diff --git a/README.md b/README.md
index 5859e74..30cb56c 100644
--- a/README.md
+++ b/README.md
@@ -45,6 +45,7 @@ Projects using **Linux** security primitives (and a few Mac exceptions) such as
 | 🔥 [sandlock](https://github.com/multikernel/sandlock) | Landlock, seccomp, seccomp-notif | Process sandbox combining Landlock (filesystem + network + IPC), seccomp-bpf (syscall filtering), and seccomp user notification (resource limits, IP enforcement, /proc virtualization, port virtualization). No root, no cgroups, no containers. COW fork enables O(1) memory scaling — parent loads model once, children share via copy-on-write. See also the [architecture blog post](https://multikernel.io/2026/03/14/introducing-sandlock/). |
 | 🔥 [ironclaw](https://github.com/nearai/ironclaw) | WASM, Linux namespaces, credential-injection | WASM-sandboxed tools (capability-based permissions, endpoint allowlisting), host-boundary credential injection where secrets never enter WASM memory. |
 | 🔥 [amla-sandbox](https://github.com/amlalabs/amla-sandbox) | WASM, capabilities | WASM-based agent sandbox using wasmtime with a capability-based security model that enforces per-tool method constraints, call limits, and parameter validation before any tool invocation leaves the sandbox. |
+| [cc-sandbox-server](https://github.com/weijiafu14/cc-sandbox-server) | split-brain, host-side credentials, crash-recovery | Instead of putting the agent in the box, keeps the harness, session, and credentials on the **host** and forwards only *tool execution* into a disposable sandbox (any substrate) over one persistent connection. Same binary runs agent mode on the host and `--tool-server` mode inside the sandbox, so tool behavior is byte-for-byte identical; a crashed sandbox is rebuilt from a per-task volume while the turn continues. An open implementation of Anthropic's "decouple the brain from the hands." |
 | 🔥 [OpenFang](https://github.com/RightNow-AI/openfang) | WASM, taint-tracking | Uses a WASM dual-metered sandbox: wasmtime with both fuel metering and epoch interruption, backed by a watchdog thread that force-kills runaway code. Seeks to implement information flow taint tracking (secrets labelled from source to sink), Ed25519-signed agent manifests, and other techniques. |
 | 🔥 [cua](https://cua.ai/docs/computer-sdk/computers) | containers, qemu | Computer-use agent SDK using Linux containers and QEMU-inside-Docker for full desktop environment isolation. See also the [qemu-docker library](https://github.com/trycua/cua/tree/699350bfba66ba8a0186ed9c98c8b084b32462be/libs/qemu-docker). |
 | [goose + boxlite discussion](https://github.com/block/goose/issues/6040) | KVM, libkrun | GitHub issue discussing integration of boxlite KVM-based sandboxing into Block's goose agent framework. |