v0.7.0

The first tagged release of boxery: self-hosted Linux desktop VMs for coding agents. Your agent stays on your laptop and gets vm_* tools that act on VMs on a machine you own.

Highlights

• One-line MCP install. npx add-mcp boxery-vm adds the boxery MCP server to Claude Code, Codex, Cursor, VS Code and other MCP clients. It works over stdio, or Streamable HTTP for remote use (e.g. tailscale serve).
• pi extension. pi install npm:boxery-vm gives pi explicit vm_bash, vm_read, vm_write, vm_edit and vm_copy tools, plus computer use and Chrome over CDP. pi's built-in tools still run locally.
• Backends. libvirt/KVM on Linux, or Lima on a Mac (boxery-host init --backend lima + boxery setup local).
• Multiple hosts. A single controller and MCP server can manage VMs on several hosts.
• Images, snapshots and forks. All three are built on one image primitive (VM@LABEL), and it also handles pool resets.
• Shared VM pool. Exclusive leases that expire on their own.
• Grants. Give a VM ssh-agent, env or file access per VM, from the controller. http: grants inject credentials at the edge, so secrets never enter the VM.
• --json output for the listing commands.
• zip is now in the base image.

Breaking changes

• The project was renamed from agentvm to boxery, and the npm package is boxery-vm. See Migrating from agentvm.
• boxery run passes its arguments to the VM exactly as given, like docker exec. To run a shell line, use boxery run demo bash -c 'make test'. run also starts in ~/project now (#16).

Security

• A security review led to fixes for a host command-injection bug in the controller transport. The LLM proxy also gets an allowlist and limits.
• Grant revocation now tears down ssh-agent sessions.
• Sandboxed ARM64 Chromium now works under Ubuntu's AppArmor.