Sandboxes and secure execution tools for coding agents
Isolated sandboxes where agents can run code and tools away from your machine and data. Of the 391 tools on our writing code page, 29 fit this narrower job. By pricing: 25 open source, 1 source-available, 2 free or freemium, 1 pricing on the maker's site. The most-starred open repos here are Deer Flow (83,959 stars), Context Mode (30,192 stars), NVIDIA OpenShell (16,156 stars). Most come from the sandboxes & code execution (17), coding (9), research (1) categories.
Updated
Deer Flow
ByteDance's open-source long-horizon agent harness that researches, codes and creates using sandboxes, memory and sub-agents.
Added
Context Mode
Context window optimizer for coding agents that sandboxes tool output and persists session memory.
Added
NVIDIA OpenShell
Sandboxed runtime for autonomous agents with declarative YAML policies on file, network and credential access.
Added
OpenSandbox
Secure, fast sandbox runtime for AI agents to run code.
Added
CubeSandbox
Lightweight, concurrent sandbox for running AI agent code securely.
Added
Open SWE
LangChain's asynchronous coding agent that takes work from GitHub issues, Slack or Linear, implements it in an isolated sandbox and opens a pull request.
Added
microsandbox
Local-first microVM runtime for running untrusted agent code safely.
Added
Fragments
E2B's open-source Next.js template for AI-generated apps, like Claude Artifacts or v0, with generated code run in secure E2B sandboxes.
Added
AIO Sandbox
All-in-one Docker sandbox for AI agents that combines a browser, shell, files, MCP, VS Code Server and Jupyter in one container.
Added
agentOS
A lightweight operating system for agents from Rivet that runs coding agents and their tools inside fast WebAssembly sandboxes with a file system, processes and networking, so you can spin up thousands cheaply.
Added
nono
Zero-trust sandboxing for agent runtimes.
Added
Judge0
Sandboxed code execution system for running untrusted code from people and AI.
Added
ArcBox
Runs AI agents on isolated machines with their own kernel, filesystem and network.
Added
HolmesGPT
CNCF sandbox SRE agent that investigates alerts and incidents.
Added
forkd
MicroVM sandbox runtime for AI agent fan-out that forks KVM-isolated child VMs from a warm snapshot in milliseconds.
Added
Zeroboot
VM sandboxes for running agent code that start in under a millisecond by forking a warm snapshot with copy-on-write memory.
Added
Mantis
Google's toolkit for AI coding agents to autonomously find, reproduce and patch software vulnerabilities in isolated environments.
Added
Agent Safehouse
macOS sandbox for local coding agents that limits file and integration access with deny-first policy profiles.
Added
Perplexity SPACE
Perplexity's open-source sandbox platform that runs each agent task in its own Firecracker microVM, with credentials and network access controlled from outside.
Added
Lody
A team workspace for running AI coding agents in parallel in isolated Git worktrees, with live diff review, GitHub integration and access from phone or desktop.
Added
Cloudflare Sandbox SDK
SDK for running isolated code sandboxes on Cloudflare's network, so agents can execute commands and files safely from a Worker.
Added
Pydantic Deep Agents
Self-hosted terminal AI assistant and Python framework on Pydantic AI, with tool calling, sandboxed execution, multi-agent teams and checkpoints.
Added
Tensorlake
Serverless runtime that gives agents MicroVM sandboxes and durable orchestration for long-running background jobs.
Added
ThinkRail
JetBrains' lightweight agentic IDE that pairs you with the pi coding agent, with isolated git-worktree workspaces, editor tabs, terminals and diffs.
Added
Cloudroom
Cloudroom runs Claude Code, Codex, Pi and other coding agents in the cloud, each in its own isolated sandbox on its own Git branch, using your own model logins; the Rust core is open source to self-host, and a desktop app manages local and cloud agents.
Added
Mirror CLI
Reflection AI's terminal coding agent that reads code, edits files and runs commands in isolated git worktrees, using the open-weight Beam model by default.
Added
Conductor
Runs a team of coding agents such as Claude Code and Codex in isolated cloud sandboxes, with Mac and iPhone apps to review and merge their work.
Added
E2B
Secure cloud sandboxes for running agent-generated code.
Added
Modal
Serverless compute and sandboxes for AI workloads.
Added
GitHub repos (26)
| Repo | GitHub stars | Licence | Last push |
|---|---|---|---|
| 83,959 | MIT | 2026-10-21 | |
| 30,192 | Elastic License 2.0 (source-available) | 2026-10-21 | |
| 16,156 | Apache License 2.0 | 2026-10-21 | |
| 15,907 | Apache License 2.0 | 2026-10-21 | |
| 12,960 | Apache-2.0 (third-party components under their own licences) | 2026-10-21 | |
| 11,034 | MIT | 2026-10-21 | |
| 8,717 | Apache License 2.0 | 2026-10-19 | |
| 6,393 | Apache License 2.0 | 2026-10-13 | |
| 6,205 | Apache License 2.0 | 2026-09-14 | |
| 4,808 | — | 2026-10-21 | |
| 4,535 | Apache License 2.0 | 2026-10-21 | |
| 4,482 | GNU GPL v3.0 | 2026-10-18 | |
| 4,240 | Apache License 2.0 | 2026-10-20 | |
| 3,616 | Apache License 2.0 | 2026-10-21 | |
| 2,919 | — | 2026-09-14 |
Top 15 of 26 by stars. Stars and licence come from each repo, checked when the listing was last verified.
FAQ
What are the best AI tools for writing code focused on sandboxes and secure execution?
We list 29. The first three by GitHub stars and featured status are Deer Flow: ByteDance's open-source long-horizon agent harness that researches, codes and creates using sandboxes, memory and sub-agents.; Context Mode: Context window optimizer for coding agents that sandboxes tool output and persists session memory.; NVIDIA OpenShell: Sandboxed runtime for autonomous agents with declarative YAML policies on file, network and credential access.
Are there free or open-source options?
Yes: 25 open source, 1 source-available, 2 free or freemium, 1 pricing on the maker's site. Pricing is as each maker states it.
More from writing code
Tools are grouped by what each says it does. Missing one? Submit it free.