fcvmBLOCK
Disposable, isolated microVMs with container ergonomics, for people and agents: Firecracker VMs from any OCI image, snapshots and fork, jailer and network isolation, web console, MCP server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://m8ven.ai/mcp/carlosbravoa/fcvm?s=readme)
fcvm runs workloads in Firecracker microVMs, each with its own kernel, with the convenience of a container tool: images, layers, volumes, published ports, exec, snapshots and fork. It is self-hosted, starts VMs without root, and puts a real virtual-machine boundary around code you don't trust. On top of that come optional jailing, network isolation and egress allowlists. Drive it from the command line, a browser console, an HTTP API, or your coding agent over MCP.
fcvm import python:3.13-slim fcvm run python-3.13-slim --allow @pypi -- pip install requests # a throwaway VM that can reach only PyPI
Why fcvm
Containers are convenient but share the host's kernel. Full VMs isolate properly but are slow to start and clumsy to manage. fcvm gives you both: Docker-style workflows, where every workload boots its own kernel in about half a second behind hardware virtualization.
It's built for:
- Sandboxes for AI coding agents. Agents get tools to create sandboxes,
run commands, copy files and fork prepared environments. Each sandbox is jailed and network-restricted by the policy you set.
- Running code you don't trust. A dependency's install script, a
downloaded tool, a build from someone else's repository.
- Throwaway and parallel environments. Prepare once, snapshot, then fork
identical running copies in about 150 ms each.
- Dev machines and small services. Full Ubuntu VMs with systemd and your
source tree mounted live, or containers that stay up across crashes and reboots.
What it isn't: a cluster orchestrator, a macOS or Windows tool (it needs Linux wit
562332582716OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add fcvm-mcp -- uvx fcvm-mcp==0.7.0
Trust audit
BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (13 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (25)
exec(command: string | undefined, opts?: ExecOptions & { background?: false }): Promise<ExecResult>;exec(command: string | undefined, opts: ExecOptions & { background: true }): Promise<Job>;local key=$SSH_DIR/id_ed25519
cat "$HOME"/.ssh/id_*.pub >> "$tmp/keys" 2>/dev/null || true
rm $pre/root/.ssh/authorized_keys
write $tmp/keys $pre/root/.ssh/authorized_keys
sif $pre/root/.ssh/authorized_keys mode 0100600
sdk/mcp/LICENSE
sdk/mcp/NOTICE
sdk/python/LICENSE
sdk/python/NOTICE
serve [--port 8686] web console and API on http://127.0.0.1:8686 (local only; prints a
class Exec(VMTestCase):
return clean if clean == vm else f"{clean}-{hashlib.sha1(vm.encode()).hexdigest()[:8]}"accept = base64.b64encode(hashlib.sha1((headers["sec-websocket-key"] + WS_GUID).encode()).digest()).decode()
(`http://172.30.1.1:3128/cache/HOST/PATH`), which fetches over TLS with
curl -s -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8686/api/vms | jq '.[].name'
adds a mirror on the proxy, `http://172.30.1.1:3128/cache/HOST/PATH`:
fcvm serve # prints http://127.0.0.1:8686/?token=... (open it in a browser)
- When the user asks for a review, run `/code-review high <paths>`; verify
curl -fsSL https://raw.githubusercontent.com/carlosbravoa/fcvm/main/install.sh | sh
curl -fsSL https://raw.githubusercontent.com/carlosbravoa/fcvm/main/install.sh | sh
curl -fsSL https://raw.githubusercontent.com/carlosbravoa/fcvm/main/install.sh | sh
curl -fsSL https://raw.githubusercontent.com/carlosbravoa/fcvm/main/install.sh | sh -s -- --system
Gates applied: no_behavioural_pass.
562332582716full audit observations/trust-audit/mcp-server/carlosbravoa__fcvm.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 562332582716 | BLOCK | F | 55 | first audit |
Questions
What is the fcvm MCP server?
Disposable, isolated microVMs with container ergonomics, for people and agents: Firecracker VMs from any OCI image, snapshots and fork, jailer and network isolation, web console, MCP server
Is fcvm safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (55/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does fcvm need?
It reads FCVM_MCP_SECRETS, FCVM_TOKEN, MY_SECRET, REGISTRY_PASSWORD and SSH_AUTH_SOCK from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does fcvm run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as fcvm at 0.7.0.
How current is this page?
The grade is for one exact copy of the source (562332582716), read on 2026-10-12. The repository is watched and re-audited when it changes.