MXC (Windows)

Microsoft eXecution Containers (MXC) is an open-source (MIT), policy-driven sandbox SDK. On Windows 11 24H2+ its default backend is processcontainer (AppContainer-style process isolation). It does not broker credentials; it can force outbound HTTP(S) through a localhost proxy, which is the hook for varlock.

Install

Requires Windows 11 24H2+ (build 26100+) for processcontainer, and Node.js 18+.

npm install @microsoft/mxc-sdk

Wire MXC through varlock

Start the proxy on the host with a fixed port, so mxc-agent.json can name it up front:

varlock proxy start --port 54321

In PowerShell, load placeholders + CA trust from JSON (bash-style eval "$(varlock proxy env)" is for Unix shells; on Windows prefer --format json):

$envMap = varlock proxy env --format json | ConvertFrom-Json
$envMap.PSObject.Properties | ForEach-Object { Set-Item -Path "Env:$($_.Name)" -Value $_.Value }

Point MXC’s process-container network at that port. MXC’s external proxy example routes sandbox traffic to localhost:<port>:

{
  "script": "claude",
  "timeout": 0,
  "processContainer": {
    "name": "varlock-agent",
    "capabilities": ["internetClient"]
  },
  "filesystem": {
    "readwritePaths": ["C:\\path\\to\\your\\project"]
  },
  "network": {
    "proxy": { "localhost": 54321 }
  }
}

Match the port to the --port you chose in step 1, and set readwritePaths to your project. Keep @proxyConfig={egress="strict"} in .env.schema so only declared hosts get secrets. Host allow/block lists are not enforced on Windows yet in MXC; varlock’s egress rules cover injection scope.

Launch with a small Node script (or wxc-exec.exe if you build the native binary from the MXC repo):

import { readFileSync } from 'node:fs';
import { spawnSandboxFromConfig } from '@microsoft/mxc-sdk';

const proxyUrl = process.env.HTTPS_PROXY;
if (!proxyUrl) {
  throw new Error('Load varlock proxy env first (HTTPS_PROXY missing)');
}
const port = Number(new URL(proxyUrl).port);

const config = JSON.parse(readFileSync('./mxc-agent.json', 'utf8'));
config.network = { proxy: { localhost: port } };
config.script = process.argv.slice(2).join(' ') || config.script;

const child = spawnSandboxFromConfig(config, { usePty: true });
child.on('exit', (code: number | null) => process.exit(code ?? 1));

npx tsx run-sandboxed-agent.ts claude

The child inherits the placeholder + CA environment you set in PowerShell. MXC’s network.proxy steers AppContainer egress at varlock on loopback, which the host process can reach.