Best AI agents for running code safely (2026)
Sandboxes that let agents run code and tools in isolation, away from your machine and data. We list 61 tools for running code safely below, each with a link-checked page, pricing as the maker states it and alternatives.
Updated
61 tools: 43 open source, 1 source-available, 8 free or freemium, 8 paid, usage-based or enterprise, 1 pricing on the maker's site.
Sandbox0
Sandbox0 is a managed sandbox runtime that gives each AI agent an isolated cloud computer where it can run code, install software, manage files and control network access. The whole writable root filesystem persists across incremental checkpoints and grows automatically as it fills, so an agent can pause compute between tasks and resume the same sandbox later with its tools, dependencies and files intact. It adds snapshots and restore, SSH, egress proxy and credential injection, private previews, Docker in the sandbox, webhooks, warm pools and custom templates, with integrations for LangChain Deep Agents, OpenAI Agents, Vercel and GitHub CI. Sandboxes run under gVisor isolation with Nomad scheduling.
Added
LayerFS
LayerFS is a filesystem built for running many coding agents in parallel. Each agent mounts a complete, writable workspace on top of shared committed history, does its work, commits what it changed and goes away, so compute only exists while a command runs. Every tool call becomes a commit on a branch, same-file clashes between agents are refused rather than silently merged, each line records the step that wrote it, and any commit can be forked at no cost for recursive exploration or RL training. Agents on different computers share one serverless store with chunk-level deduplication.
Added
OpenComputer
OpenComputer is a platform for building and deploying long-running AI agents as code. You define an agent as a TypeScript function with its model, tools and MCP servers, deploy it with one command, and every session gets its own real cloud computer, with managed sessions, schedules and API keys kept outside the agent's runtime. Templates include a coding agent that edits a repo, runs checks and opens a draft pull request, and market-research and GTM agents; its own Slack coding agent runs on it. Pricing is pay-as-you-go for model calls and per-second machine time.
Added
agentOS
A lightweight operating system for agents from Rivet that runs coding agents and their tools inside fast WebAssembly sandboxes with a file system, processes and networking, so you can spin up thousands cheaply.
Added
Agent Sandbox (Kubernetes)
A Kubernetes project that adds a Sandbox resource for running isolated, stateful agent workloads such as code execution and browsers, with warm pools and fast startup on your own cluster.
Added
AgentBay
Alibaba Cloud's cloud sandbox service for agents, offering ready-made browser, Linux and Windows desktop, mobile and code environments that agents control through an SDK or MCP.
Added
AgentDock (NexusDock)
A secure MCP runtime that lets ChatGPT, Claude and other AI clients operate your Mac, Windows, Linux and Android devices, with memory, tools and reusable automations.
Added
Cloudroom
Cloudroom runs Claude Code, Codex, Pi and other coding agents in the cloud, each in its own isolated sandbox on its own Git branch, using your own model logins; the Rust core is open source to self-host, and a desktop app manages local and cloud agents.
Added
Halofy
Halofy is an access and governance layer for a team's AI agents, giving every agent organizational context through one identity and policy model with provenance and audit, alongside a desktop AI workstation that turns power users' agent practices into shared policies.
Added
Lody
A team workspace for running AI coding agents in parallel in isolated Git worktrees, with live diff review, GitHub integration and access from phone or desktop.
Added
ThinkRail
JetBrains' lightweight agentic IDE that pairs you with the pi coding agent, with isolated git-worktree workspaces, editor tabs, terminals and diffs.
Added
AgentEnv Framework
AgentEnv Framework is Scale AI's open-source Python SDK and CLI for building RL environments for agents: containerized worlds with realistic apps and data behind an MCP gateway, plus tasks (as DAGs) that grade any agent in any sandbox.
Added
Zeroboot
VM sandboxes for running agent code that start in under a millisecond by forking a warm snapshot with copy-on-write memory.
Added
Rakazo
Self-hosted personal AI agent and persistent teammate for web, desktop, iPhone and Android, with your own choice of model and computer sandbox.
Added
Rogue
Agent evaluator and red-team tool that probes your agent with test conversations and attacks and reports pass or fail against your policies.
Added
Conductor
Runs a team of coding agents such as Claude Code and Codex in isolated cloud sandboxes, with Mac and iPhone apps to review and merge their work.
Added
Hyperbrowser
Cloud browsers and isolated sandboxes for AI agents that you start in one call and drive with Playwright, Puppeteer or any agent.
Added
forkd
MicroVM sandbox runtime for AI agent fan-out that forks KVM-isolated child VMs from a warm snapshot in milliseconds.
Added
Agent Safehouse
macOS sandbox for local coding agents that limits file and integration access with deny-first policy profiles.
Added
Perplexity SPACE
Perplexity's open-source sandbox platform that runs each agent task in its own Firecracker microVM, with credentials and network access controlled from outside.
Added
Cloudflare Sandbox SDK
SDK for running isolated code sandboxes on Cloudflare's network, so agents can execute commands and files safely from a Worker.
Added
Tensorlake
Serverless runtime that gives agents MicroVM sandboxes and durable orchestration for long-running background jobs.
Added
AIO Sandbox
All-in-one Docker sandbox for AI agents that combines a browser, shell, files, MCP, VS Code Server and Jupyter in one container.
Added
Fragments
E2B's open-source Next.js template for AI-generated apps, like Claude Artifacts or v0, with generated code run in secure E2B sandboxes.
Added
Omnara
Open-source managed agent platform, a self-hostable alternative to Claude Managed Agents and the OpenAI Agents API, with tools, secrets and sandboxes.
Added
Open Cowork
Open-source desktop app for Windows and macOS that installs Claude Code, MCP tools and skills in one click with sandbox isolation.
Added
ADR
Uber's Agentic AI Detection and Response system that secures employee and customer-facing AI agents with observability and threat detection.
Added
OpenZeppelin MCP
OpenZeppelin's official MCP servers that let agents generate secure smart contracts from audited OpenZeppelin libraries for Solidity, Cairo, Stellar and more.
Added
Automox MCP
Official Automox MCP server for managing devices, patches and policies in natural language.
Added
CData Connect AI MCP
CData's cloud-hosted MCP server for secure AI access to hundreds of enterprise data sources through Connect AI.
Added
Egnyte MCP
Egnyte's remote MCP server for secure AI search, upload and file management in your Egnyte account.
Added
Pimlico AI
CLI and MCP server that lets coding agents manage a Pimlico smart-account infrastructure account, from balances and logs to sponsorship policies.
Added
StackAI
Drag-and-drop no-code platform for enterprises to build and deploy secure, compliant AI agents.
Added
Mantis
Google's toolkit for AI coding agents to autonomously find, reproduce and patch software vulnerabilities in isolated environments.
Added
ToolHive
Stacklok platform that runs MCP servers in isolated containers with per-request identity, access policy and observability.
Added
Pydantic Deep Agents
Self-hosted terminal AI assistant and Python framework on Pydantic AI, with tool calling, sandboxed execution, multi-agent teams and checkpoints.
Added
Mirror CLI
Reflection AI's terminal coding agent that reads code, edits files and runs commands in isolated git worktrees, using the open-weight Beam model by default.
Added
Open SWE
LangChain's asynchronous coding agent that takes work from GitHub issues, Slack or Linear, implements it in an isolated sandbox and opens a pull request.
Added
ego lite
Free macOS browser where Claude Code or Codex run automation tasks in their own isolated Spaces next to your tabs, reusing your logged-in sessions through an agent skill.
Added
NVIDIA OpenShell
Sandboxed runtime for autonomous agents with declarative YAML policies on file, network and credential access.
Added
OpenSandbox
Secure, fast sandbox runtime for AI agents to run code.
Added
CubeSandbox
Lightweight, concurrent sandbox for running AI agent code securely.
Added
microsandbox
Local-first microVM runtime for running untrusted agent code safely.
Added
smolvm
Portable, branchable virtual machine for running agents safely on your computer.
Added
nono
Zero-trust sandboxing for agent runtimes.
Added
Judge0
Sandboxed code execution system for running untrusted code from people and AI.
Added
ArcBox
Runs AI agents on isolated machines with their own kernel, filesystem and network.
Added
BoxLite
Embeddable micro-VM for running AI agents.
Added
E2B
Secure cloud sandboxes for running agent-generated code.
Added
Modal
Serverless compute and sandboxes for AI workloads.
Added
Context Mode
Context window optimizer for coding agents that sandboxes tool output and persists session memory.
Added
Cua
Open-source infrastructure for computer-use agents: sandboxes, drivers across operating systems and benchmarks.
Added
Steel
Open-source browser API and sandbox for AI agents to control web browsers at scale.
Added
Agent Governance Toolkit
Microsoft toolkit for policy enforcement, identity and sandboxing for AI agents.
Added
HolmesGPT
CNCF sandbox SRE agent that investigates alerts and incidents.
Added
OneCLI
Sandboxed agent harness for teams with secure credential handling.
Added
Moltis
Secure personal agent server in Rust with sandboxed execution.
Added
Lyzr
Enterprise agent studio and framework for building secure AI agents.
Added
CoreWeave Forge
One product to run, observe, evaluate and post-train agents (W&B, OpenPipe, sandboxes).
Added
Deer Flow
ByteDance's open-source long-horizon agent harness that researches, codes and creates using sandboxes, memory and sub-agents.
Added
Scalebrowser
Gives each agent its own isolated browser with a persistent identity for staying signed in.
Added
GitHub repos (50)
| Repo | GitHub stars | Licence | Last push |
|---|---|---|---|
| Deer Flow ↗ | 83,959 | MIT | 2026-10-21 |
| Context Mode ↗ | 30,192 | Elastic License 2.0 (source-available) | 2026-10-21 |
| Cua ↗ | 29,966 | MIT | 2026-10-21 |
| ego lite ↗ | 17,562 | MIT | 2026-10-19 |
| NVIDIA OpenShell ↗ | 16,156 | Apache License 2.0 | 2026-10-21 |
| OpenSandbox ↗ | 15,907 | Apache License 2.0 | 2026-10-21 |
| CubeSandbox ↗ | 12,960 | Apache-2.0 (third-party components under their own licences) | 2026-10-21 |
| Open SWE ↗ | 11,034 | MIT | 2026-10-21 |
| microsandbox ↗ | 8,717 | Apache License 2.0 | 2026-10-19 |
| Steel ↗ | 7,821 | Apache License 2.0 | 2026-10-19 |
| smolvm ↗ | 6,746 | Apache License 2.0 | 2026-10-21 |
| Agent Governance Toolkit ↗ | 6,435 | MIT | 2026-10-21 |
| Fragments ↗ | 6,393 | Apache License 2.0 | 2026-10-13 |
| AIO Sandbox ↗ | 6,205 | Apache License 2.0 | 2026-09-14 |
| agentOS ↗ | 4,808 | — | 2026-10-21 |
Top 15 of 50 by stars. Stars and licence come from each repo, checked when the listing was last verified.
Related tasks
Popular with: DevOps and SRE engineers · Security engineers · MCP developers · Related searches: Sandboxes for AI agents to run code
Tools are matched to tasks by category, use cases and what each tool says it does. Missing one? Submit it free.