Code Capsules
Get started
Built for AI agents

The sandbox built for AI agents

Give your agent a real Linux environment. Create it, run anything, delete it. Three lines of code. No infra. 

// TypeScript
import { Sandbox } from '@codecapsules/sandbox';

await Sandbox.using(async (sb) => {
  const result = await sb.exec('python --version');
  console.log(result.stdout);  // "Python 3.12.3\n"
});  // sandbox deleted automatically
Join the waitlist Read the docs
~125ms boot time
Firecracker microVMs
Python · Node · Browser environments
TypeScript + Python SDKs
REST API no infra to manage

Your agent writes code. Running it safely is the hard part.

Code execution is what separates capable agents from chatbots. The catch: untrusted code running on your server.

Agent-generated code is untrusted

The model decides what to run. You need a hard boundary between that code and your infrastructure.

Side effects are real

File writes, network calls, process spawns — a sandbox environment that shares state with your server is not a sandbox.

Docker is the wrong tool

Containers share the host kernel. For AI-generated code, you want hardware-level isolation — the kind Firecracker provides.

Create. Exec. Delete.

The same lifecycle every time. Ephemeral by default.

01

Create a sandbox

A Firecracker microVM boots in ~125ms. Python, Node, browser with Playwright, or the full stack.

const sb = await Sandbox.create({ flavor: 'python-3.12' });
02

Run any command

Returns stdout, stderr, exit code, and timing. Install packages, run scripts — anything a real terminal can do.

const result = await sb.exec('pip install pandas && python analyse.py');
console.log(result.stdout);
03

Delete when done

Nothing persists. Use Sandbox.using() and deletion is guaranteed even if your code throws.

await sb.delete();
// or: Sandbox.using(async (sb) => { ... })

The simplest code execution API

TypeScript and Python SDKs. Same API, same behaviour. 

// Install
npm install @codecapsules/sandbox

// Basic exec
const result = await Sandbox.using(async (sb) => sb.exec('python -c "print(1+1)"'));
result.stdout;  // "2\n"

// Stream long-running output
for await (const chunk of sb.execStream('python train.py'))
  process.stdout.write(chunk);

// Upload a file, run it, download results
await sb.upload('/workspace/data.csv', csvContent);
await sb.exec('python process.py');
const output = await sb.download('/workspace/result.json');
npm · @codecapsules/sandbox PyPI · codecapsules-sandbox

Pick your environment

Each flavor is a pre-built Linux image ready to go.

python-3.12
  • · Python 3.12
  • · pip
  • · numpy
  • · pandas
  • · requests
  • · git
node-20
  • · Node.js 20
  • · npm
  • · yarn
  • · git
browser
  • · Chromium
  • · Playwright
  • · xvfb
  • · Python 3.12
full
  • · Everything above
  • · jq
  • · ffmpeg
  • · ImageMagick

Works with your agent framework

Drop-in tool definitions for every major framework. Copy, paste, ship.

Claude (Anthropic) OpenAI LangChain 
// Claude tool definition — add to any Anthropic API call
const tools = [{
  name: 'run_code',
  description: 'Execute code in an isolated sandbox and return the output.',
  input_schema: { type: 'object', properties: { code: { type: 'string' } }, required: ['code'] },
}];

async function runCode(code: string) {
  return Sandbox.using(async (sb) => {
    const r = await sb.exec(`python -c ${JSON.stringify(code)}`);
    return r.stdout + (r.stderr ? `\nSTDERR: ${r.stderr}` : '');
  });
}

Firecracker, not Docker

The same virtualisation technology used by AWS Lambda and Fly.io Machines. Strong isolation at near-container speed.

~125ms

Boot time

Ready for exec() in under 150ms.

~5MB

Memory overhead

Almost all sandbox RAM goes to your code, not the hypervisor.

KVM

Hardware isolation

Each sandbox has its own kernel. Container escapes don't apply.

Frequently asked questions

How is this different from running code inside a Docker container?
Docker containers share the host kernel. Firecracker microVMs use hardware virtualisation (KVM) to give each sandbox its own kernel — the same isolation model as a full virtual machine, at near-container speed. A compromised sandbox cannot affect the host or any other sandbox.
What languages does the sandbox support?
Any language your environment has installed. The python-3.12 flavor ships Python, pip, numpy, pandas, and git. The node-20 flavor ships Node.js 20, npm, and yarn. The full flavor includes both plus ffmpeg, ImageMagick, and jq. You can install anything else with a single exec() call before running your code.
Is the sandbox automatically deleted after use?
Yes, if you use Sandbox.using() in TypeScript or the with Sandbox.create() context manager in Python. Both guarantee deletion even if your code throws an exception. Sandboxes also have a configurable TTL (default 60 minutes) and are automatically removed when it expires.
How do I get API access?
We're currently in private beta. Join the waitlist and we'll send you an API key as soon as your spot is ready.
Can I use this with any AI model or framework?
Yes. The SDK is a standard REST client — it works with any model or agent framework. Ready-to-paste tool definitions for Claude, OpenAI, and LangChain are in the README.

Ready to give your agent a sandbox?

We're opening access in batches. Join the waitlist and we'll email you as soon as your spot is ready.

Join the waitlist Read the docs