A desktop VM built for one job: keeping Claude contained

What it does Claude Cage is a Go-based desktop app (a fork of agent-vm) that runs a full virtualized workbench — terminal, editor, browser, and official Claude Desktop — inside a guest VM on macOS, Windows, or Linux. It takes over all networking inside the VM through a bundled Mihomo proxy core, keeps a separate fingerprint (timezone, language, synced to your proxy IP), and refuses direct connections if the proxy dies. It also manages multiple Claude Code subscriptions, pairs with your phone for remote approvals, and can deploy environments to a VPS over SSH.

The interesting bit The isolation is fail-closed: if a network or isolation check fails, the environment stays offline — there’s no direct-connection fallback to leak your real IP. It’s essentially a purpose-built anti-fingerprinting sandbox, which is a candid admission of how hostile account management has become for Claude users in restricted regions.

Key highlights

• Terminal, editor, Cage browser, and Claude Desktop unified in one workbench window
• Guest VMs match your host OS (macOS, Windows, or lightweight Linux), with official images
• Multi-account management: view quotas, assign accounts to sessions, switch with explicit authorization
• Mobile pairing to continue Claude Code conversations and approve tool calls from your phone
• Tailscale integration for reaching private-network devices from inside the cage

Caveats

• Projects within one Cage config share the same guest system, tools, and filesystem — no isolation between projects, and file edits hit your real host files directly.
• Network is IPv4 TCP only; UDP, IPv6, ICMP, and LAN direct access are restricted.
• Windows 11 guests require Hyper-V-capable Pro/Enterprise/Education hosts; Intel Macs, Windows ARM64, and Linux ARM64 are unsupported.
• The README is upfront that its checks can’t guarantee your account won’t be limited anyway.

Verdict Worth a look if you run Claude Code across accounts and regions and want the proxy/fingerprint plumbing handled for you. If you just have one account and no geo headaches, a plain VM — or no VM — does the job with less machinery.