ericsciple/microVM agent harness

Safely run an AI agent prompt inside a hardware-virtualized microVM. Credentials, egress firewall, MCP gateway, and MCP servers stay on the runner host, outside the VM. Safe by default. (Prototype — see TODO.md.)

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
prompt	The task for the agent.	yes	—
model	Model passed to the Copilot CLI.	no	auto
mcp-config	Additional MCP servers as a JSON string in Copilot MCP JSON format ({"mcpServers": {...}}). This is also how safe outputs are added (they are just MCP servers). Merged in behind the gateway. Real secrets referenced here are kept host-side and never placed in the guest's config.	no	""
github-mcp	Add the default read-only GitHub MCP server (named 'github').	no	true
firewall-allow	Extra egress hosts (newline-separated) allowed on top of the deny-all baseline.	no	""
mounts	Which host paths to expose inside the guest (cumulative enum): 'none' mounts nothing (hermetic agent); 'workspace' (default) mounts GITHUB_WORKSPACE read-only with a throwaway write overlay; 'workspace+toolcache' also mounts RUNNER_TOOL_CACHE read-only. Mapped to well-known guest paths (workspace -> /__w, toolcache -> /__t) like Actions container jobs, with GITHUB_WORKSPACE/RUNNER_TOOL_CACHE set to match. Only the tool-cache entries from the host PATH are carried into the guest (rewritten to /__t). Writes are discarded; the only durable output path is a safe output.	no	workspace
copy-event	Copy the triggering event payload (GITHUB_EVENT_PATH's event.json) into the guest as agent context, and repoint GITHUB_EVENT_PATH at the copy. Only event.json is copied — never RUNNER_TEMP. Set to 'false' to withhold it.	no	true
timeout-minutes	Hard cap on the agent run.	no	15
github-token	Token the HARNESS itself uses host-side — for the inference gateway (copilot-requests) and the default read-only 'github' MCP server it provides. Held on the host; the guest never sees it. NOTE: this is NOT how safe-output or other user MCP servers get a token — those receive it via their own `env` block in mcp-config (e.g. GITHUB_TOKEN set to the workflow's github.token), like any MCP server. Requires 'copilot-requests: write' for inference. The caller must pass this (e.g. github-token set to the workflow's github.token); the action also falls back to the GITHUB_TOKEN environment variable.	no	""
rootfs	Advanced: path to a custom guest rootfs ext4 to boot instead of the fetched bare rootfs. Must satisfy the contract: x86_64 + glibc >= 2.28 + libstdc++.so.6 present (no musl/Alpine). Preflighted before boot.	no	""

Outputs

name	description
status	Result status of the agent run.