Qubicl

Give any AI agent a real, private computer on your machine.

Durable files. Terminal access. Web research. A persistent browser and desktop. Human takeover whenever you want it. No Qubicl account, cloud control plane, or model lock-in.

Quick start · Why Qubicl · Computers · Clients · Security · Docs

npm install -g qubicl-cli

Qubicl turns local Docker into observable computers for external AI agents. The agent stays in Codex, Claude, Open WebUI, Cursor, VS Code, or another MCP or OpenAPI client. Qubicl supplies the machine it works on.

your model or agent
        │
        │  MCP / OpenAPI / Open Terminal
        ▼
 localhost-only Qubicl gateway
        │
        ├── terminal + managed processes
        ├── durable, host-visible files
        ├── keyless web search + local extraction
        ├── persistent Chromium + desktop
        ├── packaged, operator-controlled skills
        └── live viewer + human takeover

Why Qubicl

Related MCP server: EdgeBox

Quick start

Requirements: Linux with Docker Engine or Docker Desktop, macOS with Docker Desktop, or Windows 11 through WSL 2 and Docker Desktop—plus Node.js 22 or 24 and Docker Compose 2.24+. Native Windows execution and WSL 1 are not supported; WSL installations must keep Qubicl state and computer homes in the WSL Linux filesystem under /home.

qubicl setup

The setup wizard checks Docker, compares computer presets, previews disk and resource use, obtains the selected images, and can create the first computer. Run Qubicl as your normal user, never with sudo.

Create another computer and connect an agent:

qubicl create computer-name --preset computer
qubicl connect computer-name --client codex

connect prints the client configuration; it never edits client files or prints a bearer token. For local stdio clients, the configuration is token-free.

git clone https://github.com/EldanRing/qubicl.git
cd qubicl
npm ci
npm run images:build
npm install -g --prefix "$HOME/.local" ./packages/cli
export PATH="$HOME/.local/bin:$PATH"
qubicl setup

Choose a computer

Presets share layers while exposing different capability contracts. Tools that the selected computer cannot support are absent from discovery.

Every preset includes native keyless web_search, local web_extract, and six verified Qubicl-native skill baselines with durable, agent-editable working copies. Operators choose which tools and skills each computer exposes:

qubicl tools computer-name
qubicl skills computer-name

Disabled tools disappear from MCP, OpenAPI, and Open Terminal, and cached calls fail closed.

Connect any agent

qubicl connect computer-name --client codex
qubicl connect computer-name --client claude-code
qubicl connect computer-name --client cursor
qubicl connect computer-name --client opencode
qubicl connect computer-name --client openclaw
qubicl connect computer-name --client hermes-agent
qubicl connect computer-name --client open-webui

Adapters cover Codex, Claude Code, Claude Desktop, Cursor, VS Code, Open WebUI, generic stdio and HTTP MCP, and direct OpenAPI. Static profiles can expose a smaller file, semantic-browser, visual-browser, or desktop catalog.

For Open WebUI, copy the generated configuration into Admin Panel → Settings → Integrations → Open Terminal. Qubicl supplies native durable-file browsing and search, filesystem-backed chat uploads, screenshots, browser tools, and explicitly published local previews without joining Open WebUI's Docker network.

See Client setup for exact instructions.

Watch and take over

qubicl view computer-name

Observation is passive. Take control fences agent tools and terminates its ordinary managed commands before handing you the keyboard and mouse. The persistent browser and explicitly managed desktop applications remain visible, so you can continue the exact task instead of starting over.

While the agent is acting, the viewer keeps Qubicl's green pointer at its latest desktop or managed-browser position and briefly pulses the exact click target. Semantic browser clicks are mapped from the page element through Chromium and the live noVNC canvas, so the indicator stays aligned through viewer resizing and letterboxing. It appears before input dispatch, survives viewer reloads, and clears when the agent loses its lease or a human takes control. It remains viewer-only—human input, webpages, and agent screenshots are untouched—and you can toggle it off from the viewer header.

If a controlling viewer disappears, Qubicl releases abandoned control after a short reconnect grace period. The operator can always recover explicitly:

qubicl control release computer-name

Built for daily use

• Publish an agent-started local web app through an authenticated loopback preview.

• Back up, verify, encrypt, restore, clone, and checkpoint durable homes.

• Apply offline, web-only, developer, or custom egress policies.

• Broker narrowly scoped credentials without placing the secret in the workload.

• Import bounded devcontainer definitions and use host-mediated Git workflows.

• Enable loopback-only SSH for editors and ordinary ssh/scp.

• Inspect a private, content-free audit trail and diagnose topology with doctor.

• Upgrade a computer in place while preserving its ID, token, policy, resources, and home.

Use qubicl help or qubicl <command> --help to explore the full CLI.

Security boundary

Qubicl keeps every computer inside one explicit Docker resource and filesystem boundary. Computers run without privileged mode, a Docker socket, host namespaces, arbitrary mounts, or passwordless elevation. The gateway listens only on 127.0.0.1; Chromium retains its Linux namespace and renderer seccomp-BPF sandboxes; model-facing files are confined to the durable home. Controller and workload processes share the computer container, so human takeover is a cooperative managed-process fence rather than a hostile-code boundary.

Qubicl is a Docker-based computer for trusted or operator-supervised workloads, not a VM boundary against hostile custom images, kernel exploits, Docker compromise, or another user who controls the host account. The default developer network profile permits outbound access. Read the complete security model before relying on the boundary.

Release status

Qubicl 0.1.x is the initial public series. It is ready for real use, but its interfaces and state format may evolve before 1.0. Linux x64, Apple Silicon macOS with Docker Desktop, and Windows 11 x64 through Ubuntu 24.04 on WSL 2 with Docker Desktop are directly exercised for the first release. Linux ARM64, Intel macOS, Windows on ARM, and other WSL distributions remain best-effort. Native Windows and WSL 1 are unsupported; Qubicl computers remain Linux containers on every host. Back up important computer homes before upgrades.

Documentation

Licensing: source code and documentation are Apache-2.0; the designated Qubicl logo and official brand artwork are CC BY 4.0. See BRANDING.md for permitted brand use and attribution.

Contributions are welcome—start with CONTRIBUTING.md, and report vulnerabilities through the repository's private security-reporting form described in SECURITY.md.