A developer working with AI agents for scientific research has published an open source project that tackles a specific but growing problem: how to let an AI agent run experiments on real data without giving that agent unrestricted access to the host system. The project, called labloop, combines five standalone MCP servers with a KVM-based virtual machine isolation layer to create a sealed research environment.
Two Projects, One System
The labloop repository contains two self-contained projects. The first, ml-scientist, provides five MCP servers named agora, arete, zetesis, episteme, and anamnesis. These servers handle the scientific workflow components, including hypothesis management, experiment design, evidence capture, and belief tracking. They can run on any machine without requiring a virtual machine.
The second project, ml-labloop, wraps those services inside a per-user KVM virtual machine. Inside the VM, the MCP services operate in a trusted zone while experimental code runs in a separate hostile zone, isolated from the rest of the system. This architecture lets researchers or AI agents execute code against real data without exposing the host to the agent's actions.
Isolation Architecture
The separation between trusted and hostile zones is the core design decision. The trusted zone runs the MCP services and manages the scientific record. The hostile zone is where experiment code executes, confined and stripped of privileges that could affect the host. Data moves between the two zones through controlled channels, and all data transfer is initiated from the host over the QEMU guest agent rather than through SSH, shared filesystems, or guest-to-host sockets.
The system was developed and tested on Linux Mint 22.3 with kernel 6.14.0-37-generic. It uses QEMU 8.2.2 and libvirt 10.0.0. Inside the VM, a rootless Podman container runtime manages the experiment environment through systemd quadlets, which start services automatically on boot.
Building, Publishing, and Deploying VMs
The project includes a three-step pipeline for creating VM images. A build script produces an unattended Linux Mint installation. A second script seals the template, locking down credentials and taking a snapshot. A third script clones the sealed template into a per-user VM. Local clones boot with a default login that forces a password change on first use. Published images distributed through a public Hugging Face bucket use one-time passwords generated at import time.
Published images go through a release pipeline that seals the template, compresses it, generates a checksum, and uploads both the image and its verification hash. The project also supports idempotent in-place upgrades for existing VMs, pushing updated configuration and tooling through the guest agent.
Tools for the Research Agent
Several command-line tools manage the lifecycle of experiments inside the VM. The labloop-exec command runs code inside the hostile zone under a confined user account. labloop-export stages artifacts from inside the VM for retrieval by the host. labloop-build rebuilds the hostile zone image when its container definition changes. A readiness check script runs a security and configuration audit before experiments begin.
The MCP servers communicate on ports 38050 through 38090, and a dashboard is available on port 38051. The desktop environment ships with launchers for the dashboard, a code editor, and the agent interface.
Getting an Agent to Actually Use the Tools
The project documentation identifies a common failure mode: AI agents tend to fall back to writing files and running Python directly in a shell rather than recording their work through the MCP tools. When this happens, the results are unregistered, non-reproducible, and do not contribute to the scientific record.
To address this, the project ships a warmup prompt called GENESIS-RESEARCH-PROMPT.md. This prompt guides the agent through a complete scientific cycle, running an A/B experiment that finishes in minutes. The exercise tests every stage of the apparatus, from hypothesis formulation through trial execution, evidence recording, and verdict generation.
Two outputs come out of this warmup beyond the experiment itself. The agent produces a note describing how it successfully drove the system, including which call orders worked and what pitfalls it encountered. Subsequent sessions read this note first, so each model's quirks are learned once rather than rediscovered on every run. The project also maintains an agent guide that maps out the zone boundaries and the sanctioned channels for data movement.
What This Means in Practice
The labloop project addresses a real tension in AI-assisted scientific research. Agents can accelerate hypothesis testing, but giving an agent free rein over a host system is a security risk. The KVM-based isolation provides a boundary that lets the agent execute experiments against real data while the MCP servers maintain a verifiable record of what was done, what was tested, and what conclusions were drawn.
For researchers who need to maintain a chain of evidence from hypothesis through conclusion, the project offers a working reference for how to build that infrastructure. The open source code, published VM images, and detailed documentation make it possible to set up a similar environment and begin testing it immediately.