{
 "schema_version": 1,
 "generated": "2026-10-29",
 "url": "https://dedupedai.com/best-ai-repos-for/sandboxing-ai-agents/",
 "task": "sandboxing AI agents",
 "question": "What is the best open-source sandbox for running AI agents safely?",
 "answer": "The best open-source AI repos for sandboxing AI agents right now are NVIDIA OpenShell, Anthropic Sandbox Runtime and Cua. Anthropic Sandbox Runtime is the lightest option (OS-level file and network limits, no container); NVIDIA OpenShell gives each agent a sandbox with a policy check on every network connection and keeps real credentials away from it; Cua gives an agent a full disposable desktop, and SPACE runs code in Firecracker microVMs behind an HTTP API.",
 "md": "https://dedupedai.com/best-ai-repos-for/sandboxing-ai-agents/index.md",
 "repos": [
  {
   "repo": "NVIDIA/OpenShell",
   "title": "NVIDIA OpenShell",
   "url": "https://dedupedai.com/use-cases/nvidia-openshell/",
   "github": "https://github.com/NVIDIA/OpenShell",
   "what": "OpenShell is NVIDIA's open-source runtime for running autonomous AI agents safely. Each agent gets an isolated sandbox where kernel controls confine file access and system calls, every network connection passes a policy check, and real credentials are only added to requests bound for approved endpoints. Policy changes are checked with formal verification and risky new access waits for human review.",
   "who": "Developers and platform teams who want coding agents to install packages, call APIs and use credentials without giving them the whole machine.",
   "stars": 19531,
   "language": "Rust",
   "requirements": [
    "Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental)",
    "Docker, Podman, or host virtualization",
    "An agent to run inside the sandbox; the default image is minimal Ubuntu with no agent installed",
    "For Kubernetes: Helm and a CNI that enforces NetworkPolicy"
   ],
   "uc_count": 3,
   "use_cases": [
    {
     "title": "Run a coding agent in a locked-down sandbox",
     "url": "https://dedupedai.com/use-cases/nvidia-openshell/run-a-coding-agent-in-an-openshell-sandbox/"
    },
    {
     "title": "Let agents use API keys they can never see",
     "url": "https://dedupedai.com/use-cases/nvidia-openshell/keep-api-keys-away-from-your-agents/"
    },
    {
     "title": "Teach your coding agent to drive OpenShell",
     "url": "https://dedupedai.com/use-cases/nvidia-openshell/teach-your-agent-to-write-openshell-policies/"
    }
   ],
   "best": {
    "title": "Run a coding agent in a locked-down sandbox",
    "url": "https://dedupedai.com/use-cases/nvidia-openshell/run-a-coding-agent-in-an-openshell-sandbox/",
    "difficulty": "Intermediate",
    "time": "30 minutes",
    "agents": [
     "claude-code",
     "codex",
     "cursor"
    ],
    "steps": [
     "Run curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh to install the CLI and a local gateway",
     "Run openshell sandbox create --name demo to create your first sandbox",
     "Follow the Run Your First Agent guide in the docs, which runs OpenCode against a free OpenRouter model inside the sandbox",
     "When the agent needs new access, approve it from OpenShell instead of granting it up front",
     "Set OPENSHELL_TELEMETRY_ENABLED=false on the gateway if you want to turn off the anonymous telemetry"
    ],
    "md": "https://dedupedai.com/use-cases/nvidia-openshell/run-a-coding-agent-in-an-openshell-sandbox/index.md"
   }
  },
  {
   "repo": "anthropics/sandbox-runtime",
   "title": "Anthropic Sandbox Runtime",
   "url": "https://dedupedai.com/use-cases/anthropics-sandbox-runtime/",
   "github": "https://github.com/anthropics/sandbox-runtime",
   "what": "Anthropic Sandbox Runtime (srt) is a lightweight tool that enforces filesystem and network restrictions on any process at the OS level, without a container. It uses sandbox-exec on macOS, bubblewrap on Linux and a dedicated local account on Windows, plus proxy-based network filtering, and was built for Claude Code to sandbox agents, local MCP servers and bash commands.",
   "who": "Developers running AI agents, MCP servers or untrusted scripts who want a quick allowlist for files and network without setting up Docker.",
   "stars": 6512,
   "language": "TypeScript",
   "requirements": [
    "Node.js and npm to install the CLI",
    "macOS, Linux with bubblewrap, or Windows",
    "Optional: a settings file at ~/.srt-settings.json; without one srt uses built-in defaults"
   ],
   "uc_count": 3,
   "use_cases": [
    {
     "title": "Sandbox an MCP server with one line in .mcp.json",
     "url": "https://dedupedai.com/use-cases/anthropics-sandbox-runtime/sandbox-an-mcp-server/"
    },
    {
     "title": "Keep agent shell commands away from your SSH keys",
     "url": "https://dedupedai.com/use-cases/anthropics-sandbox-runtime/block-agent-commands-from-ssh-keys-and-internet/"
    },
    {
     "title": "Change network rules while a sandboxed command runs",
     "url": "https://dedupedai.com/use-cases/anthropics-sandbox-runtime/change-sandbox-rules-while-a-command-runs/"
    }
   ],
   "best": {
    "title": "Sandbox an MCP server with one line in .mcp.json",
    "url": "https://dedupedai.com/use-cases/anthropics-sandbox-runtime/sandbox-an-mcp-server/",
    "difficulty": "Beginner",
    "time": "15 minutes",
    "agents": [
     "claude-code",
     "codex",
     "cursor"
    ],
    "steps": [
     "Run npm install -g @anthropic-ai/sandbox-runtime",
     "In .mcp.json, change the server's command to srt and move the original command into args, for example \"command\": \"srt\" with \"args\": [\"npx\", \"-y\", \"@modelcontextprotocol/server-filesystem\"]",
     "Create ~/.srt-settings.json with filesystem rules (denyRead, allowWrite, denyWrite) and network rules (allowedDomains, deniedDomains)",
     "Restart your agent and ask the MCP server to write to a denied path to confirm it gets EPERM"
    ],
    "md": "https://dedupedai.com/use-cases/anthropics-sandbox-runtime/sandbox-an-mcp-server/index.md"
   }
  },
  {
   "repo": "trycua/cua",
   "title": "Cua",
   "url": "https://dedupedai.com/use-cases/trycua-cua/",
   "github": "https://github.com/trycua/cua",
   "what": "Cua gives AI agents computers they can use. The repository holds Cua Spaces (a desktop app that gives agents full macOS or Linux desktops on your Mac, other machines you own or your own cloud), Cua Driver for operating native apps and browsers, Lume for local macOS and Linux VMs on Apple Silicon, a Cua SDK and CLI for sandboxes, CUA-S1 decision models and Cua Bench for evaluating computer-use agents.",
   "who": "Developers building or running computer-use agents who need safe desktops, sandboxes and app automation instead of letting agents loose on their main machine.",
   "stars": 31034,
   "language": "Rust",
   "requirements": [
    "macOS 26 or later for Cua Spaces",
    "Apple Silicon for Lume VMs",
    "macOS, Linux or Windows for the cua CLI and Cua Driver",
    "Spaces is free for individuals; Pro and Teams are paid"
   ],
   "uc_count": 3,
   "use_cases": [
    {
     "title": "Spin up a disposable Linux sandbox for an agent",
     "url": "https://dedupedai.com/use-cases/trycua-cua/spin-up-a-sandbox-for-an-agent/"
    },
    {
     "title": "Let an agent operate native desktop apps without taking your mouse",
     "url": "https://dedupedai.com/use-cases/trycua-cua/let-an-agent-operate-desktop-apps/"
    },
    {
     "title": "Create a local macOS VM on Apple Silicon with Lume",
     "url": "https://dedupedai.com/use-cases/trycua-cua/create-a-local-macos-vm-with-lume/"
    }
   ],
   "best": {
    "title": "Spin up a disposable Linux sandbox for an agent",
    "url": "https://dedupedai.com/use-cases/trycua-cua/spin-up-a-sandbox-for-an-agent/",
    "difficulty": "Beginner",
    "time": "15 minutes",
    "agents": [
     "claude-code",
     "codex",
     "cursor"
    ],
    "steps": [
     "Install with curl -fsSL https://cua.ai/install.sh | sh (Windows uses the PowerShell installer)",
     "Create a sandbox: cua sb create ubuntu --name dev",
     "Run a command inside: cua sb exec dev uname -a",
     "Take a screenshot with cua sb screenshot dev",
     "Remove it when done with cua sb rm dev"
    ],
    "md": "https://dedupedai.com/use-cases/trycua-cua/spin-up-a-sandbox-for-an-agent/index.md"
   }
  },
  {
   "repo": "perplexityai/SPACE",
   "title": "SPACE (Perplexity)",
   "url": "https://dedupedai.com/use-cases/perplexityai-space/",
   "github": "https://github.com/perplexityai/SPACE",
   "what": "SPACE is a Rust sandbox platform that runs code in isolated Firecracker microVMs, controlled through an HTTP API.",
   "who": "Platform engineers and developers who need a separate, isolated execution environment for agent or user code, reached over HTTP.",
   "stars": 1846,
   "language": "Rust",
   "requirements": [
    "A host that meets the prerequisites in docs/installation.md",
    "Docker-compatible local setup for a Kind cluster, as described in docs/installation.md",
    "Bash for installation and cluster diagnostics",
    "Git and Python 3.11+ and mdBook 0.4.52 only if you build the docs locally"
   ],
   "uc_count": 5,
   "use_cases": [
    {
     "title": "Run agent-written code in an isolated sandbox",
     "url": "https://dedupedai.com/use-cases/perplexityai-space/run-agent-code-in-isolated-sandbox/"
    },
    {
     "title": "Point existing E2B Python SDK code at SPACE",
     "url": "https://dedupedai.com/use-cases/perplexityai-space/point-e2b-sdk-code-at-space/"
    },
    {
     "title": "Build the SPACE guide and API docs on your machine",
     "url": "https://dedupedai.com/use-cases/perplexityai-space/build-spitfire-docs-locally/"
    }
   ],
   "best": {
    "title": "Run agent-written code in an isolated sandbox",
    "url": "https://dedupedai.com/use-cases/perplexityai-space/run-agent-code-in-isolated-sandbox/",
    "difficulty": "Intermediate",
    "time": "2 hours",
    "agents": [],
    "steps": [
     "Follow [Installation and configuration](docs/installation.md) to deploy SPACE in a local Kind cluster and authenticate.",
     "Follow [Your first sandbox](docs/first-sandbox.md) to create a sandbox from a template and wait for readiness.",
     "Create a command session, attach to it to start the process, and read the output and exit result.",
     "Delete the sandbox when the run finishes."
    ],
    "md": "https://dedupedai.com/use-cases/perplexityai-space/run-agent-code-in-isolated-sandbox/index.md"
   }
  },
  {
   "repo": "strands-agents/box",
   "title": "Strands Box",
   "url": "https://dedupedai.com/use-cases/strands-agents-box/",
   "github": "https://github.com/strands-agents/box",
   "what": "Strands Box is an open source Rust sandbox engine that restricts what AI agents can execute, read, write, and reach on the network.",
   "who": "Developers and security-minded teams who want to run AI agents with enforced file, program, and network limits on a Mac with Apple silicon.",
   "stars": 453,
   "language": "Rust",
   "requirements": [
    "A Mac with Apple silicon running macOS 15 or later",
    "Node.js 22.21 or later from Homebrew, if you follow the getting-started guide",
    "Access to Claude Opus 5 on Amazon Bedrock in us-west-2, if you follow the getting-started guide",
    "A Rust toolchain via rustup, only if you build from source"
   ],
   "uc_count": 4,
   "use_cases": [
    {
     "title": "Run a coding agent inside a restricted Box sandbox",
     "url": "https://dedupedai.com/use-cases/strands-agents-box/run-coding-agent-in-sandbox/"
    },
    {
     "title": "Keep API keys away from an agent with credential injection",
     "url": "https://dedupedai.com/use-cases/strands-agents-box/keep-api-keys-out-of-agent/"
    },
    {
     "title": "Audit every policy decision an agent made",
     "url": "https://dedupedai.com/use-cases/strands-agents-box/audit-agent-policy-decisions/"
    }
   ],
   "best": {
    "title": "Run a coding agent inside a restricted Box sandbox",
    "url": "https://dedupedai.com/use-cases/strands-agents-box/run-coding-agent-in-sandbox/",
    "difficulty": "Intermediate",
    "time": "60 minutes",
    "agents": [],
    "steps": [
     "Confirm you have a Mac with Apple silicon and macOS 15 or later.",
     "Run curl -fsSL https://raw.githubusercontent.com/strands-agents/box/main/download.sh | sh",
     "Run ./box-core/box --version to confirm the binaries unpacked into ./box-core.",
     "Edit Box.toml to set the agent command and direct file and network grants, and edit policy.dw to set rules for operations Box checks.",
     "Follow the getting-started guide in docs/user/getting-started.md to run the Box."
    ],
    "md": "https://dedupedai.com/use-cases/strands-agents-box/run-coding-agent-in-sandbox/index.md"
   }
  }
 ]
}