Clawk

• CollectionCode Execution
• Classificationagent-native
• LicenseApache-2.0
• MCPUnknown
• Agent SkillUnavailable
• InterfacesCLI · http
• Verified2026-10-13

• Website ↗
• Docs ↗
• Official repo ↗
• Full dossier on GitHub ↗

What it does

Clawk gives a coding agent a disposable Linux VM on the operator’s desk instead of the host laptop. cd into a repo and run clawk: the project is live-mounted, the agent runs as root in the guest with permission-bypass flags, and host files, keychain, and unlisted network destinations stay out of reach.

Isolation is a hypervisor (Apple Virtualization.framework / Firecracker), not a process sandbox. Egress is deny-by-default and DNS-aware — the userspace stack in the per-sandbox daemon filters TCP/UDP/ICMP; the guest cannot reconfigure it. Idle VMs balloon memory and can suspend; clawk destroy drops the VM disk while repo and agent conversation state stay on the host.

Pre-1.0: README IMPORTANT callout and Status section both say the project is pre-1.0, moving fast, and will break between releases.

Distinct from hosted Agent Sandbox (agentsandbox.co), Kubernetes SIG Agent Sandbox, E2B / Runloop / Vercel Sandbox (cloud microVMs), and CodeRunner (Apple Containers). Clawk is local-first hypervisor VMs with a DNS-aware egress allow-list.

Agent-facing interfaces

• Interaction pattern: CLI (local hypervisor VM)
• Catalog protocols: CLI, http
• MCP: ⚠️ Not a hosted MCP server. Clawk can provision MCP servers in the guest via clawk.mod.
• Agent Skill: ⚠️ No official npx skills add / SKILL.md package published.
• Onboarding type: cli

How agents onboard

Interaction pattern: CLI (local hypervisor VM)

brew install clawkwork/tap/clawk
cd <repo>
clawk                      # boot a sandbox for this dir + attach Claude Code

See the full onboarding section in the dossier.

Protocol surface

Verification

Last verified 2026-10-13.

Sources:

• https://api.github.com/repos/clawkwork/clawk