What is Caged?
Caged gives AI coding agents a safe, isolated place to work — away from your local machine. Send agents like Claude Code, Codex, Cursor, or Aider into cloud sandboxes backed by Firecracker microVMs. Every session is automatically:Isolated
Each sandbox runs its own Linux kernel — VM boundary, not container namespace. Full OS-level isolation.
Observed
Every file change, terminal command, and LLM call is recorded in real-time. Nothing happens in the dark.
Costed
Real-time dollar tracking of LLM tokens + compute time. Set budget guards to prevent runaway costs.
Scored
Trust score (0-100) based on agent behavior. Penalizes risky actions like file deletion or network exfiltration.
Why Caged?
Running AI agents on your local machine is risky:How It Works
Components
Next Steps
Quickstart
Create your first sandbox in 2 minutes
Concepts
Understand sandboxes, sessions, and trust scores
Config-as-Code
Add .caged.yaml to your repo
API Reference
Full REST API documentation