Moon MCHN (Moon Machine)

MicroVMs for the AI era.

Moon MCHN offers VMs to run AI agents and assistants, or to use as a general-purpose development tool.

While we want to provide a secure environment, be aware that Moon MCHN is an early release. Read CHANGELOG.md and ROADMAP.md to learn more about the present and the future of this project.

Why

Attackers now go after developers' machines: a worm in an npm package, malware in the git hooks of a fake job assignment, a prompt injection that steers a coding agent. Moon MCHN runs the code you'd rather not run as yourself in a Linux microVM, on macOS and Linux.

Each machine comes with:

• Its own kernel. A microVM with its own Linux kernel, on the host's hardware virtualization. Code inside sees the machine, and your files stay out of its reach.
• Nothing of yours inside unless you list it. A fresh configuration shares no host files. You name the directories a machine may see, read-only or writable.
• Rules on the host. Resources, mounts and network rules live on the host, out of the machine's reach, so an agent inside cannot switch them off.
• Pinned images. A machine boots an OCI image pinned to the digest it resolved to, so the same spec boots the same content. Registry images need no Docker on the host.

Quick start

You need an Apple Silicon Mac or Linux with KVM (/dev/kvm), and Rust 1.99 or later:

cargo install moonmchn-cli --locked  # installs mchn with the dependency versions the release pinned
mchn setup                           # run once; writes ~/.config/moonmchn/config.toml, sized to this host
mchn daemon start                    # starts the daemon in the background
mchn start dev                       # boots a machine named dev from the official image
mchn shell dev                       # opens a shell in it
mchn exec dev -- uname -a            # runs one command in it
mchn stop dev                        # stops it and discards its disk
mchn --help                          # shows all the commands

What it protects, and what it does not yet

Moon MCHN keeps out of a machine's reach:

• Your files outside the mounts you list: keys, credentials, other projects.
• Services on your host: no machine reaches them, whatever the network rules say.

Not yet:

• What you hand in. A mounted directory is the machine's to read and change.
• The network. Network rules are still early: in 0.1.0, setup starts with every host allowed, for you to narrow, and DNS queries pass unchecked. In a future version, the egress firewall will check every connection and DNS query, and deny by default.
• The VM process. Under the 0.1.0 engine, the process that runs the VM has your user's permissions, so a guest that escaped the VM would get them. Confining that process with Seatbelt on macOS and Landlock on Linux is next on the roadmap.

Known limitations lists the rest.

How it compares

Moon MCHN is made for one developer's own Mac or Linux machine, with two choices at its core, both on the roadmap:

• Two walls. The microVM, and the host process that runs it, confined by the host kernel: Seatbelt on macOS, Landlock on Linux.
• Machines you can rebuild. Toolchains come from Nix packs pinned in the machine's spec, so the same spec gives the same machine.

Development

DEVELOPMENT.md covers the repository layout, the Nix setup, the make targets, the rules the code holds itself to, and how to verify a release.

Security

Report vulnerabilities privately through GitHub's private vulnerability reporting. SECURITY.md covers what to include, what happens next, and what is in scope.

License

Licensed under the Apache License, Version 2.0.