosts join as remote servers for native guests.

open 24/7 · self-hosted

The park never closes

Your agents keep working through the night. You keep the keys. Install Zoo on your own hardware in one command.

Open the gates ★ Star on GitHub