Execution environments

Add real compute only when the task needs it.

An Alvoki-hosted agent can plan, run limited JavaScript, make public HTTP requests where enabled, and use granted tools without a machine. Connect customer-configured execution capacity when it needs shell, files, git, browser, tests, containers, or private-network access.

Agent loop versus execution

A hosted agent does not automatically get a machine.

When you choose an Alvoki-hosted loop, Alvoki keeps the transcript and run state. The execution choice decides whether the task gets only lightweight hosted tools or a customer-configured machine.

Lightweight hosted runtime

No machine attached

Limited JavaScript, public HTTP where enabled, and granted tool calls. No general shell, filesystem, git, or browser.

Plan and transform dataFetch public URLsInvoke granted tools

Connected execution environment

Customer-configured machine

A VM, Docker environment, or local machine provides the files, shell, processes, git, browser, tests, containers, and network access configured for the task.

Edit and test codeRun local processesReach private systems
Same per-tool controlsGitHub, MCP tools, package-backed APIs, approvals, revocation, and activity records still follow the grants on the caller.

Connect it deliberately

Connect compute without confusing who controls what.

A connected environment is a place to execute, not a blanket of Alvoki policy. Decide what the machine exposes locally, attach it to the run that needs it, and keep external credentials behind tools supplied through Alvoki where possible.

Customer configuration

Choose what the machine makes available.

The customer configures the VM, Docker host, or local machine, including its files, network reachability, installed software, and local secrets.

Run attachment

Attach execution capacity to the work that needs it.

A hosted session can bind to a sandbox volume on configured capacity. External clients use their existing environment and connect to tools through Alvoki MCP.

External credentials

Keep provider access behind Alvoki tools.

A GitHub or SaaS credential held by Alvoki follows grants and approvals. A separate token placed on the machine can be used outside that path.

Examples

Tasks that fit each execution shape.

1Summarize public data and call a granted internal API with the lightweight runtime.
2Run repository tests and create branch output in a customer-configured Docker environment.
3Use a customer VM near a private network while GitHub calls still pass through Alvoki.

Execution paths

Choose who owns the agent loop and where machine access comes from.

Alvoki-hosted agent runtime

Start persistent agent work with or without connected machine capacity.

Read more

Execution capacity setup

Configure the VM, Docker host, or local machine that will supply shell, files, processes, and network access.

Read more

Security model

See which access Alvoki controls and which access remains local to the execution environment.

Read more