trailofbits / coop

项目摘要

coop is a Rust CLI from Trail of Bits that manages disposable, isolated microVM environments (Firecracker on Linux, Lima on macOS) for running AI coding agents like Claude Code and Codex with full tool access—Docker, git, compilers, package managers—without risking the host machine. Each VM is isolated, reproducible, and cheap to create and destroy, with workspace sync and editor integration.

为什么值得关注

It directly addresses the urgent security problem of agentic coding tools having broad, potentially destructive access to developer machines, and it does so with Trail of Bits' security pedigree, a documented trust model, and a polished cross-platform microVM architecture. The rapid release cadence (13 releases in ~6 months) and thorough documentation signal serious, sustained investment.

优势

• Security-first design from Trail of Bits with an explicit trust model document and security policy
• Cross-platform microVM isolation using Firecracker (Linux) and Lima (macOS) with disposable, reproducible environments
• Excellent documentation covering commands, configuration, architecture, integrations, and multi-instance workflows
• Active development with 13 releases in six months, CI, and tests
• Seamless developer workflow: 'coop up' then 'coop claude'/'coop codex' with workspace sync and editor integration

局限性

• Narrow agent support focused only on Claude Code and Codex
• Platform coverage is limited: tested on macOS arm64 and Linux x86_64 only, with Linux arm64 untested and no Windows support
• Requires host virtualization prerequisites (KVM/Firecracker on Linux, Lima on macOS), adding setup friction
• Relatively young project still maturing (37 open issues)

使用场景

• Running AI coding agents with full tool access (Docker, git, compilers) while protecting the host from destructive actions
• Creating reproducible, disposable development sandboxes for agent-driven experimentation
• Enabling security-conscious teams to adopt agentic coding workflows with a documented isolation boundary
• Testing untrusted agent-generated code or risky refactors in an environment that can be instantly destroyed