Superserve — Firecracker microVM Sandboxes for Long-Running AI Agents

Overview

Superserve is an open-source compute layer that lets AI agents live inside isolated Firecracker microVMs with no session time limits. Released in July 2026, it addresses a critical pain point for autonomous agent operators: most sandbox providers kill your agent after 24 hours, forcing constant state rebuilding and fighting timeouts.

Superserve's key innovation is VM snapshotting: you can snapshot a running VM at any point, fork it into parallel branches, and resume exactly where you left off. Each agent gets its own VM with no shared kernels, providing true isolation. It also includes a credentials broker so agents never touch raw API keys directly, and egress is locked to URLs you specify.

You bring your own agent (Claude Code, Codex, etc.). Superserve handles the durable compute underneath. Available at superserve.ai.

Features

• Firecracker microVM isolation: Each agent runs in its own VM with no shared kernels
• No session time limits: Agents can run for days without timeouts
• VM Snapshotting: Capture running VM state at any point
• Parallel Forking: Fork a snapshot into parallel execution branches
• Resume Capability: Continue exactly where you left off
• Credentials Broker: Agents never access raw API keys directly
• URL-Locked Egress: Network egress locked to specific URLs you authorize
• MCP Support: Native Model Context Protocol integration
• TypeScript and Python SDKs: Developer-friendly APIs for both ecosystems
• Open Source and Self-Hostable: Full control over your agent infrastructure

Installation

# Install via npm
npm install @superserve/sdk

# Or via pip
pip install superserve

Quick Start

import { createSandbox } from "@superserve/sdk";

const sandbox = await createSandbox({
  image: "ubuntu:22.04",
  agent: "claude-code",
  credentials: {
    OPENAI_API_KEY: process.env.OPENAI_API_KEY,
  },
  egress: ["https://api.openai.com"],
});

// Run your agent
await sandbox.run({
  prompt: "Build a React app with these requirements...",
});

// Snapshot the current state
const snapshot = await sandbox.snapshot();

// Fork into parallel branches
const branch1 = await snapshot.fork();
const branch2 = await snapshot.fork();

Core Concepts

Durable Compute

Unlike ephemeral sandbox providers, Superserve treats VMs as durable infrastructure. Your agent's state persists indefinitely, enabling multi-day autonomous workflows without interruption.

Snapshot and Fork

The snapshot/fork model enables powerful workflows:

1. Run an agent for several hours on a complex task
2. Snapshot the progress
3. Fork into parallel branches to try different approaches
4. Resume the original branch if a fork fails

Security Model

• Credential Broker: API keys are injected at runtime, never exposed to agents
• Egress Controls: Network traffic locked to whitelisted URLs
• VM Isolation: No kernel sharing between agent VMs

Examples

Long-Running Codebase Refactoring

const sandbox = await createSandbox({
  agent: "codex",
  credentials: { GITHUB_TOKEN: process.env.GITHUB_TOKEN },
});

// This can run for days without interruption
await sandbox.run({
  prompt: "Refactor the entire codebase to use TypeScript. " +
          "Start with the core modules and work outward.",
});

Parallel Experimentation

const baseSnapshot = await sandbox.snapshot();

// Try three different approaches in parallel
const approaches = ["monolithic", "microservices", "event-driven"];
const branches = approaches.map(approach => baseSnapshot.fork());

for (const branch of branches) {
  await branch.run({
    prompt: `Design a ${approach} architecture for the system`,
  });
}

Secure API Integration

const sandbox = await createSandbox({
  credentials: {
    STRIPE_API_KEY: process.env.STRIPE_API_KEY,
    AWS_SECRET_KEY: process.env.AWS_SECRET_KEY,
  },
  egress: [
    "https://api.stripe.com",
    "https://s3.amazonaws.com",
  ],
});

Pros

• ✅ Solves the 24-hour sandbox timeout problem
• ✅ True isolation via Firecracker microVMs
• ✅ Snapshot/fork for parallel experimentation
• ✅ Credentials broker for secure API key management
• ✅ MCP native support
• ✅ Open source and self-hostable
• ✅ TypeScript and Python SDKs

Cons

• ✅ Newer project — smaller community than established providers
• ✅ Firecracker dependency adds infrastructure complexity
• ✅ Self-hosted option requires VM management expertise
• ✅ Cost of running dedicated VMs per agent at scale

When to Use

• Long-running autonomous agents: Tasks spanning multiple days
• Parallel experimentation workflows: Need to try multiple approaches
• Security-sensitive deployments: Require credential isolation
• Production agent systems: Need durable, observable infrastructure

Resources

• Official Website
• GitHub Repository
• Documentation
• Show HN Announcement