One command
wb claude takes exactly the arguments claude takes. The first run in a
git repository sets the project up; later runs start in seconds from a warm
VM.
Wraith Box
Run Claude Code inside an isolated virtual machine. Type wb claude instead of claude; the agent gets native tools, your machine keeps its files, secrets, and network to itself.
Status: design phase. The code does not run an agent yet.
What it does
Section titled “What it does”Separate kernel, no host files
Claude Code and its tools run in a guest VM: macOS on Macs first, Linux and Windows guests and hosts later. Nothing from your machine is mounted in; work comes back as a git branch you review and land.
No secrets in the guest
Not even the model credential. A host-side proxy strips what the guest sends and injects the real credential, so smuggled tokens are useless.
Default-deny network
Every packet goes to a host-side userspace network stack. Only allowlisted names resolve, and pushes are limited to the project’s own repositories.
Read the design overview or the specifications in
the repository’s docs/spec/ directory.