llmcli is an isolated Docker environment that runs Claude Code, OpenAI Codex, Gemini CLI, Grok, OpenCode, Cursor Agent, and Antigravity — with every toolchain they need to actually build software — behind a containment boundary your agents cannot cross.
One bin/dockerbuild, one docker compose up. Your host filesystem stays yours.
Why now
Agents now install packages, rewrite configs, and execute whatever they just wrote. Running that on your host — next to your SSH keys, your cloud credentials, your other projects — is the part of the workflow nobody signed off on.
A hallucinated rm, a poisoned dependency, a prompt-injected install script — on your host, any of these reaches everything you own. Inside llmcli, the worst case is a disposable container and a rebuilt volume.
Unattended agents are where the leverage is — but nobody sane runs --dangerously-skip-permissions on bare metal. Containment is what makes "skip permissions" a workflow instead of a gamble.
Seven CLIs, seven install paths, seven credential stores, seven version treadmills — multiplied by every engineer. llmcli pins the whole combination in one Dockerfile. Bump a version in one place; everyone rebuilds the same environment.
What's inside
Not a base image you finish yourself — a batteries-included workbench. The agents are installed. The languages they'll build with are installed. The versions are pinned, tested together, and bumped on a visible monthly changelog.
Bring your own API keys via .env, or use each CLI's interactive login — credentials persist in the named volume across image rebuilds, so a toolchain bump never logs you out.
An agent that can't compile, test, or run its own output is autocomplete with extra steps. llmcli ships the full polyglot bench — including the legacy stacks that real migration work runs on.
Graphify turns any folder of code and docs into a queryable knowledge graph the agents consult instead of re-reading raw source — parsed locally with tree-sitter, cutting the token burn of context reloading before it hits your bill.
The containment model
No clever tricks. A boring, auditable boundary at every surface — which is exactly what you want between an autonomous agent and everything else you run.
llmcli user, UID-matched to yours# three agents, three tickets, overnight $ ssh -p 3022 llmcli@localhost Welcome — llmcli · isolated agent workbench $ screen -S ticket-1289 $ claude --dangerously-skip-permissions \ -p "Fix the race in payments worker" # Ctrl-A D — detach. It keeps working. $ screen -S ticket-1290 $ codex exec "Migrate the config loader" $ screen -ls ticket-1289 (Detached) ticket-1290 (Detached)
The honest comparison
Isolation alone is table stakes in 2026. The question is what's waiting inside the boundary when your agents get to work.
| Capability | llmcli | Cloud sandboxesE2B, Modal, … | Docker Sandboxes | DIY devcontainer |
|---|---|---|---|---|
| Runs on your hardware, data never leaves | Yes | No — their cloud | Yes | Yes |
| Seven major agent CLIs pre-installed & pinned | Yes, tested as a set | Bring your own | Bring your own | You build it |
| Full polyglot toolchain (15 languages) | Yes | Per-image setup | Per-image setup | You maintain it |
| Persistent, SSH-accessible, detachable sessions | Yes — screen over SSH | Session limits / billing | Disposable by design | If you wire it |
| Cost model | Your hardware, flat | Metered per second | Local | Local |
| Credential state survives rebuilds | Named volume | Varies | Varies | You wire it |
| Knowledge-graph skill to cut token burn | Graphify included | — | — | — |
| Path to governed forge, per-repo MCP, token attribution | Vetrix platform | — | — | — |
Competitor capabilities as generally available mid-2026; verify current vendor packaging for your evaluation. Cloud sandboxes are excellent for embedding execution in a SaaS product — that's a different job than a developer workbench.
Part of the Vetrix software factory
llmcli is the execution cell of a larger machine. Connect it to Vetrix — the sovereign, self-hosted software factory — and your agents don't just run safely, they run accountably.
## Per-stage totals Stage Input Output Total Dev 315 185 11,300 BackendCR 50 25 2,075 BackendQA 80 40 3,120 ───────────────────────────────── rc grand total: 16,495 tokens
Who runs llmcli
You've watched an agent "clean up" the wrong file once. Never again. You want the leverage of skip-permissions with a boundary you personally verified — and you can, because the source is open to audit.
Forty engineers, seven CLIs, one question from the CISO: "where do these things run?" One pinned image, one containment story, one answer. Pair it with Vetrix and the audit log writes itself.
Rust today, .NET tomorrow, a COBOL migration you don't want to talk about. One container covers the bench — and every project's agent state stays isolated in its own volume.
Get started
First build takes 10–20 minutes (it's compiling half the languages in existence). After that, version bumps rebuild in about a minute thanks to layer caching.
# 1. Build — prompts once for your SSH public key $ bin/dockerbuild # 2. Bring it up — stays running, survives reboots $ docker compose up -d appmerc_llmcli # 3. In — pubkey only, the single door $ ssh -p 3022 llmcli@localhost ✓ seven agents · fifteen toolchains · no host filesystem access
Seven fast-moving agent CLIs and fifteen toolchains are a version treadmill. That treadmill is the product — every pin bumped on a visible changelog, tested as a set, upgraded with a one-line edit.
Claude Code → 2.1.197 · Codex → 0.142.5 · Gemini CLI → 0.49.0 · OpenCode → v1.17.11 · Node → 24.18 LTS (CVE fix) · .NET → 10 LTS
Pins verified together before release. Your persisted HOME and agent logins survive every rebuild untouched.
Edit the ARG, rebuild, recreate. Layer caching keeps npm-only bumps to ~1–2 minutes.
Questions
A self-hosted Docker container purpose-built as an AI agent sandbox: Claude Code, OpenAI Codex, Gemini CLI, Grok CLI, OpenCode, Cursor Agent, and Antigravity pre-installed and version-pinned, plus fifteen programming toolchains and the Graphify knowledge-graph skill — all behind a strict containment boundary with no host filesystem access and two published ports: a pubkey-only SSH port and a loopback-bound OAuth callback relay.
That's the job. The container mounts no host paths, lives on an isolated bridge network with no route to your other containers, and publishes only a pubkey-only SSH port plus a loopback-bound OAuth callback relay — no other network entry point. If an agent goes sideways, you lose a disposable container — not your machine. For strict outbound control, the docs cover host-level egress allowlisting down to the LLM API endpoints alone.
Those are metered execution APIs on someone else's infrastructure — the right tool for embedding code execution inside a SaaS product. llmcli is a persistent, local, self-hosted developer workbench: flat cost, no session limits, no third party between your agents and your code.
Those give you an empty isolated room. llmcli gives you the room with the workbench already bolted down: every major agent CLI installed and pinned as a tested set, the toolchains to build real software in fifteen languages, persistent credential state, and detachable long-running sessions over SSH — plus a growth path into the Vetrix factory for MCP access, orchestration, and token attribution.
Fill ANTHROPIC_API_KEY, OPENAI_API_KEY, XAI_API_KEY, GEMINI_API_KEY, and CURSOR_API_KEY into .env and the CLIs pick them up — or leave them blank and use each tool's interactive login. Either way, state persists in the named volume across image rebuilds, so a toolchain bump never logs you out.
Source available under the MIT License
We do. Seven fast-moving agent CLIs and fifteen toolchains are a treadmill — that's the point of the product. Pins are bumped on a visible monthly changelog, tested as a combination, and upgrading is a one-line edit and a short cached rebuild. Your persisted state survives every bump.