Microsoft Execution Containers (MXC)

// Overview

Microsoft Execution Containers (MXC) is a policy-driven execution layer for untrusted code and dynamically generated workloads — model output, plugins, tools, agent harnesses or whole agents. A developer declares what the workload needs, such as the files it may read or write and the network destinations it may reach, and MXC enforces that boundary with a suitable container. The policy sits outside the workload's control, so an agent or the code it generates cannot grant itself more access.

One JSON configuration schema and typed SDKs for Rust, .NET and Node hide the platform differences. MXC maps the requested controls onto a backend for each operating system: AppContainer-based process containers on Windows 11, Seatbelt on macOS and Bubblewrap on Linux. Windows 11 also offers session containers (a separate OS session with its own identity, desktop, clipboard and input), WSL containers for a Linux environment, and an experimental microVM backend for a hardware-backed boundary.

Policies can run in three modes. Enforcement blocks anything not granted; learning mode also blocks it but writes a JSON activity report that helps you author a policy; permissive mode allows and records ungranted operations while you draft one. Microsoft announced MXC as an early preview at Build 2026 and made it generally available on October 7, 2026, with agents such as GitHub Copilot, OpenAI Codex, OpenClaw, Replit, LM Studio and Unsloth AI already integrating it.

// What it does

• One policy for files (read-only, read-write and denied paths), network egress and UI access such as clipboard and display
• Policy enforced outside the workload, so an agent cannot widen its own permissions
• Process containers on all three OSes: AppContainer on Windows 11, Seatbelt on macOS, Bubblewrap on Linux
• Windows-only session containers and WSL containers, plus experimental microVM and Hyperlight backends
• Enforcement, learning and permissive modes, with JSON activity reports for writing a policy
• Typed SDKs on crates.io (mxc-sdk), NuGet (Microsoft.Mxc.Sdk) and npm (@microsoft/mxc-sdk)
• Telemetry off by default; it needs an opt-in, user consent and permitting admin policy

// Getting started

You do not need to clone the repository: install an SDK for your language from its package manager and spawn a workload with a containment request. The examples below use the Node SDK from the README.

npm install @microsoft/mxc-sdk

import { spawn, type ContainerRequest } from '@microsoft/mxc-sdk/v1';

const request: ContainerRequest = {
  command: 'node -e "console.log(\'hello from container\')"',
  network: { egress: { default: 'deny' } },
  timeoutMs: 30_000,
};

const child = await spawn(request);

wxc-exec.exe --debug config.json

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Let a coding agent run the commands it writes while keeping it away from the rest of the disk and the network
• Contain third-party plugins or MCP tools inside a desktop app with a declared, reviewable policy
• Give an IT team one place to cap what local agents may touch, enforced by the OS rather than by each agent
• Draft a least-privilege policy by running a workload in learning mode and reading its activity report

// How Microsoft Execution Containers (MXC) compares

Microsoft Execution Containers (MXC) alongside other open-source code sandboxes & isolation tools AI/TLDR tracks, ranked by GitHub stars.