Claude Code, Codex and Gemini agents run in parallel on isolated Linux VMs with your full stack ready. You set the rules—what they can reach, which secrets they use, what needs your approval—and every action is audited and costed.
A coding agent is only as useful as the environment it runs in, and only as safe as the boundaries around it. kratt gives each agent a complete machine to work on, and gives you the controls to run many of them with confidence.
Every agent works on its own Linux VM with your full stack running: repos, services, Docker, tests. Nothing is shared between tasks, and the blast radius is one machine.
Approvals for anything sensitive, an egress allowlist on every VM, and secrets that are injected outside the machine. Policy is set by the org and inherited by every workspace.
Live state for every agent and machine, an append-only audit log, session history, and AI and compute cost broken down per person, project and workspace.
Claude Code, Codex or Gemini. Changes arrive as normal pull requests with your CI. Sign-in through your identity provider, VMs in kratt's cloud or your own AWS account.
Autonomy is only useful when it's bounded. kratt puts three controls around every workspace—an approval for anything sensitive, a firewall on everything outbound, and secrets that the machine can use but never read.
When an agent needs root, a new host, a secret, a public URL, a release, or a call to an external MCP tool, the request lands in front of the workspace owner with what is being asked and why. Approve from the desktop or your phone; the agent picks up where it stopped.
"Stripe export integration test needs the Stripe API."
Test-mode key for the export suite. Injected only into requests to api.stripe.com.
Calls go out as you—your own Jira sign-in, not a shared bot.
Every outbound connection—from the agent, the services it runs, its containers, even root—goes through kratt's egress gateway on the VM, outside the agent's control. Workspaces start strict: an allowlist with the AI providers and your git host, nothing else. Everything that was allowed shows why; everything that was refused shows who tried.
| Host | From | Why | Conns |
|---|---|---|---|
| api.anthropic.com | agent | AI provider | 214 |
| github.com | agent | git host | 37 |
| registry.npmjs.org | agent | project template | 96 |
| api.stripe.com | svc api | approved · Mari | 12 |
| pastebin.com | agent | refused | 1 |
| 169.254.169.254 | container | metadata blocked | 2 |
Agents read whatever is on their machine, so the safest secret is one that is never there. Inside the VM, programs only ever see a placeholder. When a request leaves for the secret's bound host, kratt's injector—running outside the VM—swaps in the real value on the way out. The code works exactly as if it had the key; nobody on the box can read it.
Authorization:
Bearer
kratt_ph_7f3a…policy ✓
approval ✓
host ✓
swap → sk_test_••••200 OK
audit:
used by agentEvery agent starts with a map of its machine: which repos are cloned, which services run where, how tests and builds work, what the rules are. kratt gives it tools for all of it—restart a service, run the suite, cut a build, open a PR, publish a site, spawn a helper VM. When a task needs something it doesn't have yet—root, a new network host, a secret, a public URL—it requests it through kratt instead of holding it up front, and continues once you approve.
› Integrate the Stripe export and verify it end to end ● run_tests { repo: "api" } ✓ 412 passed · 0 failed · 38s ● curl https://api.stripe.com/v1/charges ✗ refused by egress: api.stripe.com not on the allowlist ● egress_request { host: "api.stripe.com", reason: "Stripe export integration test" } … waiting for the owner ✓ approved by Mari · added to project allowlist ● kratt-secret stripe-test-key ✓ placeholder issued - real key added off-VM ● run_tests { repo: "api", path: "export/stripe" } ✓ 9 passed ● git_create_pr { branch: "kratt/stripe-export" } ✓ PR #214 opened · CI running
"How are my agents doing on the billing project?"
Three workspaces are running. The Stripe export has PR #214 open with CI green. The invoice-PDF agent has been waiting on you for 20 minutes: it wants access to fonts.googleapis.com.
"Approve it for that workspace, and ask the export agent to add a test for refunds."
Done. Both agents are working again. I'll tell you when the refund test is in.
kratt is also an MCP server. Add it to Claude, ChatGPT or a voice agent, sign in once, and that assistant can see your workspaces, report on progress, start new tasks, prompt running agents and answer their approval requests. Manage a fleet of agents from a conversation, on your phone, without opening a laptop.
Large tasks can be split across machines. An agent starts its own helper VMs, hands each a piece, tracks their progress and collects the results—with every machine, agent and cost visible in one place.
A lead agent spawns child workspaces on the same project—one to reproduce a bug, one to write the migration, one to run the slow end-to-end suite. It prompts them, checks their state, reads their results, and stops or deletes them when they're done.
Every AI session's token cost and every VM hour, rolled up per day and month. Break it down by person, project, workspace or AI provider, and trace any spike to the session behind it.
| Person | Project | AI | VM |
|---|---|---|---|
| Mari | billing | €312 | €58 |
| Daniel | onboarding | €276 | €71 |
| Priya | infra | €194 | €39 |
Five steps on a VM that runs your full stack, with you reviewing the result.
One .kratt.json defines it: Docker services, setup commands, dev servers, test runner. Full Linux—any package, any library. The same environment every time.
AI CLIs are the primary interface. Claude Code, Codex, or Gemini work directly on the VM—editing files, running commands, reading logs. Drop into VS Code when you need to go hands-on.
The agent runs your full test suite and drives the UI in a real browser. Or open the running app yourself from a public URL—click through it and pin notes on whatever's off.
A diff viewer with file tree, passing checks, and inline comments. See exactly what changed across every file before anything merges—all in the browser.
A clean PR on a kratt/* branch into your normal review flow. CI runs exactly as it always does—no special handling.
Because each environment is an isolated Linux VM, you can run as many as the work demands. One per open task, one for a teammate, one long-running and one quick fix—each with its own machine, branch, and pull request, none stepping on the others.
An agent that can't run your code can't check its work. Because this one works on a real machine with your stack running, it runs the full suite and drives the app in a real browser before it hands the change to you. Watch the activity stream, the live terminal, and a healthy-services panel side by side.
A diff viewer for every change with a file tree, passing checks, and inline comments—before anything merges. No copy-paste, no context switching to read what the agent did.
Front-end bugs are hard to hand to an agent: it can't see what you see, and a vague bug report isn't a reproduction. kratt-cloud runs your app in a real Chrome—driven by Playwright—and records the whole session: every console message, network call, navigation, and click. When something fails, the agent already has the logs and the exact steps to reproduce it.
Open the running app from a public URL, try it yourself or send it to a teammate, and pin notes right on the page. Their feedback and their full session come back to the agent as a precise reproduction.
The change lands as a clean PR from a kratt/* branch into your normal review flow—checks green, ready to merge. No manual branching, no patch files.
Plans, docs, diagrams and reports land in the same workspace as the code, and you read them there, rendered, without cloning anything.
Markdown, HTML, images and Mermaid diagrams open rendered in the file workbench, with links that navigate the repo. Flip to source, edit, save—or flag a passage for the agent.
Instead of a wall of chat text, the agent shows a UI change or a design proposal as a short page with screenshots and before/after—one click from its message.
Agents keep a task list you follow as it ticks over. If a VM dies mid-task, the list and its handoff notes let the next agent continue.
Every AI session is kept and can be read from other workspaces, so "why did we build it this way?" has an answer—for you, and for the next agent.
The desktop, the in-VM browser, VS Code, child VMs, UI tracing, static sites, root access: each is a plugin. Turn on what a project needs and leave the rest off. Smaller VMs cost less and expose less.
| Plugin | What it adds | State |
|---|---|---|
| Git & PRs | Branches, pull requests and CI | on |
| Tests | Suite runs with per-file results | on |
| Remote browser | Cloud browser you can take over | on |
| Child VMs | Agents start helper VMs | on · org default |
| IDE | VS Code in the browser | off |
| Desktop | Linux desktop to watch and drive | off |
| Privileged mode | Temporary root on request | denied · project |
| Kratt Tycoon | Shows this VM on the office view | on |
Start a task, disconnect, and check on it from your phone later—it keeps going. Heavy builds and test runs use server capacity, not developer laptops. The environment is remote by design; it was never tied to a single device.
Drive kratt-cloud from a laptop, desktop, or phone—it's just a browser tab. The agent runs server-side, so disconnecting never stops the work.
The primary interface is the AI CLI, but you can go hands-on whenever you want—drop into a full VS Code in the browser. Set breakpoints, run commands, edit directly, with zero local setup.
A full Linux machine: terminal, Docker, and the entire apt ecosystem. Run Docker Compose services, install any library, and tune the environment to your stack.
Once a machine is set up, snapshot it. Every teammate and agent then starts from the same configured image.
Each repo carries its own .kratt.json—its Docker services, dev servers, and test runner come up the same way every time. Put several repos on one machine and each brings up its own stack, so a multi-repo app runs together on a single VM. Full Linux—install any package, run Docker Compose, then snapshot the configured machine into a team image everyone reuses.
{ "steps": [ { "kind": "docker", "file": "docker-compose.yml" }, { "kind": "bash:setup", "bash": "npm install" }, { "kind": "bash:setup", "bash": "npm run migrate", "dir": "packages/api" }, { "kind": "backend", "name": "api", "bash": "npm run dev", "dir": "packages/api", "port": 4000, "healthcheck": true }, { "kind": "frontend", "name": "web", "bash": "npm run watch", "dir": "packages/web", "port": 3000, "expose": true } ], "prBranch": "main" }
A small team signs in with GitHub and runs its first workspace the same day. An enterprise plugs kratt into its identity provider, its own cloud account and its review process. Same product, same controls—you turn on what you need.
No platform team required. Sensible defaults are on from day one, and the controls are there when you grow into them.
Built to sit inside an existing security and compliance story, not next to it.
An admin adds Jira, Linear or Notion once. Each member signs in with their own account, so the agent acts as them—no shared bot tokens. Big servers stay out of context until a task needs them.
Declare skills and CLI plugins for the org, a project, a repo or yourself. kratt installs them into every AI CLI on every VM—conventions travel with the work.
Versioned builds from a clean, pushed tree; releases to S3, CloudFront or Elastic Beanstalk; static sites on a CDN that outlive every VM, with deploy keys for CI.
Dictate a prompt from your phone on the org's own speech key. Agents get short-lived cloud browsers you can watch live and take over when a step needs a human, such as a login.
Every boundary around a workspace is enforced by the platform, not by the agent's good behaviour. An agent gets a machine to work on, never the keys to your repo.
Keys are sealed with AWS KMS under your org's key. The VM only holds placeholders—the real value is injected outside it, on the way to the bound host.
The agent is sandboxed inside its VM and runs unprivileged. Root is granted only when you explicitly enable it.
Agents push only to kratt/* branches through kratt's git tools, which refuse any other branch. Pair it with branch protection in GitHub.
Each task gets its own VM, archived or deleted when the work is done and never shared, so the blast radius stays one machine.
Outbound traffic from agents, services, containers and root is logged and checked against the workspace allowlist.
The control plane reaches each VM with that VM's own SSH key and pinned host key. A leaked key opens one machine, never the fleet.
The control channel has its own reserved CPU and memory, so a runaway build or test run is stopped before the machine becomes unreachable.
Approvals, secret use, egress changes, MCP calls and admin actions go to an append-only log that records which service wrote each entry.
Every channel between a VM and the control plane is mutually authenticated and certificate-pinned, and the platform is built to assume a workspace could be hostile—so a compromised task stays contained to its own disposable machine.
An ambient, read-only view of every team's agents, drawn as an office. Each team gets a room and each agent a desk; screens show who is working and who needs an answer, merged pull requests stack up per repo, and a VM that runs out of memory shows up as a desk on fire. Pair a wall screen with a one-time code.
Only states and counts reach it—never prompts, code, PR titles or anything anyone typed.
An isolated VM for every agent, with approvals, network policy, secrets outside the machine and a full audit trail—for one team or the whole organization.