daytonaio/daytona
Went closed source in June 2026; the public repository is now explicitly unmaintained. Also the reason this site treats 'open source' as a claim to verify. → full assessment
Hosted sandbox API / CDEagent-specificcloud
Verdicts · skip
Skip for now
This is the chapter that saves the most time, and the one nobody writes. These repositories are not necessarily bad — most contain at least one good idea — but the expected hassle and risk look larger than the likely benefit, and there are better uses for your evening.
The five shapes of a repo to skip, and one category error
1 · The stalled wrapper
A few hundred stars, a promising README, and no commits for four to eight months. It is not archived, which is worse: the blocklists and default profiles are rotting in place and there is no signal that maintenance stopped. Look at the last-commit date before the star count, every time.
2 · The launch-week project
Impressive architecture, a Hacker News thread, and development that stopped days after the launch. One thorough first-wave project — with egress inspection, branch isolation and blocked merges — went quiet two days after its announcement thread. The engineering was real; the commitment was not.
3 · The single-day repository
Twelve commits on one day, no releases, one author, five to fifteen stars, and a README describing a complete security model. These are sketches, not software. Some contain a genuinely good idea — time-travel debugging for agent microVMs is a real invention — and the idea is the part worth keeping.
4 · The licence trap
A GPL-3.0 desktop application that would be useful to study, except that copying any of it would relicense your product. Combine that with a stalled project and there is nothing left to take but the screenshots.
5 · The repudiated repo
The project that built its reputation on being open source and then closed the production code while leaving the public repository unmaintained. For a sandbox, the source is the trust boundary, so this is not a licensing inconvenience — it removes the mechanism by which you could check the claim.
6 · And the category error
Tools that give an agent more access, presented in lists alongside tools that contain it. An MCP server that controls your Windows desktop, a runner that executes on your host, an "agent framework" with no boundary at all. Useful, sometimes excellent, and not what you are looking for when you search for a sandbox.
The list
Each entry names the reason. Several are worth reading for their ideas — that is why some of them appear in the watch list analysis rather than being dismissed outright.
codesandbox/codesandbox-client
The browser IDE. Interesting history in WebContainers; the agent story moved to the SDK.
Hosted sandbox API / CDEbrowser
FerretDB/FerretDB
Not a sandbox. Included only because it showed up in a sandbox list; left here as a reminder to check your sources.
Adjacent toolinglinux
stackblitz/webcontainer-core
Node.js in a browser tab. Nobody has committed to the public repository since April 2025.
WASM / language isolatebrowser
strongdm/leash
Cedar-policy container wrapper from StrongDM. Ships a DISCLAIMER.txt disclaiming support, and the repo has been quiet since April 2026.
Agent sandbox wrapperagent-specificlinux · macos
genuinetools/bpfd
BPF program runner for container awareness. Archived since May 2021.
Network / egress controllinux
BIGPPWONG/EdgeBox
E2B-based local sandbox with a VNC desktop, Electron shell, GPL-3.0, stalled since April 2026, and a README that injects an unrelated project recommendation. → full assessment
Computer-use / desktop automationagent-specificlinux · macos · windows
robcholz/vibebox
Fast Apple-Silicon Seatbelt wrapper. Commits stopped in February 2026.
Agent sandbox wrapperagent-specificmacos
obra/packnplay
Docker sandbox with automatic worktrees. Quiet since March 2026 and never took off.
Agent sandbox wrapperagent-specificlinux · macos
deepclause/deepclause-sdk
DML-style runtime authorization SDK. Fifty-six stars.
Policy, approval & auditagent-specificlinux · macos
Kiln-AI/Kilntainers
MCP server that hands out ephemeral shells. Last push March 2026.
Agent sandbox wrapperagent-specificlinux
HQarroum/microbox
Lightweight ephemeral Linux sandboxes. Last push October 2025.
Agent sandbox wrapperagent-specificlinux
cirruslabs/chamber
Tart-backed ephemeral macOS VM per agent. AGPL, quiet since December 2025.
Full VM / hypervisoragent-specificmacos
colony-2/shai
Resource Sets as committed team policy. Forty-three stars and no traction since March.
Agent sandbox wrapperagent-specificlinux
akshayaggarwal99/boxed
Multi-backend (Docker/Firecracker/WASM) execution engine. Thirteen stars.
Agent sandbox wrapperagent-specificlinux
divmain/treebeard
Ephemeral worktrees with copy-on-write and network gating. Twelve stars and two days of development.
Filesystem / copy-on-writeagent-specificlinux · macos
matheusmoreira/virtdev
Per-project Arch VMs with nftables egress zones. 8 stars, one author, no credential story.
Full VM / hypervisoragent-specificlinux
PunkGo/punkgo-jack
Merkle-logged audit receipts for hook events. Seven stars, clever, unproven.
Policy, approval & auditagent-specificlinux · macos
ligon/sucoder
Unix permissions as a boundary. Six stars; the idea is old and the repo is thin.
Agent sandbox wrapperagent-specificlinux
paulux84/codex-lockbox
Five stars, one author, stale since February 2026.
Agent sandbox wrapperagent-specificlinux
PredicateSystems/predicate-secure
Policy-based authorization with post-run verification. Five stars.
Policy, approval & auditagent-specificlinux · macos
Sarthak30/agentsafe
Per-task Firecracker VMs. Four stars and one day of commits.
Agent sandbox wrapperagent-specificlinux
ashishgituser/nervos
Agent microVMs with a Git-first workflow. The repository no longer resolves at its original URL — which is itself the cautionary point about building on a wrapper with one author and no release history.
Agent sandbox wrapperagent-specificlinux
Daytona
★ 71kforks 5.6kopen issues 457created 2024-02-06last push 2026-07-24licence none detected
EdgeBox
★ 213forks 26open issues 2created 2025-09-12last push 2026-04-22licence GPL-3.0
Not an isolation layer (a separate list, on purpose)
These are useful pieces of software that do not contain the agent. Including them here is not a criticism; it is a warning about how they get misremembered after you have read three comparison tables in a row.
CursorTouch/Windows-MCP
Gives an agent the whole Windows desktop. The inverse of a sandbox, and it should be labelled that way. → full assessment
Computer-use / desktop automationagent-specificwindows
The misreading to avoid
"The agent can control my desktop" and "the agent is contained on my desktop" are opposite claims, and they appear within a page of each other in several published lists. If a tool needs full UI control to work, it cannot be sandboxed by the same tool that gives it that control — the containment has to come from somewhere else, which in practice means a VM.
What to do instead
If you wanted a sandbox wrapper
You almost certainly want one of these instead: a rootless Podman container with a hardened flag set and a narrow mount; your agent's own built-in sandbox left on; or a VM managed by Lima, Incus, UTM or Multipass. Every item on this page is a wrapper around one of those, and the wrapper is the part that stops being maintained.
If you wanted the security, not the tool
The security people are looking for in abandoned wrappers is usually available from three changes that have nothing to do with which project you install: move credentials out of the agent's environment, put the egress policy in the kernel, and make the agent's workspace a copy rather than your original. That is a weekend of work with no dependency risk at all.
A note of respect
Most of these repositories were written by one person who saw a real problem and shipped something for it in a weekend. Several of them are better thought through than projects with fifty times the stars. The judgement here is not about the quality of the work — it is about whether a stranger should build a production dependency on something that has not yet been maintained for long enough to be predictable. If one of these starts shipping releases again, revisit it.