Devin AI Software Engineer: Architecture, Sandboxes, and CLI Workflows

Cognition AI's Devin solved 13.86% of software engineering issues unassisted on the SWE-bench benchmark in its debut evaluation, compared to the previous SOTA which resolved only 1.96% unassisted [Cognition AI 2024]. This performance gap is a result of execution architecture rather than larger neural network parameters. Devin is an autonomous AI software engineer that operates inside a secure sandboxed compute environment with its own shell, directory structure, and browser to build and test code independently.

Standard language models generate code blocks but cannot test them. They lack feedback loops. Devin solves this by running within a dedicated, containerized virtual machine. Every user session spins up a fresh virtual machine. This isolated cloud sandbox runs a Linux distribution, typically Ubuntu. Inside this machine, the agent has full access to the file system, local package managers, and runtime compilers. If a task requires Node.js, Python, or Docker, Devin installs the runtime, runs the package manager, and troubleshoots version conflicts without user intervention.

Devin's core environment features include:

1. Sandbox VM: The isolated compute environment where code is executed and packages are installed.
2. Shell/Terminal: A full command-line shell where the agent runs commands, compiles code, and starts servers.
3. Headless Browser: A web browser that the agent controls to test web apps, view documentation, and interact with web portals.
4. CLI Integration: The interface allowing developers to trigger sessions locally and sync code back and forth.

This architectural decoupling ensures that the agent's work remains isolated. If the agent executes a script with dependencies that conflict with the system defaults, the virtual machine environment takes the hit, preserving local system stability. The isolation also prevents the agent from making destructive changes to the host operating system, providing a secure environment for testing untrusted or experimental packages. Most articles describe Devin generically as an AI chatbot, failing to explain the sandbox VM architecture, terminal shell access, and interactive browser execution model that makes it a true autonomous agent. By operating as a self-contained operating system client, Devin can write, test, run, and modify code without developer oversight.

Helpful references for developers include the Fast.io Workspaces and Fast.io Collaboration platforms, which help teams organize files generated by autonomous agents.

While cloud sandboxes offer isolation, many development projects require working directly with local files. Devin Local addresses this by running directly on developer machines. To maintain security and prevent runaway commands from altering the host system, Devin Local implements operating system level sandboxing.

The sandboxing mechanism differs across operating systems:

• Linux: The agent uses bubblewrap (bwrap) and socat. Bubblewrap creates unprivileged user namespaces to restrict file system access and system calls. If these system utilities are missing, the local sandbox fails to start.
• macOS: The agent uses the built-in macOS Seatbelt security framework. It applies sandbox profiles directly, restricting the agent to authorized folders without requiring external packages.
• Windows: The agent does not support native Windows sandboxing. Instead, it requires Windows Subsystem for Linux (WSL 2). The agent runs inside a containerized WSL 2 distribution to enforce Linux-style boundary controls.

Developers verify their local environment by running the devin sandbox setup command, which inspects the host system and prints missing prerequisites. Once configured, running the agent with the --sandbox flag enables autonomous sandbox mode. Within this sandbox, the agent is informed of specific restrictions and can use the request_scope tool to ask for read/write access to additional directories if needed.

Within the sandboxed environment, file system access is restricted by default. If the agent needs to read or write files outside its initial directory, it must call the request_scope tool. This tool prompts the developer to approve folder access, preventing the agent from modifying system files or directories without explicit permission. Developers manage network and domain access by editing the configuration file located at ~/.config/devin/config.json. Setting properties like allowed_domains and denied_domains filters network requests, preventing the agent from accessing restricted external APIs or accidentally leaking sensitive credentials. This granular control allows developers to block the agent from making network calls to internal IP addresses while permitting connections to external package repositories.

For more information, see how developers manage agent setups with Intelligence Mode.

The key difference between Devin and autocomplete assistants like GitHub Copilot lies in active execution. GitHub Copilot operates inside an editor, suggesting lines of code or responding to chat queries. It cannot execute the code it generates, run test suites, or debug runtime errors. The developer must copy the code, paste it into a terminal, read the error output, and write a new prompt. In contrast, Devin operates as a dynamic agent. It runs code in its terminal shell and monitors the output. If a compiler error occurs, it parses the stack trace, opens the offending file, corrects the line, and re-runs the build command. This loop continues until the code compiles successfully.

To verify visual layouts or interact with web services, Devin uses a headless browser. The agent controls this browser using libraries like Playwright. It can start local development servers, navigate to localhost ports to view the running web application, and capture screenshots of the web page to verify CSS layouts or check for console errors. It can also click buttons, input text, and fill out forms to test user authentication flows. During execution, developers maintain control over the agent's permissions using session commands in the CLI:

• /bypass: Auto-approves all tool executions, allowing the agent to run autonomously.
• /accept-edits: Prompts the developer to approve file writes before changes are saved to disk.
• /normal: The default permission level, prompting for high-risk actions like running shell scripts while allowing basic file reads.
• /plan and /ask: Toggle the agent's focus between structured planning and asking the developer clarifying questions.

This interactive feedback loop between the terminal, the browser, and the developer ensures that the agent works as a collaborative peer rather than a simple code generator. Developers do not just read the output; they watch the agent execute commands in real time, pausing execution when the agent goes off course.

Persist Devin AI files across sessions

A shared workspace with an MCP-ready endpoint for your agent's reads and writes, with versioning and search built in. Every organization starts with a 14-day free trial.

Start 14-Day Trial

Devin CLI bridges local workstations and cloud resources. Developers install the command-line utility by running this script in their terminal:

curl -fsSL https://cli.devin.ai/install.sh | bash

Once installed, the devin command starts an interactive session. Running the command without arguments opens a terminal REPL where developers chat with the agent and monitor its work. For quick tasks, developers pass prompts directly with the -p flag, such as devin -p "run linting on the current project". For automated scripts, using devin -p -- [prompt] runs a single-turn task, prints the outcome to standard output, and terminates.

A core capability of the CLI is the local-to-cloud handoff. When a task requires heavy computational resources, or when the developer needs to shut down their computer, they trigger a handoff. Running the /handoff or /handoff <task description> command packages the current session state. This packaging includes the active git branch, any uncommitted local file modifications, and the history of the current agent session.

The CLI pushes this state to the cloud platform, where a secure virtual machine is provisioned. The cloud agent attaches to the workspace and continues execution from the exact point of handoff. This allows the cloud agent to run long builds, execute integration tests, and handle review comments on pull requests while the developer's local machine remains free. Developers track active cloud runs by typing /cloud-sessions, which displays an interactive list of active cloud agents. Running /cloud-attach <session-id> reconnects the local terminal to the cloud agent, restoring the interactive shell interface.

Autonomous coding agents generate significant output, including scripts, documentation, and build logs. Managing these files across local sandboxes and cloud environments requires a persistent workspace layer. Developers often resort to local directory sharing or basic cloud storage solutions. However, these options present limitations. Local storage is isolated to a single machine, meaning files are lost if the VM terminates. Traditional cloud storage services lack built-in agent tooling, version history auditing, or structured document processing.

Fast.io provides an alternative. It serves as an intelligent workspace platform designed for agentic teams. Instead of viewing storage as a passive repository, Fast.io provides a collaborative environment where humans and agents share the same workspaces and tools. When an agent like Devin works on a project, Fast.io tracks every change using per-file version history. This ensures that concurrent modifications from multiple agents or human developers do not cause conflicts. Every write is audited, making it easy to restore previous versions if an agent makes an incorrect edit.

To handle unstructured project files, developers use Metadata Views by visiting /product/document-data-extraction/. Metadata Views turn unstructured documents into a queryable database. Users describe the fields they want extracted in natural language, and the system designs a typed schema including Text, Integer, Decimal, Boolean, URL, JSON, and Date & Time. The platform matches files in the workspace and populates a filterable spreadsheet without requiring manual OCR rules. This works with PDFs, images, and scanned pages. Developers can add new columns without reprocessing the entire dataset. This is different from semantic search (which is part of Intelligence Mode), acting as the structured data extraction layer.

Devin interacts with these workspaces using the Fast.io Model Context Protocol (MCP) server. Fast.io exposes action-based tools via Streamable HTTP at /mcp and legacy SSE at /sse. Developers can refer to mcp.fast.io and the documentation at mcp.fast.io/skill.md for specific tool capabilities. Additionally, the agent onboarding document is accessible at https://fast.io/llms.txt. Through MCP, Devin can query files, create workspaces, run semantic searches using Intelligence Mode, and transfer project ownership to human clients when the task is complete.

Fast.io offers paid subscriptions for organizations. Plans start at Starter for $29/mo, Business for $99/mo, and Growth for $299/mo. Every new organization starts with a 14-day free trial, which requires a credit card. Agents can sign up for free, create the initial workspace setup, and hand over administration to a human client who enters their billing details to start the trial. This ensures that the agent's work is preserved while providing human developers with full administrative control.