Husk 0.1.0 · Apache-2.0

Give your agent a computer.

A disposable Linux machine an agent can drive, and a way to turn a chat transcript into a bot. Runs on hardware you already own. No account, no telemetry.

Quickstart What Husk is

On Docker and Podman you get kernel isolation. On the local provider you get process guardrails — a pinned working directory, a scrubbed environment, a command deny list. That stops accidents. It does not stop an adversary, and a prompt-injected model is closer to an adversary than to an accident. The security page is specific about which one you have.

husk up scratch

$ husk up scratch
creating scratch...
✓ scratch is up

  id         cmp_5j8svxeqer9p
  provider   local  (WSL2 (Ubuntu))
  isolation  guardrails only — not a sandbox
  workdir    /work
  network    egress

$ husk exec scratch -- 'uname -sr; echo hi > /work/a.txt; cat /work/a.txt'
Linux 6.18.33.2-microsoft-standard-WSL2
hi

$ husk exec scratch -- 'sudo rm -rf /'
error refused: privilege escalation
hint:  add a pattern to guardrails.allowCommands in husk.yaml if this is intentional

The whole install, for an MCP client

One line gives Claude Code — or Cursor, or Zed, or anything speaking MCP — a Linux machine mid-conversation.

claude mcp add husk -- npx -y @husk-ai/mcp

There is no second step. Nothing is created until the model calls a tool, and the first tool result tells it plainly what kind of machine it got. MCP covers the tool list, the flags, and the other clients.

Documentation

Start here4 pagesA local-first runtime that hands an agent a disposable Linux computer, and turns a chat transcript into a bot you can run.Computers7 pagesWhat a computer is, how one gets created, and the small interface every provider has to satisfy.Chat to bot5 pagesClaude Code, ChatGPT, Cursor, Gemini and markdown, normalised into one Transcript.MCP1 pageOne line of config, seven tools, and no account. Also: what the model is told about its own containment.Models4 pagesOne surface over eleven providers — how an alias becomes a model, what happens when that model says no, and which code path your command actually takes.Security5 pagesWhat Husk protects you from, what it does not, and how to tell in one command which of the two you are running.Guides4 pagesRun husk serve on a box you own — the token, binding past loopback, a reverse proxy that does not break SSE, and a systemd unit.Reference5 pagesEvery command, every flag it actually parses, its exit code, and the flags that exist in the parser but not in --help.Help2 pagesThe questions people ask before they install, and the ones they ask an hour later.

These docs describe the code, not the plan

Every claim on this site was checked against the source in this repository, and every terminal transcript was produced by running the command. Where the code and the design documents disagree, the pages say so in a Not yet note rather than describing something that does not work.

The current set of those, so you can find them quickly: MCP is stdio only, the reaper does not sweep containers, Discord, Slack and Telegram triggers are not wired up, husk run ignores fallbackModels, and the SDK targets a different API than the one the server serves.

Stuck on something specific? Troubleshooting lists the real failure modes with the exact string husk prints for each, and the FAQ answers the rest.