TenBox: security tool for Hermes Agent

Lightweight virtual machine monitor for running OpenClaw, QwenPaw and Hermes Agent in isolation

What TenBox does

TenBox is a C++ VMM with backends for WHVP on Windows, Hypervisor Framework on macOS (Apple Silicon and Intel) and KVM on Linux (x86_64 and arm64, including Raspberry Pi). It boots standard Linux kernels with an initramfs and offers VirtIO devices for block, network, GPU, input, serial, sound and filesystem, qcow2 and raw disk images, virtiofs shared folders that can be read-only, and clipboard sharing. Windows and macOS have native GUI managers, and Linux runs a systemd daemon, tenboxd, with a tenbox CLI for creating, starting, stopping and inspecting VMs.

NAT networking with port forwarding lets guest services be exposed on host ports, and a built-in OpenAI-compatible proxy maps guest requests to configurable upstream providers. On Linux a browser-based remote desktop and an eight-digit pairing code flow are included. The Linux installer registers an apt repository and requires glibc 2.31 and /dev/kvm, while Windows and macOS installers come from the website or GitHub Releases.

Key features

Hypervisor backends: WHVP on Windows, Hypervisor Framework on macOS, KVM on Linux
Shared folders through virtiofs, optionally read-only
tenboxd daemon and tenbox CLI on Linux for managing VMs
Built-in OpenAI-compatible proxy to configurable upstream providers
NAT networking with host and guest port forwarding
Browser-based remote desktop on Linux

When to use it

Running an agent in a VM that sees only folders you share with it
Hosting an agent on a Raspberry Pi 5 or other Linux box with KVM
Keeping provider credentials on the host while the guest calls a local proxy

Who it is for: Users who want to run AI agents on their own computer without giving them access to the whole machine.

How it fits with Hermes Agent

The repository description names Hermes Agent, alongside OpenClaw and QwenPaw, as an agent it is built to host, while the VM itself is a general Linux guest.

How to install TenBox

These commands are copied from the project's README. Check the repository for the latest steps before you run them.

curl -fsSL https://tenbox.ai/install.sh | sudo sh

Requirements: On Linux, Debian 11+, Ubuntu 20.04+ or Raspberry Pi OS 11+ (amd64 or arm64) with glibc 2.31+ and /dev/kvm

FAQ

What is TenBox?

TenBox is a cross-platform virtual machine monitor for running AI agents in isolated Linux VMs. Each agent can only access the files you explicitly share with it.

How do I install TenBox?

On Debian, Ubuntu or Raspberry Pi OS, run curl -fsSL https://tenbox.ai/install.sh | sudo sh, which adds the TenBox apt repository and enables tenboxd. On Windows and macOS, download the installer from tenbox.ai or the GitHub Releases page.

Is TenBox free and open source?

GitHub reports the license as NOASSERTION, meaning it could not identify a standard license. Check the repository's license files before reuse.