VPN Works Explained: How vpnw Gives Each AI Agent Its Own Network, and How Scope Narrows the Company VPN

vpnw gives a program a sealed room with one door. The door checks a short list of where the program may go, sends it out the way you picked, and writes everything down. That’s the kernel of VPN Works, the VPN rebuilt as an operating system. For a whole company VPN, the same idea is called Scope, and it’s on the way.

Think of a program, an AI agent say, as a guest who’ll do whatever the last note they read told them. You can’t check every note. You can decide which doors they can open.

Most computers give every program every door. A VPN changes which way all of them lead. VPN Works changes what one program can reach.

An AI agent inside a sealed room: its direct connections, DNS lookups and requests to local services are all blocked; its one door leads to vpnw, which checks the policy, sends allowed traffic out by the chosen route and writes everything down

A Sealed Room With One Door

The room. vpnw starts the program inside an isolated space built from Linux’s own features. The program gets no network of its own. It can’t connect to anything directly, can’t look up addresses, and can’t ask another service on the computer, such as Docker, to connect for it.

The door. The only thing it can reach is vpnw. Every connection is checked against a policy, a short text file listing where the program may go. It goes through or it’s refused.

The route. Allowed traffic leaves the way you picked: straight out, through a proxy, or through a WireGuard tunnel that vpnw runs itself, without root. Only this program takes that route.

The log. Every connection is written down with its decision.

Plugins, the Apps

The room, the door, the route and the log are the kernel’s job. Everything beyond those four is a plugin, an app for VPN Works, a small program in a sandbox of its own that can’t touch files or the network. One shows you the log as it happens. One drafts the policy from a real run. Others can add checks the policy can’t express. The platform · Plugins

And the Company VPN

Many company VPNs are flat: once you’re in, you can reach everything, and so can anyone with a stolen password. Scope applies the same idea to the whole VPN: it watches which people use which systems and drafts rules that give each person just that. In VPN Works 0.2.0 it was a separate engine, and rules it learned stopped 136 of 144 attempts with a stolen login in a test office. It comes back as a plugin once vpnw can guard a whole network, not just one program. Scope

What It Doesn’t Do Yet

Seal programs on macOS, carry UDP, limit which files a program reads, or cover a whole network. Roadmap