A curated list of code-execution sandboxing solutions for AI/LLM agents.
- E2B - Open-source cloud runtime with Linux OS and SDK support.
- AgentSphere - MicroVM sandboxes with MCP integration for secure LLM code execution.
- CreateOS - MicroVMs with pause-to-snapshot, fork-based branching, and private overlay networking for multi-agent systems. SDK.
- Runloop - Fast devboxes with snapshots and repo connections.
- Modal Sandboxes - Programmatic sandboxes at massive scale with sub-second startup, snapshotting, and fine-grained networking controls.
- Deno Sandboxes - Millisecond boot times.
- Sprites - Persistent Firecracker VMs with exec sessions and checkpoint/restore capabilities.
- Cognitora - Firecracker microVMs with hardware-level isolation.
- exe.dev - 2-second Ubuntu VMs for coding agents.
- YepCode Run - Serverless JavaScript/Python execution with enterprise-grade sandboxing.
- shellbox.dev - SSH-accessible Linux boxes.
- Novita Sandbox - Agent deployment framework with SDK decorators and one-click configuration.
- BlueRock Agent Sandbox - Commercial sandbox with full MCP visibility and action-level tracing.
- Sandbox as a Service - Full cloud VMs rather than microVMs: 24-hour sessions with no subscription tier, public preview URLs that open no inbound port on the sandbox, and per-second billing. REST API and MCP server.
- Tenki Sandbox - Hardware-isolated Linux VMs with warm-start sessions, snapshot/fork, and multi-language SDKs.
- BoxCompute - Full Linux VMs on KubeVirt, hosted in Malaysia, with root access, an HTTP API, CLI and TypeScript/Python SDKs.
- Lizard Sandboxes - Managed sandboxes with a Firecracker microVM runtime, snapshots, live forks, and TypeScript/Python SDKs.
- Runtime - Firecracker microVMs with pause and wake that keep memory and processes, snapshots and forks, and an MCP server. SDK.
- OmniRun - Firecracker microVM sandboxes with 250ms boot, desktop GUI control, end-to-end encryption, and TypeScript/Python SDKs.
- AIO Sandbox - All-in-one container with browser, terminal, VS Code, Jupyter, and MCP.
- Sandboxer - Forkable server for LLMs and agents.
- Kubernetes Agent Sandbox - Kubernetes APIs with pluggable isolation backends (gVisor/Kata) for secure agent workloads at scale.
- Arrakis - MicroVM isolation with snapshots and backtracking.
- BunkerVM - Firecracker microVMs that record each command, rewind to any step, and compare agent runs.
- Bouvet - Rust-based sandbox.
- Microsandbox - Self-hosted with VM-level isolation and under 200ms boot times.
- SandboxAI - Multi-cloud infrastructure for AI-generated code.
- SandBase Harness - Self-hosted agent runtime with per-session Docker and Kubernetes sandboxes, MCP tool permissions, approvals, and audit/replay.
- Daytona - Open-source infrastructure with SDK/CLI.
- Fence - Lightweight CLI sandbox with network and filesystem restrictions using OS-native tools.
- Landrun - Landlock-based sandboxing without root.
- cplt - Seatbelt and Landlock sandbox for coding agents, with policy committed to the repository.
- nono - Capability-based shell using kernel-level security primitives.
- yolo-cage - Anti-exfiltration sandbox.
- Yolobox - Docker containers protecting home directory.
- Flintlock - MicroVM lifecycle management backed by containerd for building higher-level solutions.
- Capsule - WASM runners.
- Enclave - JavaScript sandbox preventing code injection and prototype pollution.
- Rivet Agents - Universal API for Claude Code, Codex, OpenCode, and Amp.
- pctx - Execution layer with type-checked Deno sandboxes.
- pctx-sandbox - Python decorator for untrusted code.
- AgentFence - Security testing platform for prompt injection and secret leakage vulnerabilities.
- OpenServ - TypeScript framework for autonomous agents.
- AgentBox - Run coding agents (Claude Code, Codex, OpenCode) in parallel sandboxed VMs — local Docker (default), self-hosted, or cloud (Hetzner, Daytona, Vercel, E2B, DigitalOcean). Sub-1s checkpoints, per-box browser/VS Code/shells, git credentials kept on the host.
- AEGIS - Self-hosted orchestrator that runs autonomous agents in isolated, policy-enforced runtimes (Firecracker, Podman or Docker) with deny-by-default policy. AGPL-3.0, pre-alpha.
- SIwithin - Runs Claude Code unattended inside a per-run macOS sandbox-exec profile (home folder refused whole), under a true-dollar budget enforced three times, with a sha256 receipt per run.
- Mudroom - macOS app and CLI that runs coding agents in Linux micro-VMs (Apple container) on a copy-on-write clone of the project, behind a network allowlist proxy, with per-hunk diff review before changes are applied.
- bashkit4j - In-JVM sandboxed bash: 160+ reimplemented commands on an in-memory VFS, opt-in allowlisted host mounts, zero OS processes — no containers, no VMs (Java 17+).
- Agents.one Playground - Upload Python agents and share public playground links for zero-install testing.
- AgentSandboxes - Index of cloud sandbox providers with source-linked specs, prices and a REST API.
- AI Agent Sandbox - Run agents in-browser with Pyodide.
- Browser Use Sandboxes - Production browser automation.
- ComputeSDK - Universal API across multiple cloud providers with automatic provider detection.
- VibeKit - SDK supporting E2B, Daytona, Modal, and other providers.
- ViteHub - TypeScript sandbox runtime with Cloudflare and Vercel adapters.
Contributions welcome! Please read the contribution guidelines first.