> Desktop sandbox
What it is
Every Ocai conversation runs its work inside a sandbox: an isolated Linux machine where tools execute, files are processed, and nothing is trusted by default.
Where that sandbox lives depends on how you use Ocai. In the browser, it runs on our servers, and it has no internet access. Install the desktop app, and the sandbox moves to your laptop. It gains internet access, it can host MCP servers, and it can work with your local files. Same product, much more capable.
The model still runs in the cloud either way. Your laptop handles the doing; the cloud handles the thinking.
Browser versus desktop app
Why the desktop sandbox is more capable
- MCP servers run on your laptop. When you connect an integration, such as the WordPress MCP, its server runs inside your sandbox. It never runs on infrastructure we operate.
- Tools can use the internet. A server that needs to publish a post or poll an API uses your laptop's connection. Access is per-server and per-domain: a server can only call the domains listed in its manifest.
- File work happens next to your files. The sandbox reads and writes through a gated bridge to the folder you point it at. Documents stay on your disk; they are not uploaded so a tool can process them.
- Private endpoints just work. Requests originate from your machine, so they reach things only your network can reach, like an internal tool behind the office VPN.
Isolation: the blast radius is one folder
The desktop sandbox has its own Linux kernel. It is a machine inside your machine, and its reach ends at the folder you give it. A process that goes wrong inside the sandbox, whether that is buggy code, a misbehaving MCP server, or something worse, can touch the files in that folder and nothing else. It cannot read your documents. It cannot see your other applications. It cannot reach your operating system, your keychain, or your browser.
Inside the sandbox, every MCP server runs as its own user, with its own files and its own memory. One server cannot spy on another, and one bad server cannot take the rest down. If a server stops answering, you remove it mid-conversation without restarting the app.
How internet access is controlled
Internet access is denied by default. A server gets exactly the outbound access its manifest declares, which domains it may call, and the sandbox enforces this at the kernel level. A server that asked for api.wordpress.com cannot quietly start calling somewhere else.
All traffic enters and leaves through a single local port, routed per server.
Privacy: what stays on your machine
- Your MCP credentials live on your laptop, inside the sandbox. We never hold them.
- Files the sandbox works on are read and written locally. They do not travel to our servers for a tool to process them.
- Internet requests originate from your machine and your network. Your laptop does not expose anything about itself in the process.
The model in the cloud sees what you send it in a conversation, the same as the web app. Everything else the sandbox does happens on your hardware.
Getting started
- Download the desktop app for your operating system from the download page.
- Sign in with your Ocai account. The first launch sets up the sandbox image.
- Connect an integration from Settings, then attach it to a chat when you need it.
Hardware virtualization has to be available on your machine. Most laptops from the last several years ship with it turned on.
Managing the sandbox
- The sandbox boots when you need it and sleeps when idle.
- You can add or remove MCP servers mid-conversation. The sandbox reloads them in place, without a restart.
- Memory and CPU are capped, so a runaway server cannot eat your laptop.
Questions people ask
What can the sandbox touch on my laptop?
One folder, which you choose. Nothing outside it: no other files, no other apps, no system settings.
Does the sandbox have access to my whole computer?
No. It runs its own kernel and has no path to your operating system. Its blast radius is the folder it has access to.
Is my data safer in the browser or in the desktop app?
They make different trade-offs. The browser sandbox has no internet and runs on our servers, so files travel to it when you attach them. The desktop sandbox runs on your machine inside its own kernel; files stay local, and internet access only exists in the narrow, declared way described above. For private or internal work, the desktop sandbox is the stronger option.
Does the app need to stay open?
The sandbox runs while the desktop app runs. Close the app and your laptop stops hosting servers entirely.