Secure environments for your AI agents
Run your agents on a machine we host, or on a box you already own. Either way it’s outbound-only, allowlisted and audited — and it has its own agent that watches it, triages incidents and fixes them.
- —VMs on EC2, from $17 / month
- —microVMs per session, $0.25 / hour
- —Templates: Odoo with AI, 7ots, sandboxes
- —Push metrics, YAML rules, alerts
- —Triage agent over allowlisted SSH
- —Per-target audit of every command
We host the box. You run the agent.
Machines on our AWS account, born guarded: they enroll as a target at first boot, with rules, allowlist and triage already on.
Pick a template, a size and an idle-sleep window. The box boots the app, pins its identity, dials home and shows up in Machines — monitoring included.
Long-lived machine
- EC2 with IMDSv2 and an encrypted gp3 disk
- Start, stop, reboot, idle-sleep
- Wakes on the next agent run
- Terminated only when AWS confirms
Per-session sandbox
- One Firecracker microVM per session
- Wakes on a task, billed per minute
- Idle-stops after 15 min, 8 h max
- Nothing persists between sessions
Agent-ready image
- App, tools, rules and allowlist in one
- Capture a configured VM as an AMI
- Clones re-pin identity and re-enroll
- Launch identical boxes per customer
Templates built for agents
Each template boots the app, the tools an agent needs to operate it, and the rules and allowlist to keep that agent honest.
Odoo with AI
Odoo 18 Community and PostgreSQL 16 behind Caddy TLS, an odoo-agent bridge so agents can read the ERP's status, version and databases, and rules for workers and the database.
7ots ot
A 7ots ot runtime (@7ots/cli) in its own microVM per session, driven only by allowlisted 7ots subcommands.
Agent workbench
A long-lived machine for coding agents: Docker, Node 20, Claude Code, Kimi and Codex CLIs under a non-root agent user.
Code sandbox
An ephemeral Firecracker microVM: one shell task in, exit code and output back, and nothing persists.
Ubuntu, guarded
A clean, hardened Ubuntu 24.04 with the push agent and triage door already on — the base for anything else.
Your own template
Configure a VM once, capture it, and launch identical guarded copies for every customer.
Capture a VMEvery box is guarded
Hosted by us or bring your own: declarative rules, allowlisted SSH investigation, and reports your on-call can act on.
A tiny push agent ships metrics, processes and logs every few seconds. YAML rules evaluate against the payload and its history — no dashboards to babysit.
On CRIT, the LLM of your choice investigates over SSH and emails a markdown root-cause report. Schedules run the same agent on a cadence.
Every command passes through tgt-ssh: dangerous blocklist, then read, then remediate. Anything else is rejected and logged to a per-target audit trail.
Give your agents a machine of their own — and a guard that never gets creative with root.
Bring your own box
Already running servers? Register one as a target in five minutes — push metrics, and let the agent handle the 3 am page.
Register a target
One API call returns a push token and a Caddy-managed subdomain like demo.sudosudo.dev.
Push metrics
Your target POSTs JSON every N seconds. The last 500 snapshots are kept and chartable.
Agent triages CRIT
Rules fire with per-key cooldowns; CRIT dispatches the agent through your allowlist.
Rules are just YAML
Expressions run against the pushed payload and recent history under a strict AST allowlist. No method calls, no dunder names, no surprises.
- payload.*, history[n].*, len / any / all / min / max / sum
- Cooldown per rule — no alert storms
- Severity: info / warn / crit
rules:
- key: disk-high
when: "payload.disk.used_pct >= 90"
severity: crit
cooldown_s: 900
subject: "[{target}] disk {payload.disk.used_pct}% full"
- key: mem-pressure
when: "payload.mem.used_pct >= 85"
severity: warn
cooldown_s: 300Secure by construction
The same guarantees on every machine, hosted or yours. Nothing to switch on.
Hosted VMs open 80/443 for their app and nothing else. The triage door is a reverse tunnel the box dials out.
Instance metadata needs a session token and one hop, so an SSRF in the app can’t lift credentials.
Every root volume is encrypted gp3. Captured templates and their snapshots stay in the platform account.
The box pins its EC2 instance id at first boot. A cloned disk refuses to report as its source.
Dangerous blocklist, then read, then remediate. Anything else is rejected before it reaches the shell.
Each agent run keeps a per-target log of what it ran, what was allowed, and what came back.
The guard agent runs in a sandbox with no network; the LLM key is injected by a proxy and never enters it.
Orgs, members and scoped API keys. Every storage call is filtered by org; owners alone spend or destroy.
Simple pricing
The guard is free while in beta. Compute is AWS cost plus 20% — bring your own LLM key, model cost stays with you.
- Your own boxes as targets
- Unlimited alert rules
- Triage agent and audit log
- Email, Slack and webhook alerts
- t3.micro $17 · small $28 · medium $49 · large $89
- microVM $0.25 / hour, billed per minute
- Every template, guard included
- Idle sleep and template capture
- More VMs and targets per org
- Partner orgs and custom templates
- Custom onboarding
- Priority support
Questions
What’s the difference between a VM and a microVM?
A VM is a long-lived EC2 machine for an app your agents operate: it keeps its disk, can idle-sleep and can be captured as a template. A microVM is a Firecracker sandbox per session: it wakes on a task, stops after 15 idle minutes (8 hours at most), and keeps nothing between sessions.
Can I use my own servers instead?
Yes. Register any box reachable over SSH as a target, run the push agent, and you get the same rules, triage agent, allowlist and audit as a hosted machine. You can mix both in one org.
Which LLM does the agent use?
Yours. Set a Claude, OpenAI, Gemini, DeepSeek, Kimi or Grok key on the target and model cost stays with you. Without a key the platform model runs under a daily quota.
Can the agent break my box?
Only within the allowlist you approve. Every command goes through tgt-ssh: blocklisted commands are rejected, read commands run, remediation runs only if you allowed it, and every attempt is logged.
How is compute billed?
VMs are a flat monthly price per size (AWS cost plus 20%); a sleeping VM only pays for its disk. microVMs are $0.25 per hour, billed per started minute. The guard is free during the beta.