Give an AI coding agent a safe, sandboxed virtual machine it can boot, use, and destroy without touching the host system.
Automate spinning up test environments with specific CPU, memory, and disk configurations for CI or QA.
Let an agent run and observe an operating system boot process for debugging or educational purposes.
Build a controlled environment for running untrusted or experimental code inside a disposable VM.
| r0guesch0lar/qmp-mcp | 132ikl/game | 1lystore/pay-dcp | |
|---|---|---|---|
| Stars | 2 | 2 | 2 |
| Language | Rust | Rust | Rust |
| Last pushed | — | 2020-12-30 | — |
| Maintenance | — | Dormant | — |
| Setup difficulty | hard | moderate | moderate |
| Complexity | 4/5 | 2/5 | 3/5 |
| Audience | developer | general | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires QEMU installed and, for full speed, KVM access on the host alongside understanding of the MCP tool-calling setup.
qmp-mcp is a server that lets an AI agent control a single QEMU virtual machine through the Model Context Protocol, a standard way for AI tools to expose actions to an agent. Instead of letting the agent run raw commands against your computer, the agent describes the kind of virtual machine it wants, and the server builds, boots, and manages that machine on the agent's behalf, then tears it down when finished. The core idea is that the agent never touches QEMU or your filesystem directly. It sends a structured description called a Hardware Spec, listing things like the machine type, CPU, number of virtual processors, memory, disks, boot media, network, and display. The server checks every field for safety, rejects anything invalid before starting the virtual machine, and only then builds the actual QEMU command from it. There is an optional escape hatch that allows raw QEMU flags, but it is turned off unless you explicitly enable it for trusted setups. The server only ever runs one virtual machine at a time, moving it through stages from starting, to running, to optionally paused, to stopped. If the underlying QEMU process exits on its own, such as from a crash or a guest shutdown, the server notices and resets back to a clean state. While the machine is running, the server talks to it using QEMU's own control protocol over a private connection that is never exposed on the network, offering tools to pause, resume, check status, and capture the screen. For commands that do not have a dedicated tool, there is a generic command option, but it is restricted by a Command Policy: a safe allowlist by default, with genuinely dangerous commands permanently blocked and unable to be re-enabled. Disk images and boot media are referenced by name rather than by file path, and are looked up inside two folders you control, one for writable disk images and one for read only installation media. This project is aimed at developers building AI agents or tools that need to safely spin up and control a real virtual machine, such as for testing, sandboxed code execution, or automated system administration tasks. It ships in two interchangeable versions, one written in TypeScript and one in Rust.
An MCP server that lets an AI agent safely create, control, and tear down a single QEMU virtual machine through a validated, allowlisted command interface.
Mainly Rust. The stack also includes Rust, TypeScript, QEMU.
Setup difficulty is rated hard, with roughly 1h+ to a first successful run.
Mainly developer.
This repo across BitVibe Labs
Verify against the repo before relying on details.