# Cosmonic

> Documentation for Cosmonic Desktop and Cosmonic Control: capability-driven WebAssembly sandboxes for your agent's code, from laptop to Kubernetes

This file contains links to documentation sections following the llmstxt.org standard.

## Table of Contents

- [Cosmonic Control API Reference](https://cosmonic.com/docs/api-reference/control.cosmonic.io/): Complete API reference for the Cosmonic Control CRDs in the control.cosmonic.io API group, covering the HTTPTrigger and ProjectEnvironment resources.
- [cosmonic:kafka](https://cosmonic.com/docs/api-reference/cosmonic-kafka/): WIT reference for cosmonic:kafka@0.5.0, the Kafka capability built into Cosmonic Control: producer, transaction, consumer and handler interfaces, b...
- [wasmCloud Runtime Operator API Reference](https://cosmonic.com/docs/api-reference/runtime.wasmcloud.dev/): Complete API reference for the wasmCloud Runtime Operator CRDs used by Cosmonic Control, including Workload, WorkloadDeployment, Host, and Artifact...
- [Architecture](https://cosmonic.com/docs/architecture/): Overview of the Cosmonic Control architecture, including wasmCloud, controllers, operators, custom resources, and the Kubernetes API server.
- [Custom Resources](https://cosmonic.com/docs/custom-resources/): Reference guide for Kubernetes custom resources in Cosmonic Control, including Artifacts, Hosts, HTTPTriggers, Workloads, and more.
- [Deploy on VMware vSphere Kubernetes Service (VKS)](https://cosmonic.com/docs/deployment-guides/cosmonic-control-on-vmware-vsphere-kubernetes-service/): Step-by-step guide to installing Cosmonic Control on VMware vSphere Kubernetes Service (VKS) with Contour ingress and monitoring.
- [Google Antigravity Sandbox](https://cosmonic.com/docs/desktop/agents/antigravity-sandbox/): Sandbox Google Antigravity with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local ...
- [Claude Code Sandbox](https://cosmonic.com/docs/desktop/agents/claude-code-sandbox/): Sandbox Claude Code with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAsse...
- [Claude Desktop Sandbox](https://cosmonic.com/docs/desktop/agents/claude-desktop-sandbox/): Sandbox Claude Desktop with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebA...
- [OpenAI Codex Sandbox](https://cosmonic.com/docs/desktop/agents/codex-sandbox/): Sandbox OpenAI Codex with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAss...
- [Gemini CLI Sandbox](https://cosmonic.com/docs/desktop/agents/gemini-cli-sandbox/): Sandbox Gemini CLI with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAssem...
- [Hermes Agent Sandbox](https://cosmonic.com/docs/desktop/agents/hermes-sandbox/): Sandbox Hermes Agent with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAss...
- [Kiro CLI Sandbox](https://cosmonic.com/docs/desktop/agents/kiro-cli-sandbox/): Sandbox Kiro CLI with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAssembl...
- [LM Studio Sandbox](https://cosmonic.com/docs/desktop/agents/lm-studio-sandbox/): Sandbox LM Studio with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAssemb...
- [OpenClaw Sandbox](https://cosmonic.com/docs/desktop/agents/openclaw-sandbox/): Sandbox OpenClaw with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAssembl...
- [OpenCode Sandbox](https://cosmonic.com/docs/desktop/agents/opencode-sandbox/): Sandbox OpenCode with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAssembl...
- [NVIDIA OpenShell Sandbox](https://cosmonic.com/docs/desktop/agents/openshell-sandbox/): Sandbox NVIDIA OpenShell with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local We...
- [Pi Sandbox](https://cosmonic.com/docs/desktop/agents/pi-sandbox/): Sandbox Pi with Cosmonic Desktop: connect it over MCP and install the cosmonic-sandbox skill so the code it writes runs in a local WebAssembly sand...
- [Application Views](https://cosmonic.com/docs/desktop/app-views/): A tour of every Cosmonic Desktop view — Workloads, Academy, Launchpad, Capabilities, Logs, Secrets, Local Registry, Inspect, Settings — plus the Bu...
- [Build an AI Sandbox from Scratch: Hello World in Rust with wash](https://cosmonic.com/docs/desktop/build-an-ai-sandbox-from-scratch/): Walkthrough 3 of the Cosmonic Desktop quickstart: build a sandboxed WebAssembly component from scratch in Rust with wash 2.6.1, prove the capabilit...
- [Air-gapped install](https://cosmonic.com/docs/desktop/build-toolchain/air-gapped/): Install the Cosmonic Desktop build toolchain on a machine with no internet access, using a signed offline bundle that stays cryptographically verif...
- [The build toolchain](https://cosmonic.com/docs/desktop/build-toolchain/): What Cosmonic Desktop installs to build components (Rust, the wasm target, wash, wkg, and a C linker), how it sets the tools up and keeps them veri...
- [The cosmonic CLI](https://cosmonic.com/docs/desktop/cli/): The cosmonic developer CLI for Cosmonic Desktop. Scaffold a project with new, run a live dev loop with dev, and promote a build to a registry with ...
- [Connect Coding Agents](https://cosmonic.com/docs/desktop/coding-agents/): Connect Claude Code, OpenAI Codex, Gemini CLI, or any MCP client to Cosmonic Desktop and drive workloads: from a prompt to a running component in y...
- [Containers to Components](https://cosmonic.com/docs/desktop/containers-to-components/): A concept-by-concept mapping from desktop container tools like Docker Desktop to Cosmonic Desktop: images to components, containers to sandboxed wo...
- [The cosmonicd Daemon](https://cosmonic.com/docs/desktop/daemon/): What the cosmonicd daemon does, how it runs as a service on each platform, its CLI commands (paths, oci, mcp serve, uninstall), and its environment...
- [Cosmonic Desktop](https://cosmonic.com/docs/desktop/): Cosmonic Desktop is a sandbox for your agent's code: run AI-generated and untrusted code in capability-driven WebAssembly sandboxes on your own mac...
- [Install Cosmonic Desktop on Linux](https://cosmonic.com/docs/desktop/install/linux/): Install Cosmonic Desktop on Linux from the .deb, .rpm, or AppImage, with the daemon service configured for you, and verify it is running.
- [Install Cosmonic Desktop on macOS](https://cosmonic.com/docs/desktop/install/macos/): Install Cosmonic Desktop on macOS from the signed .pkg or .dmg and verify the daemon is running.
- [Verify a Cosmonic Desktop download](https://cosmonic.com/docs/desktop/install/verify-signatures/): Confirm a Cosmonic Desktop download is authentic: Developer ID and notarization on macOS, Authenticode on Windows, detached GPG signatures on Linux.
- [Install Cosmonic Desktop on Windows](https://cosmonic.com/docs/desktop/install/windows/): Install Cosmonic Desktop on Windows from the .exe installer and verify the daemon is running.
- [From Laptop to Cluster](https://cosmonic.com/docs/desktop/laptop-to-cluster/): Deploy a workload you shaped in Cosmonic Desktop to a Cosmonic Control cluster on Kubernetes — same spec, same security model, no rewrite step.
- [Messaging with NATS](https://cosmonic.com/docs/desktop/messaging-with-nats/): Connect a NATS cluster to your Cosmonic Desktop host so sandboxed workloads can use pub/sub, request/reply, JetStream, and KV, with credentials kep...
- [Mount a volume](https://cosmonic.com/docs/desktop/mount-a-volume/): Give a Cosmonic Desktop component filesystem access by mounting a volume: an ephemeral scratch directory or a real folder on your machine, at a pat...
- [Privacy and Telemetry](https://cosmonic.com/docs/desktop/privacy-and-telemetry/): What Cosmonic Desktop collects with telemetry consent on (crash reports and usage counts), what it never collects, and how to turn it off.
- [Quickstart: Run Your First Workload](https://cosmonic.com/docs/desktop/quickstart/): Run your first sandboxed WebAssembly workload in Cosmonic Desktop: paste a component reference, review the generated Workload, and apply it.
- [Sandbox MCP Servers](https://cosmonic.com/docs/desktop/sandbox-mcp-servers/): Run MCP servers as sandboxed WebAssembly workloads on Cosmonic Desktop — deny-by-default egress, verified images, and secrets as references for the...
- [Sandboxing AI: Run Agent-Generated Code in an AI Sandbox](https://cosmonic.com/docs/desktop/sandboxing-ai/): Walkthrough 2 of the Cosmonic Desktop quickstart: use Builder to send a prompt to your coding agent and land the result in an AI sandbox — WebAssem...
- [The Cosmonic Tray](https://cosmonic.com/docs/desktop/tray/): What the cosmonic-tray menu-bar companion does, how it runs on each platform, and how it relates to the app and the cosmonicd daemon.
- [Troubleshooting Cosmonic Desktop](https://cosmonic.com/docs/desktop/troubleshooting/): Troubleshoot Cosmonic Desktop: read the Logs view, fix daemon connection issues, private registry pulls, tray icons, and volume errors.
- [Uninstall Cosmonic Desktop](https://cosmonic.com/docs/desktop/uninstall/): Fully uninstall Cosmonic Desktop from macOS, Windows, or Linux, including the daemon service, tray, and stored workload state.
- [FAQ](https://cosmonic.com/docs/faq/): Frequently asked questions about Cosmonic Control, wasmCloud, WebAssembly components, and cloud-native platforms.
- [Glossary](https://cosmonic.com/docs/glossary/): Definitions of key terms used in Cosmonic Desktop, Cosmonic Control, wasmCloud, and the WebAssembly component ecosystem.
- [Introduction to Cosmonic](https://cosmonic.com/docs/): How Cosmonic secures the code AI agents run, from laptop to cluster: Cosmonic Desktop, a sandbox for your agent's code that runs on your own machin...
- [Get Started](https://cosmonic.com/docs/install-cosmonic-control/): Install Cosmonic Control on any Kubernetes cluster in minutes.
- [CI/CD with GitLab CI](https://cosmonic.com/docs/integrations/gitlab-ci/): Build, sign, attest, and deploy Cosmonic Control workloads from GitLab CI using the cosmonic-labs/ci-components/wash CI/CD Catalog.
- [CI/CD and GitOps](https://cosmonic.com/docs/integrations/gitops-with-argo-cd/): Automate Wasm deployments on Cosmonic Control with GitHub Actions and Argo CD.
- [How to add WebAssembly components to IDPBuilder](https://cosmonic.com/docs/integrations/idpbuilder/): Deploy Cosmonic Control with IDPBuilder to run a local internal developer platform with WebAssembly components.
- [Multitenancy](https://cosmonic.com/docs/multitenancy/): How Cosmonic Control supports multi-tenant deployments with Kubernetes namespace isolation and WebAssembly sandboxing.
- [Observability](https://cosmonic.com/docs/observability/): Built-in observability stack in Cosmonic Control with Prometheus metrics, Loki logs, and Tempo distributed traces.
- [Air-Gapped Installation](https://cosmonic.com/docs/operations/air-gapped-installation/): Mirror Helm charts and container images to an internal registry for air-gapped Cosmonic Control installations.
- [Autoscaling](https://cosmonic.com/docs/operations/autoscaling/): Scale Cosmonic Control HTTPTriggers and WorkloadDeployments with the standard Kubernetes Horizontal Pod Autoscaler or KEDA via the /scale subresource.
- [Component Configuration and Secrets](https://cosmonic.com/docs/operations/component-configuration/): Configure Wasm components with inline values, Kubernetes ConfigMaps, Secrets, and network allowlists on Cosmonic Control.
- [Production Installation](https://cosmonic.com/docs/operations/deploying-to-cosmonic-control/): Deploy Cosmonic Control to production Kubernetes with Helm. Covers cluster requirements, Helm values, ingress setup, and day-two operations for Was...
- [Host Groups](https://cosmonic.com/docs/operations/host-groups/): How host groups work in Cosmonic Control: a set of wasmCloud host pods deployed with the cosmonic-control-hostgroup Helm chart that register with C...
- [Ingress and Workloads](https://cosmonic.com/docs/operations/ingress-and-workloads/): Configure Envoy ingress and deploy WebAssembly workloads on Cosmonic Control using Kubernetes CRD manifests.
- [Tuning NATS Workloads](https://cosmonic.com/docs/operations/nats-tuning/): Size subscription capacity, acknowledgement windows, and instance pools for WebAssembly components on NATS, and diagnose shedding, redelivery, and ...
- [NATS Workloads and Grants](https://cosmonic.com/docs/operations/nats-workloads/): Run WebAssembly components against NATS on Cosmonic Control with the wasmcloud:nats host plugin: subjects, streams, KV buckets, and the deny-by-def...
- [Tenant RBAC](https://cosmonic.com/docs/operations/tenant-rbac/): Configure multi-tenant RBAC on Cosmonic Control with namespace-scoped Kubernetes Roles and RoleBindings.
- [Two-component NATS workloads](https://cosmonic.com/docs/operations/two-component-nats-workloads/): Many real workloads split into two pieces: a thin, fresh-per-request HTTP component that handles the inbound request, and a heavier worker componen...
- [Upgrading](https://cosmonic.com/docs/operations/upgrading/): Upgrade Cosmonic Control to the latest version with Helm.
- [Capabilities (Capability-Based Security)](https://cosmonic.com/docs/platform-concepts/capabilities/): Capabilities are unforgeable references that name what a Wasm component is allowed to do.
- [Platform Concepts](https://cosmonic.com/docs/platform-concepts/): Concept references for the security, isolation, and trust model behind Cosmonic Control, Cosmonic Desktop, and the Cosmonic platform.
- [Principle of Least Authority (PoLA)](https://cosmonic.com/docs/platform-concepts/principle-of-least-authority/): Principle of Least Authority (PoLA): what it means, how it differs from least privilege, and how WebAssembly + Cosmonic enforce it by default.
- [Security and Non-Deterministic I/O](https://cosmonic.com/docs/platform-concepts/security-under-non-deterministic-io/): AI agent security under non-deterministic I/O: why traditional access control breaks when an LLM generates tool calls, and how capabilities bound r...
- [WebAssembly for Platforms](https://cosmonic.com/docs/platform-engineering-with-webassembly/): Discover how platform teams use WebAssembly and Cosmonic Control to cut infrastructure costs, enforce security boundaries, and ship features faster.
- [Securely Deploy MCP on Kubernetes](https://cosmonic.com/docs/securely-deploy-mcp-on-kubernetes/): Deploy MCP servers as sandboxed WebAssembly components on Kubernetes with Cosmonic Control for secure agentic AI.
- [Blobstore Fileserver (NATS)](https://cosmonic.com/docs/template-catalog/blobstore-fileserver-nats/): Serve files from NATS-backed blob storage using a Rust WebAssembly component on Cosmonic Control.
- [Blobstore Operations (NATS)](https://cosmonic.com/docs/template-catalog/blobstore-nats/): Demonstration of blob storage operations via HTTP, implemented as a Wasm component for Cosmonic Control.
- [Hono Swagger UI](https://cosmonic.com/docs/template-catalog/hono-swagger-ui/): Interactive API documentation built on the Hono HTTP framework and Swagger UI middleware, deployed as a Wasm component.
- [HTTP Server](https://cosmonic.com/docs/template-catalog/http-server/): Deploy a multi-endpoint HTTP server written in Go as a WebAssembly component on Cosmonic Control.
- [Template Catalog](https://cosmonic.com/docs/template-catalog/): Browse ready-to-deploy application templates for Cosmonic Control, including HTTP APIs, messaging services, and more.
- [Kafka Templates](https://cosmonic.com/docs/template-catalog/kafka-templates/): Four clone-and-customize Kafka patterns for Cosmonic Control: a serverless handler consumer, an HTTP producer, a pull service, and exactly-once tra...
- [Petstore MCP Server (TypeScript)](https://cosmonic.com/docs/template-catalog/mcp-server-ts/): Build a sandboxed MCP server in TypeScript, compiled to a WebAssembly component. Deploy to Cosmonic Control with Helm for secure, isolated AI agent...
- [NATS Templates](https://cosmonic.com/docs/template-catalog/nats-templates/): Seven clone-and-customize NATS patterns for Cosmonic, in Rust and Go: core subscriber, request/reply, fan-out, JetStream consumer and pull worker, ...
- [Troubleshooting](https://cosmonic.com/docs/troubleshooting/): Troubleshoot Cosmonic Control deployments by checking wasmCloud host logs and resolving common issues.