Vantisso
A vertically integrated platform for running AI agents — from hardware isolation up to the native runtime
The stack for running agents has long been split between isolation sandboxes and agent frameworks. Vantisso brings it together into a single, self-contained software package, where hardware isolation, a native runtime, and zero-trust credential governance interlock as one layer — delivering security and resource optimization at the same time.
Why Vertical Integration
Until now, environments for running agents have fallen into two camps. One is the isolation sandbox: it gives you a secure isolation boundary, but no runtime to actually run agents inside it. The other is the agent framework: it gives you a runtime for agents to execute and reason in, but no hardware-level isolation boundary. Either way, developers are left to build the missing half themselves, which makes optimizing for security and cost considerably harder. Vantisso integrates both layers from the ground up, so agent-service developers can focus entirely on building their services.
| Capability | Isolation Sandboxes | Agent Frameworks | Vantisso |
|---|---|---|---|
| Hardware isolation | Provided | Not provided | Hardware (KVM)-level isolation |
| Agent runtime | Requires custom build | Provided | Built-in native runtime |
| Credential governance | Requires custom build | Requires custom build | Host-isolated · zero-trust |
| Full resource teardown (ephemerality) | Varies by implementation | Requires custom build | Full kernel-resource reclamation |
| Agent execution restore | Requires custom build | Requires custom build | Restore execution state to any point in time |
| Resource & cost optimization | Developer's responsibility | Developer's responsibility | Integrated infra & runtime optimization |
| Integration scope | Isolation layer | Execution layer | Vertically integrated isolation & execution |
Vantisso's 6 Core Capabilities
Vantisso's vertical integration comes together across two layers — three capabilities that govern the infrastructure layer where agents run, and three that govern the runtime layer that drives the agents on top of it.
Infrastructure Layer
Infrastructure-agnostic deployment with hardware-level isolation
Built on KVM-based Firecracker MicroVMs, Vantisso gives every agent its own independent hardware isolation boundary. From a personal laptop to on-premises enterprise servers to the cloud, you get the same level of isolation no matter where an agent runs.
Full resource teardown on task completion
The moment an agent finishes its mission, every hardware and OS resource it held — disk, network, processes, and the rest — is released, with nothing left behind. That rules out resource leaks and cross-contamination from earlier runs, so every execution environment stays pristine, as if freshly created.
Ultra-fast provisioning and state recovery
A new execution environment cold-starts in under a second, and with the Warm Pool it can be ready to run in roughly 2 ms. Even when full memory (RAM) is restored, recovery finishes within 200 ms — and that figure holds constant no matter how much memory was allocated.
Runtime Layer
Built-in native agent runtime
Rather than leaning on third-party frameworks, Vantisso embeds a self-contained runtime that runs independently inside the VM and works hand in hand with the underlying infrastructure controls to optimize execution. It ships with primitive built-in tools for core operations and supports both major commercial LLM providers and open-source LLM APIs out of the box, so you're never locked into a single model. It goes a step further, tailoring each call to the provider's API to trim operating costs along the way.
Multi-agent orchestration
The runtime has group formation, a shared feed, direct peer-to-peer calls (vsfeed/vscall), and liveness monitoring (Watchdog) built in, coordinating collaboration across many agents efficiently. And even after an agent is gone, a Handoff channel passes structured JSON outputs on to the next one, preserving continuity across long-running missions a team carries out together.
Zero-trust, MCP-based tool gateway
Backend credentials — API keys and the like — stay isolated on the host and are never, under any circumstances, injected into the VM. The agent sees only a filtered, namespaced tool catalog scoped to its profile, which blocks privilege theft and abuse by design.
ARCHITECTURE — One Integrated System for Both Isolation and Performance
The six capabilities above aren't the result of bolting open-source components together. Vantisso builds every layer itself, from the hardware virtualization infrastructure up to the operations control plane. What sets this architecture apart is not any single layer, but how it connects the execution domain — isolated for security — to the host control domain that governs it efficiently.
HOST OS — Control & Management Domain
GUEST VM — Agent Execution Domain
Execution isolated by virtualization, operated by the host
Agents run inside a VM created by the virtualization engine, while the control plane, multi-agent orchestration, and MCP gateway that govern them live on the host. Even if an agent is compromised or goes rogue, the enterprise's core assets stay protected — because the execution domain is isolated at the hardware level and the host stays in control of it.
Purpose-built channels for host–agent communication
Separating the execution domain from the control domain tends to add latency to the communication between them. Unlike stacks assembled from open-source parts, which bridge the two over a general-purpose network, Vantisso designs each cross-boundary channel for its specific purpose and builds it in-house. Environment creation and snapshot recovery, task control, and security status signals each travel over the channel best suited to it, keeping the performance cost of crossing the boundary to a minimum.
Host-driven state management and snapshots
The host manages environment creation, recovery, and snapshots from outside the VM. Because it captures and tracks execution state directly rather than requesting it from the agent, it can restore an agent's execution to an exact point in time at the system level.
Separating the virtualization-based execution domain from the control domain pays off in scalability, too. Because each agent runs in its own isolated environment, adding more agents never creates interference between them; because the gateway brings in external tools through one standard interface, the set of integrations can keep growing; and because Vantisso ships as a single software package, it deploys unchanged everywhere, from one laptop to large-scale cloud.
AGENT RUNTIME - The Multi-Agent Collaboration Model
Before isolated agents can act as one team, you have to define what they exchange and over which path. Real multi-agent collaboration needs three distinct forms of communication: a status update broadcast to the team, a one-to-one task delegation between agents, and a result handover that persists an output for the next agent to pick up. Because a single message bus cannot serve all three well at once, Vantisso splits them into three purpose-built channels, embedded in the runtime. On top of those it layers operations that act on the whole team at once and a way to preserve and hand off an agent's memory.
A shared space that every agent reads from and writes to. One agent posts and the whole team is subscribed: a one-to-many status stream, persisted to disk (pub/sub). As each agent records its progress and completions here, the others read them to decide what to do next, and because the runtime stamps every post with its author, the feed doubles as an audit log.
One agent calls another directly to hand off a task and get the result back: a 1:1 synchronous exchange. The path is ephemeral and disappears once the response returns, and a built-in depth guard keeps agents from calling one another indefinitely.
A group-shared, key-value store for structured results. Because it lives on the host rather than inside a VM, its artifacts outlast the agent that wrote them.
The team designer decides how to coordinate
Vantisso supports flexible team-coordination patterns. You can appoint one agent as the team lead to delegate work over vscall and gather the results, or you can run leaderless, with each agent doing its part in parallel and announcing completion on the feed while an aggregator picks up those signals and assembles them. On the three purpose-built channels described above, a wide range of collaboration patterns can be defined, and which one to use is up to whoever designs the team.
Acting on the whole team at once
Vantisso provides operations that act on the team as a single unit, and by design these are invoked from outside the team, by an application or an operator.
Broadcast
Not just an announcement, but a request for the whole team to act. A single prompt fans out to every agent in parallel so they run the same task at once, and each agent's result is gathered and returned. The run is also recorded on the feed, so it stays traceable.
Pause and resume
These run at the hypervisor level, so instead of a software-level wait, they actually freeze each execution environment and later wake it back up. That is invaluable when a run heads in an unexpected direction: you can stop the whole team, inspect and clean things up, then pick the work back up.
There is a good reason these operations come from outside the team. A pause freezes every member, so if an agent inside the team issued one, it would freeze itself too and leave no one to resume the group. Coordination within the team runs over the three channels; control of the team as a whole comes from outside. That separation is what keeps you from ever losing control.
Preserving and passing on memory
An agent's memory comes in two tiers: the short-term memory of the work in progress and the long-term memory it deliberately curates and leaves behind. Vantisso preserves each tier in its own way and hands it off to the next agent.
The working context and in-progress state live in the agent's VM memory in real time. Because the Vantisso host can capture the entire VM as a point-in-time snapshot, that agent's working memory can be brought back exactly as it was, or restored onto a fresh VM.
Outputs the team needs to reference beyond any single agent's lifetime are kept in the Handoff store as structured documents. The host retains them durably, so even after the original agent's VM is gone, another agent can pick up the work from the Handoff documents it left behind.
See Vantisso in action
This is how the concepts above actually work on screen. These are real screens from the Vantisso web console: one is the Workspace mode, where you compose an agent team and watch it collaborate; the other is an operator monitoring mode that surfaces Prometheus-based system metrics at a glance.
Settings
Each profile selects a provider and model. Provider choices are limited to those with an API key in the global keychain (configs/vantisso-secrets.yaml). Changes apply to the next Create VM, not to running VMs.
| Profile | Provider | Model | Streaming | |
|---|---|---|---|---|
| default | ||||
| tech-lead | ||||
| frontend-dev | ||||
| stylist | ||||
| reviewer | ||||
| content-writer | ||||
| researcher |
grp-7c41e9
activeGroup info
Agents
| Agent ID | Role | Status | VM ID | Actions |
|---|---|---|---|---|
| agt-1a2b | tech-lead | busy | vm-3f9a2c | |
| agt-3c4d | frontend-dev | busy | vm-b17e4d | |
| agt-5e6f | stylist | ready | vm-9a2f81 | |
| agt-70a1 | reviewer | ready | vm-4c6b0e | |
| agt-9b3c | content-writer | spawning | vm-e83d17 | |
| agt-c2d4 | researcher | done | vm-2d70a9 |
Activity Feed
liveDanger zone
System
GET /metrics · Prometheus scrape · Grafana dashboard uid=vantisso-overview
Frequently asked questions
The questions we hear most often from teams evaluating Vantisso.
- What is Vantisso?
- Vantisso is a vertically integrated platform for running AI agents in isolation and keeping them under control. Each agent gets its own KVM-backed Firecracker MicroVM for hardware-level isolation, a native runtime built in-house drives the agent inside it, and every credential stays on the host.
- How is this different from an isolation sandbox or an agent framework?
- An isolation sandbox gives you a safe place to run code but no runtime to drive an agent inside it. An agent framework gives you the runtime but no hardware isolation boundary. Either way you build the missing half yourself. Vantisso ships both layers as one system.
- Why MicroVMs instead of containers?
- Containers share the host kernel, which makes that kernel part of the attack surface. A MicroVM runs on its own kernel behind a hypervisor (KVM) boundary, so a compromised agent cannot reach the host or the other agents through it.
- Is it slow to boot a VM per agent?
- Creating a fresh environment takes under a second. With the warm pool, a ready VM is claimed in about 2 ms. Restoring a snapshot, guest memory included, stays under 200 ms no matter how much RAM the VM was given.
- Where are credentials such as API keys kept?
- On the host, and never injected into a VM under any circumstance. Agents reach external tools only through the MCP gateway running on the host, and the gateway exposes just a profile-filtered catalog of tools. A compromised agent therefore leaks neither the backend address nor the key.
- How do you stop an agent from reaching internal networks or cloud metadata?
- A host-side egress firewall governs the traffic leaving each VM. By default it blocks the cloud metadata address (169.254.169.254), closing the instance-credential theft path from the start, and a stricter mode blocks every private range as well. Because it runs on the host, the agent inside cannot disable or bypass it.
- Which LLMs can I use?
- Vantisso supports the major commercial providers as well as open-source LLM APIs, so you are not tied to one model. Models are selected per profile, which lets different roles on an agent team run on different models.
- Where can I run it, and how do I start?
- Anywhere you have a Linux host with KVM: a laptop, an on-premises server, or a cloud instance, all behaving the same way. The requirements are Ubuntu 22.04 or 24.04, x86-64, and access to /dev/kvm. Download the prebuilt evaluation package and every feature is unlocked for 30 days from your first run.
Now it's your turn to run it
Put everything you have seen here into practice: isolated execution, the native runtime, and multi-agent collaboration, all in the Vantisso trial.
Start the trial now