Guides / Run an AI assistant

Run an AI assistant

kosa8 ships ready-made setups for eight assistants. Each runs in its own machine, sees only the folder you hand it, and reaches only the websites that assistant actually needs.

What is ready to go

$ kosa8 agent kits
KIT       IMAGE           NETWORK                             DESCRIPTION
azmx      node:22-alpine  api.azmx.ai,api.anthropic.com,ap..  AZMX AI agent CLI in an isolated sandbox
claude    node:22-alpine  api.anthropic.com,registry.npmjs..  Claude Code in an isolated sandbox
codex     node:22-alpine  api.openai.com,registry.npmjs.org   OpenAI Codex CLI in an isolated sandbox
copilot   node:22-alpine  api.githubcopilot.com,api.github..  GitHub Copilot CLI in an isolated sandbox

Run one

$ kosa8 agent run claude
  sealed machine ready
  only api.anthropic.com reachable

Give it your project

$ kosa8 agent run claude --mount ~/code/api:/work

That folder is all it can see. The rest of your computer is not there as far as it is concerned.

Guard the work

Take a checkpoint before you let it loose, so a bad step costs a second rather than an afternoon.

$ kosa8 checkpoint claude-work --label "before the refactor"

Letting it drive kosa8 itself

kosa8 is an MCP server, so an assistant can make its own copies and checkpoints without you typing the commands.

$ kosa8 mcp serve            # stdio, for a local client
$ kosa8 mcp serve --http :7433
$ kosa8 mcp tools            # everything it exposes

Anything that changes state is marked destructive, so a well-behaved client asks first. For a stronger guarantee than "asks first", see Company rules.

The built-in assistant

kosa8 also has its own, which sees your live container state and runs every proposed action through an approval gate.

$ kosa8 ai -m "why did the api container exit?"

$ kosa8 approve check sandbox_rm web
sandbox-rm web

  touches   the kosa8 daemon on this host
  touches   target web
  risk      destructive
  why       "sandbox_rm" removes state permanently; there is no
            snapshot to rewind to afterwards

Some things can never be waved through

You can let ordinary work run without prompting, but destructive and escalating actions are always confirmed — whatever you put in the settings. A switch that turns off every safeguard is not a safeguard.