# AgentNest

The open-source runtime for secure AI agent execution. Disposable, policy-controlled environments for Python, shell, files, packages, browsers, GPUs, and Git work — self-hosted, Python-first, and deliberately not another cloud or cluster orchestrator.

Source: https://wheredoirunthis.com/products/agentnest · JSON: https://wheredoirunthis.com/api/products/agentnest · Read on 2026-07-23

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Container
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: Yes
- Regions: Not disclosed
- Coverage: 11 of 54 assessed capabilities supported · 7 not assessed
- Agent readiness: read 5 of 7 signals, drive 7 of 9 signals

## Links

- Homepage: https://github.com/mihirahuja1/agentnestOSS
- Docs: https://mihirahuja1.github.io/agentnestOSS/
- Repository: https://github.com/mihirahuja1/agentnestOSS

## Runtime

- **GPU & accelerators**: Yes — "`from agentnest.presets import gpu_sandbox` — `gpu_sandbox('pytorch/pytorch:...cuda12.4...', gpus=1)`. 'Docker must have the NVIDIA Container Toolkit configured. GPU access is explicit and zero by default.'" [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/agents.md) (confidence: high)
- **BYOC (Bring your own cloud)**: na — "Self-host tool — you run it on your own Docker/K8s infra; BYOC (deploy into a customer's cloud account) is a hosted-product concept, na here." [source](https://github.com/mihirahuja1/agentnestOSS) (confidence: high)
- **Secrets management**: Explicit `Secret('value')` wrapper — redacted to [REDACTED] in captured stdout/stderr; injected as environment values. Only wrapped values are redacted (not transformed derivatives). Git credentials are never inherited from the host and must be injected explicitly, wrapped in Secret. — "'Only values explicitly wrapped in Secret are redacted. They become [REDACTED] in captured stdout and stderr.'" [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/policies.md) (confidence: high)
- **Storage options**: Ephemeral /workspace (host temp dir) + restricted tmpfs scratch; path-safe file I/O (rejects absolute paths and `..`; no-follow FDs defeat symlink escapes/races; 64 MiB read limit). No arbitrary volume-mount option by design. Durable output via snapshots (tar) + artifact discovery (globs with sha256). — "'File APIs reject absolute paths and .. traversal ... The public API intentionally has no arbitrary volume-mount option.'" [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/security.md) (confidence: high)
- **Supported workloads**: Disposable sandboxed execution of untrusted / agent-generated Python and shell code: stateful Python REPL sessions, package installs (egress-allowlisted), file work, Playwright browser automation (browser preset), GPU compute (gpu preset), and Git workspaces (clone/diff a repo, run tests). Used as a sandboxed code tool inside agent frameworks (LangChain/smolagents) or exposed over MCP. — "README capabilities + presets (browser_sandbox/gpu_sandbox) + GitWorkspace + framework integrations + MCP tools." [source](https://github.com/mihirahuja1/agentnestOSS) (confidence: high)
- **Persistence**: Ephemeral by default — one container + one host temp dir mounted at /workspace, both deleted on destroy / context exit / lifetime expiry / timeout. Read-only root + restricted tmpfs scratch. No arbitrary volume mounts (deliberate). Durable state is via `Sandbox.snapshot('workspace.tar')` / `restore` and `artifacts('output/**/*')` discovery, not a mounted persistent disk. — "'Each DockerRuntime owns exactly one container and one host temporary directory ... mounted into the container, at /workspace. The root filesystem is read-only by default; restricted tmpfs mounts provide ephemeral scratch space.' Snapshot/restore + artifacts APIs documented." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/architecture.md) (confidence: high)
- **Data jurisdiction**: na — "Operator-controlled — runs wherever you self-host. No vendor-managed region." [source](https://github.com/mihirahuja1/agentnestOSS) (confidence: high)
- **Resource limits & quotas**: Per-sandbox at creation: memory, cpus, PIDs, tmpfs scratch size, max_output_bytes, per-file read limit, and total lifetime + per-command timeout. Non-destructive timeouts (0.3.0): a slow command is killed on its own (in-container `timeout`) leaving the sandbox alive; a host-side backstop still destroys sandboxes on images without coreutils timeout. Bounded by the host you self-host on — no platform quotas. — "SecurityPolicy(max_output_bytes=...), Sandbox(memory='512m', cpus=1.0); 'limits memory, CPU, PIDs, and scratch tmpfs size'; per-command timeout terminates only the offending process." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/architecture.md) (confidence: high)
- **SDK languages**: Python only (Python-first, `>=3.10`). Sync `Sandbox` + `AsyncSandbox`. The package IS the SDK (`pip install agentnest`). — "pyproject requires-python >=3.10, classifiers 3.10/3.11/3.12; no other-language SDK exists." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/pyproject.toml) (confidence: high)
- **Network & egress controls**: Yes — "0.3.0 egress allowlisting: 'Denied is still the default; an allowlist routes traffic through a filtering CONNECT-proxy that only lets approved domains through' (e.g. pypi.org + files.pythonhosted.org, everything else refused). `NetworkPolicy.denied()` / `NetworkPolicy.allowlist(domains=...)`. Docker backend enforces domain allowlists (0.3.0); raw CIDR allowlists fail closed; Kubernetes does CIDR NetworkPolicy but rejects domain rules." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/policies.md) (confidence: high)
- **Snapshots & forks**: Yes — "0.3.0 'Forkable sandboxes (Sandbox.fork) that branch a running sandbox's state into an independent copy for speculative or parallel work'; plus `checkpoint = sandbox.snapshot('workspace.tar')` / restore. Snapshot support is an optional runtime-checkable capability protocol per backend." [source](https://github.com/mihirahuja1/agentnestOSS) (confidence: high)
- **Deployment methods**: Python SDK (embed `Sandbox`/`AsyncSandbox` in your process) + `agentnest` CLI (run/shell/doctor/backends/serve/mcp/demo/prune) + an MCP server (`agentnest mcp`) + an authenticated remote HTTP API server (`agentnest serve`, FastAPI) + YAML profiles (agentnest.yaml). Framework adapters: framework-neutral SandboxRunner, a LangChain StructuredTool, a smolagents executor. — "CLI docs (run/shell/doctor/backends/serve/mcp); integrations guide (LangChain/smolagents/SandboxRunner/MCP); `agentnest serve` authenticated API." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/cli.md) (confidence: high)
- **Isolation**: Container — "Default Docker backend: 'runs UID/GID 65532, disables privileged mode and networking, drops all Linux capabilities, enables no-new-privileges, makes the root filesystem read-only, limits memory, CPU, PIDs, and scratch tmpfs size'. Explicitly NOT a microVM by default: 'Containers share the host kernel. Choose an isolation boundary appropriate for your threat model.' Stronger isolation is a PLUGGABLE backend, not the default: gVisor (runsc) / Kata (both via Docker OCI runtime), Kubernetes RuntimeClass, or a remote Firecracker microVM worker — each needs host-side setup. Recorded as `container` (the shipped default that an agent-operator gets out of the box); the microVM options are opt-in backends." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/security.md) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Not supported | "No installable agent-skills format; integration is via MCP + framework adapters (LangChain/smolagents), not skills." [source](https://github.com/mihirahuja1/agentnestOSS) |
| AI app builder | Not supported | "Not a prompt-to-app builder." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Autonomous QA agent | Not supported | "No autonomous QA/testing agent (it is the sandbox such an agent would run in). An adversarial escape-attempt test suite runs in CI — that's the project's own security testing, not a product feature." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Built-in coding agent | Not supported | "No first-party coding agent — AgentNest is the sandbox that an external agent runs code in." [source](https://github.com/mihirahuja1/agentnestOSS) |
| BYOK for LLMs | Not supported | "Secret injection can carry an LLM key into a sandbox, but there is no BYOK-LLM gateway feature." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Credential-injection proxy | Not assessed |  |
| LLM gateway | Not supported | "No multi-provider LLM routing/gateway." [source](https://github.com/mihirahuja1/agentnestOSS) |
| MCP client | Not supported | "Provides an MCP server; does not act as an MCP client." [source](https://github.com/mihirahuja1/agentnestOSS) |
| MCP-server hosting | Not supported | "Exposes a first-party MCP control server (mcp-server); does not host customer MCP servers as workloads." [source](https://github.com/mihirahuja1/agentnestOSS) |
| MCP server | Supported | "`pip install 'agentnest[mcp]'; agentnest mcp` exposes create_sandbox/exec_python/exec_shell/write_file/read_file/destroy_sandbox as MCP tools to any MCP client." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/integrations.md) |
| Model inference API (first-party) | Not applicable | "Not an inference provider." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Preinstalled coding agent | Not assessed |  |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not applicable | "Embeddable runtime; no managed public HTTPS endpoint provisioning per workload." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Custom domains | Not applicable | "No hosted domains — self-host runtime." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Direct public IPv6 | Not applicable | "Self-host; networking is denied-by-default, no per-instance public IPv6 addressing." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Edge KV store | Not applicable | "Not an edge runtime." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Egress controls | Supported | "Egress allowlisting: deny-by-default network, allowlist domains routed through a filtering CONNECT-proxy so code reaches approved domains and provably nothing else; every connection logged." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/policies.md) |
| Email send / receive | Not supported | "No email primitive." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Public preview URLs | Not applicable | "No hosted shareable per-deploy URLs." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Private networking | Not applicable | "No platform service-to-service private network (single-sandbox lifecycle library)." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Built-in reverse proxy | Not applicable | "It's a library + local backends, not a hosting platform with ingress. (An egress CONNECT-proxy exists for outbound allowlisting — that's egress-controls, not inbound routing.)" [source](https://github.com/mihirahuja1/agentnestOSS) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "The remote API server has token auth (AGENTNEST_API_TOKEN) for the control plane, but no auth-as-a-service / IAM for workloads. Policies are 'local controls, not user authorization.'" [source](https://github.com/mihirahuja1/agentnestOSS) |
| BYOC | Not applicable | "Self-host tool — BYOC (deploy into a customer's cloud) is a hosted-product concept; na." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Deploy into customers' VPCs | Not assessed |  |
| Secrets management | Supported | "First-class Secret('value') wrapper — injected as env, redacted to [REDACTED] in captured stdout/stderr." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/policies.md) |
| Self-host / OSS core | Supported | "Apache-2.0, fully on GitHub; `pip install agentnest`, runs on your Docker/K8s. 'Self-hosted & extensible: your Docker or Kubernetes.'" [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/LICENSE) |
| Sharing | Not applicable | "No hosted share-a-running-workload link (self-host library)." [source](https://github.com/mihirahuja1/agentnestOSS) |
| SSO / SAML | Not applicable | "No hosted multi-user account platform (self-host)." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Teams | Not applicable | "No hosted multi-user team accounts (self-host)." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Workload identity | Not assessed |  |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "Official `agentnest` CLI: run/shell/doctor/backends/serve/mcp/demo/prune (`agentnest = agentnest.cli:main`)." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/cli.md) |
| E2B-compatible API | Not assessed |  |
| Filesystem API | Supported | "Remote file operations over the API without SSH: write_file/read_file/upload_file/download_file + artifacts('output/**/*') discovery (path-safe, symlink-race-safe)." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/api.md) |
| Git deploy | Not applicable | "Sandbox runtime, not a git-push-to-deploy platform. (A GitWorkspace helper clones a repo INTO a sandbox to run tests — the opposite direction.)" [source](https://github.com/mihirahuja1/agentnestOSS) |
| HTTP data API | Not applicable | "Not a data layer." [source](https://github.com/mihirahuja1/agentnestOSS) |
| OpenAPI spec | Not supported | "No published/fetchable OpenAPI spec; the optional FastAPI server auto-exposes a schema at runtime but it is not documented or shipped as a spec file." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Private container registry | Not supported | "Pulls images from a registry and supports image allowlists + digest pinning, but does not OFFER a hosted private registry." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Public API | Supported | "Documented Python API (Sandbox/AsyncSandbox and the stable package root) plus a versioned authenticated remote HTTP API (`agentnest serve`)." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/api.md) |
| SDK | Supported | "Official Python SDK — `pip install agentnest` (the package IS the SDK). Single language (Python-first)." [source](https://pypi.org/project/agentnest/) |
| SSH access | Not supported | "No SSH into sandboxes — execution is via the SDK/CLI/API (exec_python/exec_shell/stream_shell), not an SSH surface." [source](https://github.com/mihirahuja1/agentnestOSS) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | "Container-based; YAML profiles configure sandbox options but not cloud-init/ignition VM user-data." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Desktop / computer-use sandbox | Not supported | "browser_sandbox is a headless Playwright preset (browser automation), not a GUI virtual desktop / computer-use noVNC surface." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/agents.md) |
| GPU compute | Supported | "gpu_sandbox(image, gpus=1) preset — requires host NVIDIA Container Toolkit; GPU access explicit, zero by default." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/agents.md) |
| Live-state (memory) snapshots | Not assessed |  |
| Multi-region | Not applicable | "Self-host — placement is the operator's choice, not a product facet." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Object storage | Not applicable | "Self-host runtime; provisions no managed S3/blob store." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Persistent disk | Not supported | "Ephemeral by design — the container + workspace are deleted on destroy/exit/timeout, root is read-only, and 'the public API intentionally has no arbitrary volume-mount option.' Durability is via snapshot-to-tar (see snapshots-forks), not a mounted persistent disk." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/security.md) |
| Sandbox templates / custom images | Supported | "Deterministic `Template` builds + browser/GPU presets + run any Docker image (with allowlist/digest trust controls) — reusable bases you launch sandboxes from." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Scale to zero | Not applicable | "Self-host runtime — sandboxes are created/destroyed explicitly (warm SandboxPool for startup); no managed auto-suspend-on-idle." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Selectable isolation runtime | Not assessed |  |
| Snapshots / forking | Supported | "Sandbox.fork() branches a running sandbox's state into independent copies; Sandbox.snapshot('workspace.tar') / restore checkpoint state." [source](https://github.com/mihirahuja1/agentnestOSS) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "Not a data layer." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Ephemeral instant DB (no-signup) | Not applicable | "Not a data layer." [source](https://github.com/mihirahuja1/agentnestOSS) |
| First-party database | Not supported | "No managed first-party database (you run your own inside a sandbox)." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Vector search | Not applicable | "Not a data layer." [source](https://github.com/mihirahuja1/agentnestOSS) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not applicable | "Not a managed CI/CD runner service (it runs IN CI as a test dependency)." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Built-in observability | Partially supported | "Structured audit events (export them; alert on timeouts/OOM/policy denials/cleanup errors) + optional OpenTelemetry API extra (`[observability]`). First-party but thin — event stream + OTel hook, not a full metrics/logs/tracing/APM stack." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/deployment.md) |
| Preview environments | Not applicable | "No per-PR hosted ephemeral environments (execution runtime, not a deploy platform)." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Scheduled tasks | Not supported | "No cron/scheduled-job primitive. (Every resource carries a deadline label; `agentnest prune` reaps orphans — cleanup, not scheduling.)" [source](https://github.com/mihirahuja1/agentnestOSS) |
| Project template marketplace | Not supported | "Deterministic Template builds + presets exist, but no project-starter template marketplace/gallery." [source](https://github.com/mihirahuja1/agentnestOSS) |
| Durable workflows | Not supported | "No durable-execution/workflow engine (bounded SandboxPool + fork exist, but not durable workflows)." [source](https://github.com/mihirahuja1/agentnestOSS) |

## Agent readiness

### Read: 5 of 7 signals present

5/7 signals (4 full, 1 partial) — repo surface; 4 website-only checks na (no live own domain, docs site not deployed)

- Llms txt: fail — "No llms.txt; the advertised docs site is not deployed (404)."
- Llms full txt: fail — "No llms-full.txt."
- Robots AI policy: na — "No live own web property — surface is github.com + pypi.org (their robots, not the product's)."
- JSON LD: na — "No own site to carry SoftwareApplication/Product json-ld (docs site not deployed)."
- Sitemap: na — "No live own domain; the mkdocs sitemap would exist only if the docs site were deployed (it 404s)."
- Meta quality: partial — "GitHub repo OG card + PyPI metadata carry a clear title/description, but no product-site <head> to grade."
- Markdown negotiation: pass — "All docs are in-repo markdown served clean via raw.githubusercontent.com (docs/*.md); the README itself is markdown."
- Content efficiency: pass — "GitHub-rendered README + raw markdown docs are near-pure text (very high readable-text ratio)."
- Docs discoverable: pass — "README links quickstart/architecture/deployment/security/integration guides + examples/; comprehensive in-repo docs, first-class."
- Pricing machine readable: na — "No hosted pricing — self-host is free under Apache-2.0."
- Anti bot: pass — "No challenge on public content; curl/gh fetched repo + raw docs cleanly."

### Drive: 7 of 9 signals present

7/9 signals (3 full, 4 partial; 2 na — self-host, no hosted signup)

- Public API: pass — "Documented Python API (mkdocstrings api.md) + a versioned authenticated remote HTTP API (`agentnest serve`)."
- Openapi spec: fail — "No published/fetchable OpenAPI spec (FastAPI auto-serves one at runtime, not documented/shipped)."
- MCP server: pass — "pip-installable MCP server with docs: `agentnest[mcp]` + `agentnest mcp` + client config examples — earns full per rubric v3 (installable MCP server with docs)."
- SDK packages: partial — "One official SDK (Python only)."
- Auth docs: partial — "Remote API uses a bearer token (AGENTNEST_API_TOKEN); deployment guide says authenticate/terminate TLS/rotate tokens — a basic key-auth mention, no OAuth/scoped-key model."
- Agent self serve creds: na — "Self-host — no hosted signup/credential issuance (you set your own API token)."
- Webhooks: fail — "No HTTP webhooks (audit events are in-process structured events, not signed webhook callbacks)."
- CLI tool: pass — "Official `agentnest` CLI."
- Error model: partial — "Documented stable exception hierarchy (exceptions.py — ExecutionTimeoutError/PolicyDeniedError/UnsupportedCapabilityError), but not a documented JSON error model for the HTTP API."
- Rate limit docs: na — "No hosted API to rate-limit; per-sandbox resource limits are self-configured, not platform limits."
- Agent config: partial — "MCP server + framework adapters (LangChain/smolagents) + an 'AI agents' docs guide — one/two integration surfaces, but no agents.md / .well-known/agent / skills listing."

## Coding harnesses

- Claude Code (Anthropic) — "The MCP server exposes sandbox lifecycle and execution as tools any MCP client (Claude Code, Cursor, Claude Desktop) can call: `pip install 'agentnest[mcp]'; agentnest mcp`. Register in a Claude Code / Cursor MCP config: { mcpServers: { agentnest: { command: agentnest, args: [mcp] } } }." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/integrations.md)
- Cursor (Anysphere) — "any MCP client (Claude Code, Cursor, Claude Desktop) can call ... Register it with a client — for example in a Claude Code / Cursor MCP config." [source](https://github.com/mihirahuja1/agentnestOSS/blob/main/docs/guides/integrations.md)

## Open source

- Repository: https://github.com/mihirahuja1/agentnestOSS
- License: Apache-2.0
- Stars: 8
- Forks: 0
- Self-host methods: package-manager, docker, kubernetes, source-build

## Company & presence

- Headquarters: Not disclosed — independent OSS project, no company entity.
- Founded: Repo created 2026-07-17; first PyPI release (0.2.0) same day.
- Team size: Single maintainer (github.com/mihirahuja1); authors listed as 'AgentNest contributors'. Small ~4k-LOC codebase ('auditable in an afternoon').
- GitHub: https://github.com/mihirahuja1/agentnestOSS
- PyPI: https://pypi.org/project/agentnest/

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)
- [AWS Lambda MicroVMs](/products/lambda-microvms.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.