How does KelyfOS prevent network egress for AI agents?

Without the --allow flag, the Firecracker microVM boots with zero virtio-net devices. The Linux kernel literally has no network interface device to transmit IP packets, providing a true hardware-level airgap rather than fragile firewall rules.

How fast is KelyfOS cold boot compared to Docker or standard VMs?

KelyfOS achieves a 134ms median cold boot-to-ready on bare-metal KVM hardware. This is 9.2x faster than Docker Ubuntu (1,240ms) and 4.6x faster than generic Firecracker with standard Linux distributions (620ms).

How does KelyfOS keep API secrets safe from AI agents?

Secrets never enter guest memory or environment variables. The host-side egress proxy intercepts outbound TLS requests to whitelisted domains and injects Authorization headers in-flight. Inspecting 'env' or /proc inside the microVM reveals zero credentials.

What MCP tools are exposed to the AI agent?

The static supervisor PID 1 exposes exactly 6 tools over hybrid vsock: exec, read_file, write_file, list_dir, upload, and download.

How does the cryptographic audit verification work?

Every MCP tool call, vsock frame, and output stream is logged by the host into a SHA-256 hash-chained JSONL log. The 'kelyfos verify' command validates monotonic clocks, frame checksums, and hash chain integrity offline with zero keys or network access.

KelyfOS — The Firecracker microVM built specifically for AI agents

A sandbox an AI agent can only reach through tools. Minimal guest OS for Firecracker microVMs with 134ms cold boot, zero-egress airgap, host-side secret injection, and tamper-evident SHA-256 audit trail.

Core Guarantees

Egress is off, not filtered: Without --allow, microVM boots with zero virtio-net devices.
Secrets never enter the guest: Host egress proxy injects credentials in-flight on matching domain requests.
Tamper-evident audit chain: Host logs all vsock MCP frames to SHA-256 hash-chained receipt verified offline.
6 MCP Tools: exec, read_file, write_file, list_dir, upload, download over hybrid vsock.

Quickstart

kelyfos run --agent claude-code ./workspace

Performance Benchmarks

Cold Boot-to-Ready: 134 ms (9.2x faster than Docker Ubuntu)
Snapshot Restore: 48 ms
Five Agents Parallel Boot: 343–543 ms
Combined Release Size: 117 MB

Documentation and full terminal demo available at github.com/p4r4n0rm4l/KelyfOS