Claude Cage: A VM Sandbox Built for Claude Code Sessions

Claude Cage — the Lee-xeo desktop project that hit roughly 2,400 GitHub stars within two weeks — wraps Claude Code and Claude Desktop inside a local virtual machine so proxy paths, browser fingerprints, and project folders stay isolated from your everyday macOS or Windows environment. The README (MIT-licensed, built on the agent-vm stack) targets power users who manage multiple Claude subscriptions, remote SSH deployments, or strict network containment without maintaining a separate VPS per account.

It is not an Anthropic product. Treat it as operator tooling in the same risk bucket as personal Claude Code on classified nets: useful when configured carefully, dangerous when mistaken for compliance.

Agents that act on your behalf need rules. See how explainx helps secure your agents →

TL;DR

What problem Cage claims to solve

The README opens with a blunt pain point: builders juggle VPS hosts, fingerprint browsers, and environment checks while fearing account bans when Claude traffic looks inconsistent.

Cage compresses that into one Electron-style workbench:

• Terminal for Claude Code
• Editor for diffs
• Cage browser for OAuth and web logins
• Proxy manager with Clash or Mihomo YAML import

Shared project folders map explicit directories to the guest; host SSH keys and personal browser cookies do not auto-import, reducing accidental credential bleed — the same class of mistake we saw in Grok Build GhostShares when defaults were too permissive.

Architecture in builder terms

Cage inherits agent-vm, Lima (macOS and Linux guests), gVisor tap-vsock networking, and Mihomo as the bundled proxy core. The network model is strict:

• Public IPv4 TCP exits through the selected proxy node
• DNS rides the same tunnel
• No automatic direct fallback when the proxy dies — the guest stays offline
• Optional Tailscale inside the guest for private admin paths

Before outbound access, Cage runs network and isolation checks. Failures pause the internet until you fix the proxy or guest config — closer to Claude Cage's cited Claude-Guardian patterns than to a naive SOCKS switch in .bashrc.

Claude Cage VM sandbox isolating Claude Code network traffic from the host machine

Multi-account and mobile workflows

Cage advertises Claude Code subscription management: view allowances, assign accounts to new sessions, and switch accounts after explicit authorization. That targets freelancers running several Max or Pro seats — a workflow Anthropic does not document officially and employers may ban under trade-secret policies.

Mobile apps let you approve tool calls or steer the remote browser while the VM stays on a home Mac mini — the operational pattern n8n's Nod agent also recommends when laptops sleep.

Deployment beyond the laptop

Advanced users can SSH-deploy the Linux guest to a VPS so heavy jobs keep running when the lid closes. That turns Cage into a poor person's dedicated Claude Code bastion, comparable to running Codex on a remote dev box but with a GUI proxy wizard.

Tailscale integration means the guest can reach private Git hosts or internal APIs without punching public holes — useful for indie hackers, risky if you bridge into corporate VLANs without InfoSec sign-off.

Limits the README admits

Cage is explicit about boundaries worth quoting in your runbook:

• Host project folders are live mounts — Cage can delete or git-push real files on your machine.
• Projects inside one Cage config share one guest — no per-project VM isolation.
• Checks do not guarantee Anthropic account safety.
• Intel Macs and several ARM host combos are unsupported in current builds.

None of that blocks experimentation; it does block calling Cage "secure enclave" in a SOC2 narrative.

How Cage compares to other isolation options

If your goal is corporate IP protection, use employer-provided VDI and DLP — not a community VM — following lessons from Point72's alleged Codex leak.

Getting started safely

The README's one-liner tells any coding agent to install from GitHub and wire Cage's proxy to an existing Clash node. Human steps:

1. Download from lee-xeo.github.io/Claude-Cage for your host OS.
2. Import a trusted proxy subscription; Cage will not protect you from a malicious provider.
3. Create a guest matching your licensed OS image.
4. Open a test repo before pointing Cage at production monorepos.

Run Cage's built-in environment diagnostics and compare with a third-party browser test if you rely on IP reputation.

Installation paths the README documents

Cage ships signed macOS builds, signed or unsigned Windows previews, and Linux packages for Debian and Ubuntu hosts. First launch walks through:

1. Proxy import — paste Clash or Mihomo YAML; pick exit node.
2. Guest OS selection — match licensed Windows or macOS images, or pick Debian or Ubuntu for a lighter guest.
3. Storage placement — virtual disks can grow large; SSD recommended.
4. Project mount — choose folders deliberately; deletes propagate to host.

The README's agent-install one-liner is designed for Claude Code itself to run setup — meta, but only if you trust the agent with proxy credentials.

Official releases and checksums live on GitHub Releases; manifests are not committed. Verify hashes before running binaries from trending repos.

Proxy chains and fingerprint sync

Cage's differentiator versus a manual VM is integrated proxy governance:

• Import subscription URLs or local Mihomo configs.
• Configure chain proxies when your provider requires a transit hop.
• Optionally sync timezone and locale with the proxy egress IP so Claude sessions look geographically consistent — a feature power users want and security teams worry about.

When checks fail, Cage pauses outbound traffic rather than falling back to raw host internet. That fail-closed default is the right choice for leak prevention, but it also means broken nodes feel like "Claude is down" until you fix the proxy.

Mobile remote and Tailscale use cases

Cage markets Android and iPhone clients to approve tool calls or steer the guest browser while away from the desk. Pair that with Tailscale inside the guest to hit private Git remotes without exposing them to the public internet.

Treat Tailscale ACLs like production firewall rules: if the guest can reach internal Jenkins, so can a compromised Claude session prompt.

Community velocity and maintenance risk

Roughly 2,400 stars in eleven days (per the November 11, 2026 GitHub snapshot) means fast feature churn and 297 commits already on main. Trending status attracts security researchers and scammers alike — verify you cloned Lee-xeo/Claude-Cage, not a typosquat fork.

The project descends from agent-vm with Lima, gVisor networking, and code-server inside the guest. Expect breaking changes while the author adds Windows 11 guest polish and Intel Mac support gaps remain documented.

Claude Cage open-source sandbox for Claude Code sessions with proxy-isolated virtual machine networking

Ethics and ToS reality

Using proxies to evade geographic or account limits may violate Anthropic's terms even if Cage technically works. explainx.ai documents tools; it does not advise circumventing vendor policies. If you only need isolation from personal malware risk, a local guest without location spoofing is the defensible configuration.

When Cage is the wrong tool

Skip Cage if you only need vanilla Claude Code on a trusted corporate laptop with MDM — your security team already provides VDI. Skip it if you cannot maintain proxy hygiene; a leaked residential node is worse than no proxy. Skip it if you require audited Anthropic support; Cage explicitly disclaims affiliation.

Reach for Cage when you already run multiple Claude subscriptions, test geo-dependent workflows, or want browser logins quarantined from your personal Chrome profile. It is operator gear, not a team IDE replacement.

Document your setup so the next engineer knows which guest disk holds which account — the README warns all projects in one config share one VM.

Before you depend on Cage for client work, run a dry week: clone an open-source repo inside the guest, run tests, and confirm no host SSH keys leaked into the project mount. Compare logs with your normal Claude Code session on the host. If the only win is IP geolocation, you may not need a full guest — a corporate VPN plus a separate OS user account might be enough and easier to defend in a security review with legal.

Related on explainx.ai

• Claude Code commands reference
• Loop engineering with coding agents
• n8n Nod local personal agent
• Accenture contractor Claude Code incident
• Point72 Claude Codex lawsuit claims
• Grok Build data exposure defaults
• What are agent skills

Repository stats and feature list reflect the public GitHub README and releases page as of November 11, 2026.