AI Agent Sandboxes Compared (2026)
I compare E2B, Perplexity SPACE, NVIDIA OpenShell, Anthropic srt and Kernel on isolation, pricing, free tiers, MCP support and real install commands.
By agentools
- E2B: Hosted code sandboxes with SDKs
- Perplexity SPACE: Self-hosting Firecracker microVMs
- OpenShell: Policy-controlled agent fleets
- Anthropic Sandbox Runtime (srt): Local coding agents and MCP servers
- Kernel: Browser agents in the cloud
The best AI agent sandbox depends on where the agent runs. E2B fits most app builders who want a hosted sandbox with an SDK. Perplexity SPACE suits teams that want to self-host Firecracker microVMs. OpenShell fits fleets that need network and credential policy. Anthropic's srt fits local coding agents. Kernel fits browser agents.
I sandbox agents because I don't trust the code they write or the text they read. Generated code can run rm -rf in the wrong directory, and a prompt injection in a web page can tell the agent to read ~/.ssh or send your API keys somewhere.
There are two families. Cloud or self-hosted microVM sandboxes give your app a fresh Linux machine over an API, then throw it away. Local sandboxes restrict an agent running on your own machine, so it can work in your repo without reaching your other files or the whole internet. Kernel covers browsers instead of code.
At a glance
| Tool | Best for | Pricing | Type |
|---|---|---|---|
 E2B | Hosted code sandboxes with SDKs | Free tier | SDK + cloud |
 Perplexity SPACE | Self-hosting Firecracker microVMs | Free, open source | Sandbox platform (self-hosted) |
 OpenShell | Policy-controlled agent fleets | Open source | Agent runtime (CLI + gateway + SDKs) |
 Anthropic Sandbox Runtime (srt) | Local coding agents and MCP servers | Free | CLI |
 Kernel | Browser agents in the cloud | Free tier | Browser API |
The 5 picks
1. E2B
Secure cloud sandboxes for AI agents
E2B is open-source infrastructure (Apache 2.0) for running AI-generated code in cloud sandboxes. Each sandbox is a small Linux machine, isolated from the others, that you control from the JavaScript or Python SDK. It covers commands, a Code Interpreter SDK, and a Desktop SDK for computer use.
Its MCP gateway runs inside the sandbox and exposes 200+ servers from the Docker MCP Catalog, or custom ones from GitHub, through one endpoint (sandbox.getMcpUrl() plus a token).
npm i e2b
pip install e2b
pip install e2b-code-interpreter
Set E2B_API_KEY first. Hobby is free with a one-time $100 credit; Pro is $150/month plus per-second usage.
Caveat: it is hosted by default, so your code runs on their cloud (self-hosting takes Terraform). The Pro fee is steep for side projects, and the old standalone MCP server repo is deprecated.
Pricing: Free tierSDK + cloud
2. Perplexity SPACE
Self-hosted sandboxes that run agent code in isolated Firecracker microVMs
Perplexity SPACE is Perplexity's open-source (Apache 2.0) sandbox platform, written in Rust. It runs code in isolated Firecracker microVMs. Your app uses an HTTP API to create Linux environments from a template, run commands, stream output, and pause, wake or delete sandboxes. Warm pools and base snapshots keep starts fast; egress profiles set network policy.
Its E2B Compatibility Wrapper lets the E2B Python SDK point at your own cluster.
git clone https://github.com/perplexityai/SPACE.git && cd SPACE
bash infra/space/kind/scripts/install-prereqs.sh
bash infra/space/kind/scripts/install-fc-vendor.sh
bash infra/space/kind/scripts/up.sh
Local setup is a Kind cluster on a Linux x86_64 host with KVM and about 30 GiB of free disk; it does not run directly on macOS. There is no MCP server.
Caveat: this is team infrastructure, not a one-command app, and the local deployment uses development passwords and keys, so keep it private.
Pricing: Free, open sourceSandbox platform (self-hosted)
3. OpenShell
NVIDIA's sandboxed runtime for autonomous agents, with every file, syscall and network call checked against your policy
NVIDIA OpenShell is an open-source (Apache 2.0) runtime for fleets of autonomous agents. Each agent runs in a sandbox with kernel-level controls on file access and system calls. Every outbound connection passes a policy check, and agents never see real credentials: OpenShell injects them only into requests to approved endpoints.
It runs on Linux, Apple Silicon Macs, or Windows with WSL 2 (experimental), via Docker, Podman or host virtualization. There is no MCP server; npx skills add NVIDIA/OpenShell teaches a coding agent to drive the CLI and write policies.
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo
Anonymous telemetry is on by default; set OPENSHELL_TELEMETRY_ENABLED=false to disable it.
Caveat: you write and maintain the policies, and the project is young (0.1.x).
Pricing: Open sourceAgent runtime (CLI + gateway + SDKs)
4. Anthropic Sandbox Runtime (srt)
OS level sandbox for agents and MCP servers, no container needed
Sandbox Runtime (srt) is the sandboxing layer from Claude Code, released by Anthropic as an open-source CLI and TypeScript library (Apache 2.0). There is no container or VM: it uses Seatbelt on macOS and bubblewrap on Linux (Windows is in alpha), plus a proxy for network domain allowlists.
Prefix a command with srt and the rules cover its whole process tree: writes only to allowed paths, reads denied on places like ~/.ssh.
npm install -g @anthropic-ai/sandbox-runtime
srt "curl example.com"
To sandbox a local MCP server, change its command in .mcp.json from npx to srt with args ["npx", ...], and set rules in ~/.srt-settings.json.
Caveat: this is process-level restriction on your own machine, weaker than a microVM, and not for hostile code at scale. It is a Beta Research Preview, so config formats may change.
Pricing: FreeCLI
5. Kernel
Fast cloud browsers for web agents
Kernel is a browser sandbox, not a code sandbox. It hosts cloud browsers for web agents, so browsing happens in a session on their side, not on your machine. Agents connect over CDP from Playwright or Puppeteer, with live view, session replays, managed stealth mode, managed auth and browser pools. Idle time in standby is not charged.
Its hosted remote MCP server (OAuth 2.1 or API key) launches Chromium browsers and runs Playwright code; set it up with kernel mcp install --target <target>.
brew install kernel/tap/kernel
# or
npm install -g @onkernel/cli
The Developer plan is free plus usage, with $5/month in credits. Hobbyist is $30/month and Start-Up $200/month.
Caveat: it only handles browsing, the service is proprietary (its browser images are open source), and sessions run on their cloud.
Pricing: Free tierBrowser API
More to consider
Comparison table
| Tool | Type | Isolation | Pricing | Free tier | MCP support | Open source |
|---|---|---|---|---|---|---|
| E2B | Cloud SDK (self-host option) | Per-sandbox VM | Free Hobby, Pro $150/mo + per-second usage | $100 one-time credit | Yes, MCP gateway (200+ servers) | Yes, Apache 2.0 |
| Perplexity SPACE | Self-hosted platform | Firecracker microVM | Free, you pay for infra | Free (self-hosted) | No | Yes, Apache 2.0 |
| OpenShell | Self-hosted runtime | Kernel-level policy sandbox | Free, you pay for infra | Free | No (agent skills) | Yes, Apache 2.0 |
| srt | Local CLI | OS sandbox (Seatbelt, bubblewrap) | Free | Free | Wraps local MCP servers | Yes, Apache 2.0 |
| Kernel | Cloud browsers | Hosted browser sessions | Free + usage, $30 and $200 plans | $5/mo credits | Yes, hosted remote MCP | No (browser images open source) |
How I would choose
- Building an app that runs model-written code: E2B, starting on the free Hobby tier.
- Code must stay on my own infrastructure: Perplexity SPACE, or self-hosted E2B. SPACE's wrapper lets E2B Python SDK code point at my cluster.
- Many autonomous agents with credentials and egress to control: OpenShell, accepting that writing policies becomes my job.
- Claude Code or another coding agent on my laptop: srt. Deny reads on
~/.ssh, allow writes in the repo, allowlist the domains it needs. - A local MCP server I don't fully trust: srt again, through
.mcp.json. - An agent that browses the web: Kernel, paired with a code sandbox if the agent also runs code.
- Payment and login secrets in a browser: Agent Vault gives agents mock card and login tokens and swaps in the real values inside a secure enclave.
On Docker: as a general point, a container shares the host kernel, so its boundary is thinner than a VM's. That is the usual reason microVM tools exist. For code I wrote, a container may be fine. For code a model wrote after reading the internet, I want more.
FAQ
What is an AI agent sandbox?
An isolated environment where an agent's code, commands or browser sessions run with limited access to files, network and credentials. If the agent errs or gets prompt injected, the damage stays inside.
Is Docker enough to sandbox an AI agent?
Sometimes. Containers share the host kernel, generally a weaker boundary than a microVM, so for untrusted generated code I would use E2B, SPACE or OpenShell.
Can I self-host E2B?
Yes, the runtime deploys with Terraform on AWS, GCP, Azure or a general Linux machine. Perplexity SPACE also accepts the E2B Python SDK through its compatibility wrapper.
How do I sandbox Claude Code or an MCP server locally?
Install srt with npm and prefix commands with srt, or switch the MCP server's command in .mcp.json from npx to srt. Rules go in ~/.srt-settings.json.
What does an AI agent sandbox cost?
srt, SPACE and OpenShell are free, though self-hosting means paying for infrastructure. E2B Pro is $150/month plus per-second usage, and Kernel starts free with $5/month credits.