Starlight
Agent microVMs
Early access
Zero trust for agents.
Every command, file, and connection an agent makes runs in its own hardware-isolated machine, watched from a host that keeps the credentials, the policy, and the evidence.
You gave an agent a shell.Now watch what it does with it.
An IDS for your agents. Isolation, detection, and enforcement for everything they do on your machines.
Bring your framework of choice. Agent microVMs isolate and contain the agent.
You orchestrate agents with the framework you already use.
Agent microVMs wrap every action in a hardware-isolated machine.
Isolation and detection contain what an agent can do when it misbehaves.
The host stays authoritative for policy, credentials, budgets, and audit evidence.
Ephemeral and long-lived sessions
A machine for the moment, or for the mission.
Spin up a session for one task and destroy it at the end, or keep a long-lived session that holds state and context across work. Either way the boundary is the same hardware-isolated machine, and either way teardown is clean when the session ends.
Networking and credentials
Nothing leaves by default.
Sessions start with no general network access; connectivity is granted through explicit destination and port allowlists. Credentials never enter the guest at all: the host holds them and exposes constrained interfaces, so a compromised tool has no long-lived secrets to read.
Budgets and determinism
Bounded and deterministic.
The host sets each session's CPU, memory, runtime, output, and token budgets, and the guest cannot raise them. Commands carry idempotency keys and end in explicit states: success, failure, cancelled, exhausted, expired, or unknowable. Never a silent retry.
Artifacts and audit
Evidence, not trust.
Results come back as content-addressed artifacts, collected only after the machine is confirmed stopped, alongside a tamper-evident record of what was requested, what was authorized, and what came back.
Outcomes
Safer autonomy
Agents compile code, run tests, process files, and invoke tools without receiving equivalent access to the server underneath.
Keep your agent stack
Your framework stays responsible for workflows and intelligence. Agent microVMs become the execution boundary beneath it.
Failures stay contained
Budgets, network policy, and clean teardown limit the impact of mistakes or adversarial input, whether a session lives for a minute or a month.
Credentials stay home
Provider and platform credentials remain on the host. Sessions use constrained interfaces instead of carrying reusable secrets.
How it works
01
Your framework calls one API
Create a session, run commands, transfer files, stream events, and collect results through a versioned execution API.
02
The task runs in its own machine
Each session gets a hardware-isolated microVM with its own resource limits and network policy, enforced by the host.
03
Evidence comes back, the machine goes away
Verified artifacts and an audit record return to your application. The machine is destroyed when the session ends, after one task or after weeks.
Under the hood
Framework-neutral API
Sessions, commands, file transfer, event streams, and cancellation through one versioned API, whatever drives it.
Digest-pinned images
Sessions boot from exact container-image digests admitted by policy, so operators know which userspace every session used.
Resumable event streams
Live progress with recovery after disconnection and ordered terminal events, so long tasks never depend on one fragile connection.
Minimal privileged surface
Most of the runtime is unprivileged. A deliberately narrow launcher owns the few operations that require privilege.
Exec and managed sessions
Drive execution from your own framework, or let a hardened host-side planner drive it. Both use the same policy and audit path.
Hardened platform integration
Runs on Starlight's hardened OS: SELinux enforcement, FIPS-approved cryptography, and an immutable operating system.
Runtime security
Watched from the host. Contained by the machine.
Monitoring
Observed from outside the machine
The host watches network attempts with eBPF from outside the guest, where the session has no access, so observation does not depend on anything running inside.
Sequence-aware detection
Live observations feed a detector that evaluates behavior as an ordered sequence across a session, so a slow-moving pattern reads as one story instead of scattered events.
Classified as it happens
Credential-like requests and suspicious process activity are classified in flight, so detection works from meaning, not just raw event streams.
Attributed and correlated
Every observation is tied to the tenant and session that produced it, and related activity is correlated across hosts, so a campaign reads as one incident.
Explainable alerts and timelines
Alerts persist with the reasoning behind them and sit alongside session timelines in the API, so operators can see why something fired.
Telemetry that reports on itself
The runtime reports its own health, overload, and any lost telemetry, and exports bounded, redacted monitoring data downstream, so silence is a signal rather than an unknown.
Containment
One machine per session
Agent actions execute inside lightweight hardware-isolated machines with their own kernel, separated from the host and from each other.
Policy the guest cannot loosen
Identity, resource, filesystem, and network rules are enforced from the host. Nothing inside the machine can widen its own access.
No credentials inside
Platform and model credentials stay on the host and never enter the machine. Sessions work through constrained interfaces instead of carrying secrets.
Configurable risk policies
Operators define what counts as risky for their environment and how the runtime responds, tightening or relaxing per tenant.
Pause, quarantine, block
A suspicious session can be paused or quarantined, its network and credential access revoked, and actions classified as dangerous stopped before they run.
Explicit security contracts
Security-relevant operations go through versioned, OpenAPI-defined contracts, and detector rules and plugins are signed, so the boundary and the logic enforcing it are both verifiable.
Works with your stack
Keep your framework. Add the boundary.
- LangChain and LangGraph
- CrewAI
- OpenAI Agents SDK
- Vercel AI SDK
- More on the way
Built for the places agents are hardest to trust.
Edge, disconnected, and regulated environments, running alongside local inference on Starlight nodes.
Put a boundary under your agents.
Agent microVMs are in early access. Tell us about your agent architecture and we will give you an architectural review.