Microsoft eXecution Container (MXC)

Canonical version: Microsoft eXecution Container (MXC).

Microsoft eXecution Container (MXC) is an open-source (MIT License) sandboxed code execution system from Microsoft for running untrusted code (model outputs, plugins, tools) safely on Windows, Linux, and macOS. Instead of shipping one isolation technology, it puts multiple containment backends, from OS-native process sandboxes to full VMs, behind a unified JSON configuration schema and a TypeScript SDK. It is the engine behind local sandboxing in GitHub Copilot CLI.

Architecture

• Policy-driven: JSON configs (versioned schemas) define execution parameters and security policy across three layers: filesystem (read-only/read-write path whitelists), network (allow/block outbound, proxy support), and UI (clipboard, display, GUI access)
• Lifecycle: one-shot execution or a stateful provision → start → exec → stop → deprovision flow
• Implementation: Rust native binaries and shared library crates, wrapped by the @microsoft/mxc-sdk npm package

Per-OS backends

Caveats

Early preview. From the README: "no MXC profiles should be treated as security boundaries currently" and the default policies generated by the SDK are "overly permissive". Denied paths are not yet supported on Windows, and network proxying is cooperative (not enforced) on Linux/macOS. Treat it as a guardrail against accidents, not as a boundary against a determined attacker, at least for now.

References

• Repository: https://github.com/microsoft/mxc
• TypeScript SDK: https://www.npmjs.com/package/@microsoft/mxc-sdk
• Used by Copilot CLI local sandboxing: https://docs.github.com/en/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing

Related

• GitHub Copilot Sandboxing
• GitHub Copilot CLI
• Windows Sandbox
• Docker Sandboxes
• OpenSandbox
• AI Agents
• AI Agent Permissions
• microVM

About Sébastien

Ready to get to the next level?