AI agent tools for sandbox
Short answer: Our top pick for sandbox: OpenSandbox, with the highest AgentPick Score (84/100) among tools tagged "sandbox". Runners-up: teable (79) and smolvm (79). Compare what each does, its license and how recently it was updated below.
| # | Tool | What it does | Score | Stars | License | Updated |
|---|---|---|---|---|---|---|
| #1 | OpenSandbox | Secure, Fast, and Extensible Sandbox runtime for AI agents. | 84/100 | ★ 16k | Apache-2.0 | 14 Oct 2026 |
| #2 | teable | ✨ AI Spreadsheet for Business | 79/100 | ★ 22k | See repo | 14 Oct 2026 |
| #3 | smolvm | An embeddable, portable, branchable virtual machine to safely run Agents locally. | 79/100 | ★ 6.7k | Apache-2.0 | 14 Oct 2026 |
| #4 | astrid | Astrid is a portable, capability-secure operating system for composable software. | 76/100 | ★ 10k | Apache-2.0 | 14 Oct 2026 |
| #5 | boxlite | The micro-VM for AI agents — light enough to embed on your laptop, elastic enough to power an agentic cloud. | 75/100 | ★ 2.5k | Apache-2.0 | 14 Oct 2026 |
| #6 | arcbox | Run AI agents on real and isolated machines — own kernel, filesystem, and network — with <100ms boot. Local first, OCI compatible, pure Rust. | 73/100 | ★ 4.2k | Apache-2.0 | 14 Oct 2026 |
| #7 | tensorlake | Tensorlake is a serverless runtime for sandboxes and deploying background agentic applications | 70/100 | ★ 1k | Apache-2.0 | 14 Oct 2026 |
| #8 | cuga-agent | CUGA is an open-source generalist agent harness for the enterprise, supporting complex task execution on web and APIs, OpenAPI/MCP integrations, compo… | 70/100 | ★ 899 | Apache-2.0 | 14 Oct 2026 |
| #9 | agents | A durable process per agent, with memory that survives restarts | 68/100 | ★ 1.6k | Apache-2.0 | 14 Oct 2026 |
| #10 | celesto | Secure and persistent computer for AI agents | 68/100 | ★ 1k | Apache-2.0 | 14 Oct 2026 |
| #11 | moltis | A secure persistent personal agent server in Rust. One binary, sandboxed execution, multi-provider LLMs, voice, memory, Telegram, WhatsApp, Discord, T… | 67/100 | ★ 2.9k | MIT | 22 Sept 2026 |
| #12 | agent-safehouse | Sandbox your local AI agents so they can read/write only what they need | 65/100 | ★ 2.1k | Apache-2.0 | 14 Oct 2026 |
| #13 | okou | Okou connects to the tools your team already uses and does the work — across marketing, sales, engineering, and operations, under your control. | 65/100 | ★ 1.2k | See repo | 14 Oct 2026 |
| #14 | coop | Isolated VM environment for running Claude Code and Codex | 65/100 | ★ 777 | Apache-2.0 | 13 Oct 2026 |
| #15 | ironcurtain | A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev) | 64/100 | ★ 613 | Apache-2.0 | 14 Oct 2026 |
| #16 | memU | Personal memory across agents | 63/100 | ★ 15k | See repo | 13 Oct 2026 |
| #17 | fence | Lightweight, container-free sandbox for running commands with network and filesystem restrictions | 63/100 | ★ 991 | Apache-2.0 | 14 Oct 2026 |
| #18 | forkd | Fork() for AI agent microVMs. Spawn 100 children in ~100ms from a warm parent; BRANCH a live VM in ~150ms. KVM-isolated, snapshot CoW. | 56/100 | ★ 2.9k | Apache-2.0 | 14 Sept 2026 |
| #19 | sandbox | All-in-One Sandbox for AI Agents that combines Browser, Shell, File, MCP and VSCode Server in a single Docker container. | 54/100 | ★ 6.2k | Apache-2.0 | 14 Sept 2026 |
| #20 | easy-agent | Production-ready open source terminal coding agent with readable, layered code: permission rules, OS sandboxing, MCP, skills, sub-agents, and Anthropi… | 49/100 | ★ 1k | MIT | 11 Oct 2026 |
| #21 | clawk | Give coding agents a disposable Linux VM, not your laptop | 47/100 | ★ 1k | Apache-2.0 | 13 Aug 2026 |
| #22 | litellm-agent-control-plane | 1 place to call all your agents - OpenCode, Hermes, Claude Managed Agents, Cursor Agents API, DeepAgents. | 45/100 | ★ 1.3k | MIT | 12 Oct 2026 |
| #23 | agentscope-runtime | A production-ready runtime framework for agent apps with secure tool sandboxing, Agent-as-a-Service APIs, scalable deployment, full-stack observabilit… | 45/100 | ★ 876 | Apache-2.0 | 4 Jun 2026 |
| #24 | Dormice | The SQLite of agent sandboxes — self-hosted, E2B-compatible. One machine, sandboxes that live forever, idle costs nothing. | 41/100 | ★ 1.5k | Apache-2.0 | 11 Oct 2026 |
| #25 | magic | Magicrew. The first open-source all-in-one AI productivity platform (Generalist AI Agent + Workflow Engine + IM + Online collaborative office system) | 39/100 | ★ 5.1k | See repo | 12 Aug 2026 |
| #26 | knowledge-agent-template | Open source file-system and knowledge based agent template. Build AI agents that stay up to date with your knowledge base | 39/100 | ★ 1.1k | MIT | 15 Sept 2026 |
| #27 | zerobox | Lightweight, cross-platform process sandboxing powered by OpenAI Codex's runtime. Sandbox any command with file, network, and credential controls. | 39/100 | ★ 721 | Apache-2.0 | 17 May 2026 |
| #28 | openbrowser | Let AI agents browse the web. An autonomous toolkit for browser-based AI agents. | 33/100 | ★ 9.6k | MIT | 2 Apr 2026 |
| #29 | LitterBox | A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end … | 33/100 | ★ 1.5k | GPL-3.0 | 5 May 2026 |
| #30 | zeroboot | Sub-millisecond VM sandboxes for AI agents via copy-on-write forking | 27/100 | ★ 2.5k | Apache-2.0 | 21 Mar 2026 |
Source: each project's public GitHub repository (description, stars, license, last push). Listed tools aren't tested or ranked by AgentPick.
How to choose
- Read the license before using it commercially.
- Check how recently it was updated and how active its issues are.
- Run it on a small, low-risk task first.
Get the best new agent tools every week. Free, with a verdict on each. Get the weekly digest
Related
AI agent tools for agent memory →
Agent building
AI agent tools for self-hosted setups →
Agent building
AI agent tools for LangChain →
Agent building
AI agent tools for harness engineering →
Agent building
AI agent tools for penetration testing →
Agent building
AI agent tools for benchmark →
Agent building
AgentPick Weekly
The week's new agent tools with a verdict on each, every week. Free. We'll email you a link to confirm, and you can unsubscribe any time. See our Privacy Policy.