smolvm 0.0.36

credential-forwardingCovers 0.0.36Reviewed by BitbisonUpdated 2026-11-04

smolvm starts local microVMs to isolate AI agents from the host, yet every agent preset copies the host's whole ~/.ssh directory, ~/.git-credentials and GitHub CLI login into the VM, plus the Claude Code login from the macOS keychain, with no opt-out and open internet by default. It sends nothing off the machine itself.

What smolvm is

smolvm, by Celesto AI, is a Python library and CLI that starts microVMs for AI agents on the user's own machine, through Firecracker, QEMU, libkrun or Lume. Its pitch is isolation: each agent gets its own VM, and the README says untrusted code in it "can't escape or access your host", so AI-generated code runs there instead of on the user's machine. Its agent presets (smolvm claude start, smolvm codex start and others) boot such a VM with one coding agent installed, as "a disposable place to work".

What the package does

smolvm starts local VMs for coding agents. Every agent preset copies the host's credentials into the VM it starts: the git configuration, ~/.git-credentials, the whole ~/.ssh directory with every private key in it, and the GitHub CLI's login. The Claude Code preset also copies the Claude Code configuration and login, forwards ANTHROPIC_API_KEY, and on macOS reads the Claude Code login out of the system keychain. There is no option to turn the copy off, and a missing file is skipped silently.

The VM's internet access is open by default. Whatever runs inside it, the agent and anything the agent executes or is talked into executing, holds those keys and tokens and can reach any host with them.

The VM accepts no connections from other machines by default. It sits behind the host on a NAT network, smolvm's own service inside it listens only on a host-to-VM vsock channel, its SSH (root, keys only, no passwords) and any port the user exposes are forwarded on the host's 127.0.0.1, and smolvm's HTTP API and dashboard bind to 127.0.0.1. It becomes reachable from the network only if the user chooses bridge networking or starts the API on another address; that API has no authentication when started from the CLI. The exposure is outbound: what leaves is what the agent sends.

smolvm sends nothing off the machine itself. The files go over SSH into the VM smolvm starts on the same host (Firecracker, QEMU or Lume). The package has no remote VM service and no telemetry, and it turns Lume's telemetry off. smolvm's own service inside the VM only receives files and runs commands; it opens no outbound connections of its own.

What the code does

• src/smolvm/presets/_git.py:37-53 lists the copies made for every preset: ~/.gitconfig, ~/.config/git/config, ~/.git-credentials (plaintext https://user:token@host lines, per its own comment), the whole ~/.ssh directory except authorized_keys, and ~/.config/gh. The module docstring (lines 15-25) gives the reason: agents need git, gh and ssh git@github.com to work without signing in again.
• src/smolvm/presets/_install.py:132-133: apply_preset calls transfer_host_configs with include_git_configs=True unconditionally. Lines 571-600 copy each path that exists and skip a missing one without a word.
• src/smolvm/presets/claude_code.py:103-120 adds ~/.claude.json (minimized) and ~/.claude/.credentials.json, and forwards ANTHROPIC_API_KEY. Lines 90-94 name the keychain item Claude Code-credentials; _extract_keychain_secret (_install.py:470) reads it with security find-generic-password and writes it to /root/.claude/.credentials.json in the VM. macOS asks the user before the keychain releases it.
• src/smolvm/types.py:355-357: InternetSettings defaults to allowed_domains=("*",), open outbound access.
• Inbound: src/smolvm/types.py:489 defaults the network mode to nat; the in-VM service's src/server.rs:3 (in the sdist's Rust agent crate) listens on vsock://1024; src/smolvm/images/cloud_init.py:49-50 sets PermitRootLogin yes and PasswordAuthentication no; port exposure in src/smolvm/facade.py (expose_local, line 2575) binds to localhost; src/smolvm/cli/commands/app.py:952 defaults smolvm server start --host to 127.0.0.1, and src/smolvm/server/app.py:137-141 adds authentication only for SDK sessions.
• _install.py:93-96 and 107-133 install the agent's packages before any credential is copied, so network-fetched install scripts never see them.

The documentation understates the copy. README.md says presets launch with "git credentials forwarded". docs/guides/agent-presets.md:105 says presets "copy only the configuration they need where possible" and asks users to review their configuration folders. Neither mentions SSH private keys, ~/.git-credentials, the GitHub CLI's token or the keychain read.

Does it fit what smolvm is for

Partly. The copy is deliberate and serves a purpose smolvm states: an agent that can commit, push and use gh without signing in again. But it works against the purpose smolvm leads with. A VM keeps untrusted code from reaching the host's files; once the host's SSH keys, git tokens and agent login are inside it, code in the VM no longer needs to escape to use them, and with open internet it can use them anywhere: push to every repository the keys reach, act as the user on GitHub, spend their Claude subscription. The isolation the README promises covers the host's disk, not the host's identity, and the presets hand over the identity by default.

The copy is also wider than the purpose needs. Pushing to one repository needs one key or token; the presets take every private key in ~/.ssh and every line of ~/.git-credentials. And the documentation that would let a user weigh this, the README and the presets guide, says less than the code does.

Conclusion

credential-forwarding: smolvm is not malicious and sends nothing off the machine, and copying credentials is an intended convenience; but every agent preset copies all of the host's SSH keys, git credentials and GitHub token, and for Claude Code its login from the macOS keychain, into a VM with open internet access, with no opt-out and less disclosure than the code does.

Before starting a preset, move keys and tokens the agent should not hold out of ~/.ssh, ~/.git-credentials and ~/.config/gh, or start it as a user whose home holds only what the agent needs, and restrict the VM's internet access where the backend supports it.

Links

• smolvm on PyPI