My main motivation was sandboxing. Agents are extremely powerful, but they need a framework they can work well within (at least that is my point of view). For production-like use, I think that means real isolation, so I wanted to try putting the agent inside a Firecracker microVM. My goal was to build something I would actually feel comfortable running on my main PC.
In Fire mode, the agent has no host filesystem access and no API or LLM credentials. Authenticated HTTP calls go through a host-side broker that enforces policy, injects credentials, redacts responses, and only allows configured endpoints/methods. LLM calls are proxied host-side too.
The agent itself is intentionally small and now that the foundation is in place, I'll try to start expanding it with more tools and skills. If this sounds interesting, feel free to try it, take it apart, or build on it. Looking forward to all the feedback :)