Skip to main content
Caged Platform

​
What is Caged?

Caged gives AI coding agents a safe, isolated place to work — away from your local machine. Send agents like Claude Code, Codex, Cursor, or Aider into cloud sandboxes backed by Firecracker microVMs. Every session is automatically:

Isolated

Each sandbox runs its own Linux kernel — VM boundary, not container namespace. Full OS-level isolation.

Observed

Every file change, terminal command, and LLM call is recorded in real-time. Nothing happens in the dark.

Costed

Real-time dollar tracking of LLM tokens + compute time. Set budget guards to prevent runaway costs.

Scored

Trust score (0-100) based on agent behavior. Penalizes risky actions like file deletion or network exfiltration.

​
Why Caged?

Running AI agents on your local machine is risky:
ProblemWithout CagedWith Caged
Agent deletes filesYour files are goneSandbox is disposable
Agent installs malwareYour machine is compromisedVM is destroyed after
Agent runs up a $500 billYou find out next monthBudget guard kills it at $5
Agent does something sketchyYou have no ideaFull replay + trust score
Two agents conflictThey fight over the same filesEach gets its own sandbox

​
How It Works

Developer                   Caged Platform                    Sandbox
    │                           │                               │
    ├── caged up ──────────────►│                               │
    │                           ├── Create Firecracker VM ─────►│
    │                           ├── Clone repo ────────────────►│
    │                           ├── Run init_script ───────────►│
    │                           │                               │
    ├── caged connect <id> ────►│◄── WebSocket PTY ────────────►│
    │                           │                               │
    │   Dashboard               │                               │
    │   ├── Live terminal ◄─────┤◄── Events stream ────────────►│
    │   ├── File browser ◄──────┤                               │
    │   ├── Cost tracker ◄──────┤                               │
    │   └── Trust score ◄───────┤                               │
    │                           │                               │
    ├── caged destroy <id> ────►│── Destroy VM ────────────────►│ ✕

​
Components

ComponentDescription
API ServerGo backend managing sandboxes, auth, billing, events
CLIcaged command-line tool for creating and managing sandboxes
DashboardWeb UI for monitoring sandboxes, viewing replays, managing billing
SDKsTypeScript and Python libraries for programmatic access
Sandbox AgentProcess inside each VM that relays events to the platform

​
Next Steps

Quickstart

Create your first sandbox in 2 minutes

Concepts

Understand sandboxes, sessions, and trust scores

Config-as-Code

Add .caged.yaml to your repo

API Reference

Full REST API documentation