Qavren Swarm
Disposable coding agents in hardened containers. They edit a copy of your repo and hand back a diff.
The useful version of an AI coding agent is one that can run tests. The dangerous version is the same one, because now it can run anything. Swarm's answer is that the agent never touches the real files.
What it is
Qavren Swarm is a local MCP server that orchestrates ephemeral, hardened Docker containers as disposable coding agents. An IDE harness talks JSON-RPC over stdio; each task spawns a throwaway Linux container that edits a read-only copy of a host workspace, runs tests, and returns a git diff.
Nothing touches your real files until you explicitly call apply_diff.
What it does well
Read-only by construction. The host workspace is bind-mounted read-only. The agent works in a writable copy inside the container. The isolation is a mount flag, not a policy the agent agreed to follow.
A diff is the deliverable. Every task returns a reviewable patch. The decision to apply it stays with a person.
Containers built to be disposable. Non-root, capabilities dropped, resources capped, thrown away when the task ends.
Pluggable model backend, per task. Route a task to your logged-in Claude Code CLI through a host broker (flat-rate under an existing subscription), to any OpenAI-compatible local endpoint like Ollama or LM Studio (free), or to the metered Anthropic API. The choice is per-task, so cheap work runs cheap.
Recovery when a patch half-applies. Hunk-by-hunk apply, patch export, and paused jobs — because the interesting failure mode isn't the agent writing bad code, it's a good diff that won't land cleanly.
What runs on it
Qavren's own development. It's a single-developer tool on a Windows 11 workstation with Docker Desktop over WSL2, used against this portfolio's repositories.
What it looks like in practice
A task goes out from the IDE: fix this failing test. A container spins up, copies the read-only workspace into scratch space, works, runs the suite, and returns a diff plus the test output. The diff gets read. If it's right, apply_diff puts it on disk. If it isn't, the container is already gone and nothing on the host changed.
What it's not
It's not a hosted service, and it isn't multi-user.
It's not a replacement for review. It is built specifically to make review the mandatory step.
It's not a sandbox escape guarantee. The threat model is documented rather than implied.
Status
Working and in use. MIT-licensed, CI green, with the MCP tool surface, container lifecycle management, the host broker, and job error-recovery (hunk-by-hunk apply, patch export, paused jobs) all shipped. Tech: .NET 10 MCP stdio server + Docker.DotNet + a Kestrel broker, with a Python agent inside the container.