OpenSandbox

Overview

OpenSandbox is an Apache-2.0 sandbox platform for AI applications and agents. The project provides multi-language SDKs, a CLI, an MCP server, Docker and Kubernetes runtimes, network policy controls, credential vault support, command/file/code-interpreter environments, and guidance for secure container runtimes such as gVisor, Kata Containers, and Firecracker microVMs.

Use it when an agent needs an isolated place to run commands, write files, execute code, expose temporary services, or run workload-specific tools without handing the agent direct access to the host machine.

Install

For the Python SDK:

pip install opensandbox

For the CLI:

pip install opensandbox-cli

For MCP clients:

pip install opensandbox-mcp
opensandbox-mcp --domain localhost:8080 --protocol http

The README also documents Java/Kotlin, JavaScript/TypeScript, .NET, and Go SDK installation paths. Pick the SDK that matches the agent host and runtime.

MCP Setup

The OpenSandbox MCP server exposes sandbox lifecycle, command execution, and text file operations to MCP-capable clients. A Claude Code stdio setup uses:

claude mcp add opensandbox-sandbox --transport stdio -- \
  opensandbox-mcp --api-key "$OPEN_SANDBOX_API_KEY" --domain "$OPEN_SANDBOX_DOMAIN"

The MCP docs also describe HTTP transport and Cursor configuration. Treat the MCP server as a privileged tool boundary because it can create sandboxes, run commands, read and write files, expose endpoints, and terminate workloads.

Agent Capabilities

Use Cases

• Give Claude Code, Cursor, or another MCP client a sandboxed command and file execution surface.
• Run coding-agent workloads inside Docker or Kubernetes instead of directly on a developer workstation.
• Expose a temporary service from a sandbox and return its endpoint to an agent.
• Add egress policy and credential vault controls around agent workloads.
• Run code interpreter tasks, browser automation, VNC desktops, or VS Code environments inside managed sandboxes.
• Compare OpenSandbox with E2B, Daytona, Microsandbox, and other agent sandbox infrastructure.

Source Review

Verified on 2026-06-18:

• The upstream README describes OpenSandbox as a general-purpose sandbox platform for AI applications with multi-language SDKs, unified sandbox APIs, Docker/Kubernetes runtimes, agent examples, network policy, credential vault, and secure runtime guidance.
• The README states that OpenSandbox is listed in the CNCF Landscape.
• The README documents Python, Java/Kotlin, JavaScript/TypeScript, .NET, and Go SDK installation paths.
• The README documents osb, opensandbox-mcp, local Docker server startup, code interpreter SDK usage, and examples for Claude Code, Gemini CLI, OpenAI Codex CLI, Qwen Code, Kimi CLI, LangGraph, Google ADK, and OpenClaw.
• The MCP README says the MCP server exposes sandbox lifecycle management, command execution, and text file operations to Claude Code, Cursor, and other MCP-capable clients.
• The CLI README documents sandbox creation, command execution, file upload and download, network egress policy, credential vault state, diagnostics, and OpenSandbox-specific skill installation.
• PyPI resolves opensandbox version 0.1.11, opensandbox-cli version 0.1.1, and opensandbox-mcp version 0.1.1.
• The latest GitHub release is java/code-interpreter/v1.0.13, published on 2026-06-16.
• SECURITY.md documents supported versions, release signatures, security reporting, egress policy best practices, audit logging, and least privilege.

Safety and Privacy

OpenSandbox reduces risk by giving agents a dedicated execution environment, but it still runs real code, files, services, images, credentials, and network requests. The sandbox runtime, image source, network policy, credential vault, volume mounts, endpoint exposure, logs, and cleanup policy determine the real security boundary.

Do not treat MCP access as harmless. The MCP server exposes operations that can create workloads, write files, run commands, expose ports, and return outputs to the model. Keep sensitive workloads behind approval, least privilege, network restrictions, observability, and retention controls.

Duplicate Check

Checked current content/tools/, content/agents/, content/mcp/, content/skills/, guides, open pull requests, and repository-wide content for OpenSandbox, opensandbox-group/OpenSandbox, alibaba/OpenSandbox, opensandbox, opensandbox-cli, opensandbox-mcp, OpenSandbox MCP, AI agent sandbox runtime, Kubernetes agent sandbox, Docker agent sandbox, and code interpreter sandbox. Existing E2B, Daytona, Microsandbox, and sandbox-security content cover adjacent infrastructure, but no dedicated OpenSandbox tools entry, exact source URL duplicate, target file, or open duplicate PR was found.

Disclosure

Editorial listing. No paid placement or affiliate link is used. OpenSandbox is Apache-2.0 open-source software; hosted OpenSandbox endpoints, Kubernetes clusters, Docker registries, gVisor, Kata Containers, Firecracker microVMs, cloud providers, MCP clients, model providers, observability systems, and credential vault integrations may have separate licenses, billing, terms, privacy controls, and operational requirements.