# microsandbox

A computer for anything, anywhere. Open-source microVM sandboxes for AI agents and untrusted code.

Source: https://wheredoirunthis.com/products/microsandbox · JSON: https://wheredoirunthis.com/api/products/microsandbox · Read on 2026-10-12

## At a glance

- Type: Sandbox
- Kind: Open core
- Isolation: Virtual machine
- Free tier: Not documented
- Starting price: $49/mo
- GPU: No
- Regions: Not disclosed
- Coverage: 17 of 61 assessed capabilities supported
- Agent readiness: read 11 of 11 signals, drive 8 of 11 signals

## Links

- Homepage: https://microsandbox.dev/
- Docs: https://docs.microsandbox.dev/
- Pricing: https://microsandbox.dev/pricing
- Repository: https://github.com/superradcompany/microsandbox

## Pricing

- Model: Monthly plan plus metered usage; private-beta rates
- Unit: vCPU-hours, memory GiB-hours, writable disk GiB-hours, durable storage GiB-hours; compute billed in seconds.
- Free tier: Cloud Free: $0 monthly hard-capped pool; invitation access required. Separate from free Apache-2.0 self-host runtime.

| Tier | Price | Includes | Notes |
| --- | --- | --- | --- |
| Free | $0/month | Hard cap, no overage. 3 running / 2 persistent; each sandbox 1 vCPU,512 MiB,8 GiB disk. | Private beta: access by request. Published rates need owner confirmation before promotion (homepage wording). Durable storage allowance wording is not proof of free egress. [source](https://microsandbox.dev/pricing) |
| Builder | $49/month | 1,000 running / 50 persistent; overage beyond pools. | Private beta: access by request. Published rates need owner confirmation before promotion (homepage wording). Durable storage allowance wording is not proof of free egress. [source](https://microsandbox.dev/pricing) |
| Teams | $299/month | 25,000 running / 500 persistent; overage beyond pools. | Private beta: access by request. Published rates need owner confirmation before promotion (homepage wording). Durable storage allowance wording is not proof of free egress. [source](https://microsandbox.dev/pricing) |
| Enterprise | Custom committed/BYOC | Concurrency sized to fleet; custom agreement. |  [source](https://microsandbox.dev/pricing) |

- Card required: Not documented
- Source: https://microsandbox.dev/pricing

## Runtime

- **GPU & accelerators**: No — "No general-purpose passthrough or host PCI devices; no hosted GPU option disclosed." [source](https://docs.microsandbox.dev/security/isolation) (confidence: medium)
- **BYOC (Bring your own cloud)**: Evaluation: same open runtime in your cloud or on your metal; you operate it and vendor helps evaluate/deploy/stay current. — "BYOC is contact-to-evaluate, not a generally self-serve managed cloud-account deployment." [source](https://microsandbox.dev/platform/byoc) (confidence: high)
- **Secrets management**: Host-side, destination-bound placeholder substitution; allowed endpoints receive the actual credential. — "Allowed-host/DNS/TLS identity and authority alignment gate substitution. An allowed endpoint can reflect/misuse the value; raw SDK values also persist in host-side configuration. Not an absolute cannot-leak guarantee." [source](https://docs.microsandbox.dev/security/secrets) (confidence: high)
- **Storage options**: Managed persistent directory volumes and writable root disks; cloud files accessible through common SDK path operations. — "Cloud excludes disk-kind/create-on-mount; low-level open-handle filesystem operations are local-only." [source](https://docs.microsandbox.dev/cloud/overview) (confidence: high)
- **Supported workloads**: AI agents, untrusted user code/plugins, CI jobs, developer environments, scraping and automation in own-kernel microVMs. [source](https://github.com/superradcompany/microsandbox)
- **Persistence**: Persistent sandboxes and managed named/default directory volumes; cloud paths resolve against organization host storage, not the client laptop. — "Managed volumes support lifecycle and filesystem access; disk-kind volumes and create-on-mount are local-only." [source](https://docs.microsandbox.dev/cloud/overview) (confidence: high)
- **Data jurisdiction**: Unknown — hosted placement/data residency reviewed with the team before rollout. — "Managed deployments review data handling, residency, audit and secrets requirements; no public country/region list found." [source](https://microsandbox.dev/) (confidence: low)
- **Resource limits & quotas**: Private beta: Free 3 concurrent/2 persistent, Builder 1,000 concurrent/50 persistent, Teams 25,000 concurrent/500 persistent. Free sandbox shape 1 vCPU/512 MiB/8 GiB disk; includes 5 vCPU-hours/20 memory GiB-hours/20 disk GiB-hours and 1 GiB durable-storage cap. — "Builder and Teams have metered overage; org quotas and maximum-duration/idle-timeout process controls. Monthly workload throughput is not concurrency." [source](https://microsandbox.dev/pricing) (confidence: high)
- **SDK languages**: Rust, TypeScript, Python, Go, Ruby [source](https://docs.microsandbox.dev/sdk/overview)
- **Network & egress controls**: Yes — "Default permits public internet but blocks private, loopback, link-local and metadata destinations. Can allowlist or disable egress. Cloud non-public block cannot be lifted; prior deny-by-default wording is not current." [source](https://docs.microsandbox.dev/networking/overview) (confidence: high)
- **Snapshots & forks**: Yes — "Cloud captures disk snapshots of stopped persistent sandboxes and restores into new sandboxes. Live capture, full checkpoints, forks, groups and local archives are local-only." [source](https://docs.microsandbox.dev/cloud/overview) (confidence: high)
- **Deployment methods**: container-image, cli, sdk, api, mcp — "Shared SDK/msb CLI with explicit cloud backend; OCI images; REST management API; companion stdio MCP server documented in getting-started/agents." [source](https://docs.microsandbox.dev/cloud/overview) (confidence: high)
- **Isolation**: Virtual machine — "Cloud runs the same own-kernel microVM runtime; security/isolation identifies libkrun with KVM/HVF locally. vm is the schema bucket for this named but unenumerated microVM substrate; no Firecracker claim." [source](https://microsandbox.dev/platform/cloud) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "npx skills add superradcompany/skills; works with Claude Code, Cursor, Codex, Gemini CLI and GitHub Copilot." [source](https://docs.microsandbox.dev/getting-started/agents) |
| AI app builder | Not supported | "No documented ai app builder capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Autonomous QA agent | Not supported | "No documented autonomous qa agent capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Built-in coding agent | Not supported | "No documented built-in coding agent capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| BYOK for LLMs | Not supported | "Can proxy destination-bound API keys, but no LLM gateway/BYOK model-router product." [source](https://docs.microsandbox.dev/security/secrets) |
| Credential-injection proxy | Supported | "The real value stays in host memory. On egress to an allowed host, host-side network stack substitutes the placeholder. Allowed endpoints receive the secret and can reflect/misuse it." [source](https://docs.microsandbox.dev/security/secrets) |
| LLM gateway | Not supported | "No documented llm gateway capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| MCP client | Not supported | "No documented mcp client capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| MCP-server hosting | Not supported | "No documented mcp-server hosting capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| MCP server | Supported | "The microsandbox MCP server exposes structured Model Context Protocol tools; npx -y microsandbox-mcp with documented client configs." [source](https://docs.microsandbox.dev/getting-started/agents) |
| Model inference API (first-party) | Not applicable | "Compute/microVM sandbox runtime, not a data-layer, edge KV, or first-party model inference service." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Preinstalled coding agent | Partially supported | "Manual msb run script installs a pinned Claude Code release in a Node.js microVM and launches it; host sign-in required. No turnkey preinstalled managed image." [source](https://docs.microsandbox.dev/how-to/agents/claude-code) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not supported | "No documented automatic https capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Custom domains | Not supported | "No documented custom domains capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Direct public IPv6 | Not supported | "No documented direct public ipv6 capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Edge KV store | Not applicable | "Compute/microVM sandbox runtime, not a data-layer, edge KV, or first-party model inference service." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Egress controls | Supported | "Public internet allowed by default; private/loopback/link-local/metadata blocked. Egress can be allowlisted or disabled; cloud non-public floor cannot be lifted." [source](https://docs.microsandbox.dev/networking/overview) |
| Email send / receive | Not supported | "No documented email send / receive capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Public preview URLs | Not supported | "No documented public preview urls capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Private networking | Not supported | "Cross-sandbox isolation: sandboxes cannot see/reach one another absent explicit shared volumes or local published ports. No managed service mesh/private-network product documented." [source](https://docs.microsandbox.dev/security/isolation) |
| Built-in reverse proxy | Not supported | "No documented built-in reverse proxy capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "No documented built-in auth capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| BYOC | Partially supported | "Contact us to evaluate; you run the same open runtime in your cloud or on your metal. Operator-run evaluation, not a self-serve managed BYOC service." [source](https://microsandbox.dev/platform/byoc) |
| Deploy into customers' VPCs | Not supported | "BYOC runs your own workload in your own perimeter. No managed nested deployment into customers VPCs advertised." [source](https://microsandbox.dev/platform/byoc) |
| Secrets management | Supported | "Destination-bound secrets and host-side placeholder substitution; cloud supports hostname-scoped secret substitution." [source](https://docs.microsandbox.dev/sandboxes/secrets) |
| Self-host / OSS core | Supported | "Apache-2.0 runnable microVM runtime: msb run ubuntu; embedded SDK creates a sandbox child process with no setup server/long-running daemon." [source](https://github.com/superradcompany/microsandbox) |
| Sharing | Not supported | "No documented sharing capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| SSO / SAML | Supported | "Two-factor login, OIDC SSO and org roles for humans; invitation-only cloud. OIDC is the registry SSO alias; no SAML-specific claim." [source](https://microsandbox.dev/enterprise) |
| Teams | Supported | "Invite viewers, members or admins; organization roles, quotas, billing and audit logs." [source](https://microsandbox.dev/enterprise) |
| Workload identity | Not supported | "Static host-side credential substitution, not an OIDC/SPIFFE identity issued to the workload." [source](https://docs.microsandbox.dev/security/secrets) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "Official msb CLI installs via curl, Homebrew, npm, Python or Cargo and manages local/cloud microVMs." [source](https://docs.microsandbox.dev/cli/overview) |
| E2B-compatible API | Not supported | "Own microsandbox REST and SDK contract; no drop-in E2B API compatibility advertised." [source](https://docs.microsandbox.dev/api-reference/overview) |
| Filesystem API | Supported | "Common guest-filesystem path operations and host-to-guest copies work on cloud; low-level open-handle operations are local-only. Managed volume filesystem also has REST endpoints." [source](https://docs.microsandbox.dev/cloud/overview) |
| Git deploy | Not supported | "No documented git deploy capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| HTTP data API | Not applicable | "Compute/microVM sandbox runtime, not a data-layer, edge KV, or first-party model inference service." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| OpenAPI spec | Supported | "Fetchable OpenAPI 3.1.0 organization spec (38 paths) and personal spec (53 paths); broken apex catalog link has valid docs-hosted alternatives." [source](https://docs.microsandbox.dev/api-reference/openapi.json) |
| Private container registry | Not supported | "Private registries means pull images from your own registries with credentials the guest never sees, not a platform-hosted image registry." [source](https://microsandbox.dev/platform/cloud) |
| Public API | Supported | "Cloud REST API manages sandboxes and accounts with API key/personal bearer tokens; SDK/CLI handle command channels." [source](https://docs.microsandbox.dev/api-reference/overview) |
| SDK | Supported | "Official Rust, TypeScript, Python, Go and Ruby SDKs with references." [source](https://docs.microsandbox.dev/sdk/overview) |
| SSH access | Supported | "Native SDK sessions and msb ssh work on cloud; msb ssh serve is local-only." [source](https://docs.microsandbox.dev/cloud/overview) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | "Sandbox YAML config and script/bootstrap options, not cloud-init/ignition metadata interface." [source](https://github.com/superradcompany/microsandbox) |
| Desktop / computer-use sandbox | Partially supported | "Local-only manual recipe installs LXQt, TigerVNC and noVNC into Debian microVM; no preconfigured hosted desktop product." [source](https://docs.microsandbox.dev/how-to/development/vnc-desktop) |
| GPU compute | Not supported | "No general-purpose passthrough or host PCI devices; no cloud GPU option documented." [source](https://docs.microsandbox.dev/security/isolation) |
| Live-state (memory) snapshots | Partially supported | "Local-only: full checkpoints and live-state forks resume processes; cloud supports stopped-sandbox disk snapshots only." [source](https://docs.microsandbox.dev/cloud/overview) |
| Multi-region | Not supported | "No documented multi-region capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Object storage | Not supported | "Managed directory volumes and root disk, not a vendor-provided managed S3/blob bucket service." [source](https://docs.microsandbox.dev/cloud/overview) |
| Persistent disk | Supported | "Managed persistent volumes and persistent sandboxes; named directory volumes work on cloud." [source](https://docs.microsandbox.dev/cloud/overview) |
| Sandbox templates / custom images | Supported | "OCI images from Docker Hub, GHCR, ECR, GCR or another registry; local image archives and root formats have additional capabilities." [source](https://docs.microsandbox.dev/images/overview) |
| Scale to zero | Partially supported | "Maximum-duration and idle-timeout policies work on cloud; local stop/snapshot lifecycle is caller-controlled. No documented automatic wake-on-request fleet autoscaler." [source](https://docs.microsandbox.dev/cloud/overview) |
| Selectable isolation runtime | Not supported | "Security profiles affect in-guest privilege; local/cloud backend selection changes placement, not a choice of microVM vs gVisor/container isolation." [source](https://docs.microsandbox.dev/security/isolation) |
| Snapshots / forking | Supported | "Cloud: disk snapshots from stopped persistent sandboxes restored into new sandboxes. Live capture, full checkpoints and forking are local-only." [source](https://docs.microsandbox.dev/cloud/overview) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "Compute/microVM sandbox runtime, not a data-layer, edge KV, or first-party model inference service." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Ephemeral instant DB (no-signup) | Not applicable | "Compute/microVM sandbox runtime, not a data-layer, edge KV, or first-party model inference service." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| First-party database | Not supported | "No documented first-party database capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Vector search | Not applicable | "Compute/microVM sandbox runtime, not a data-layer, edge KV, or first-party model inference service." [source](https://docs.microsandbox.dev/getting-started/introduction) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | "Runtime can isolate CI jobs; not a vendor-managed billed GitHub/GitLab runner service." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Built-in observability | Partially supported | "Local OTLP resource metrics and historical logs; cloud live-follow works but resource metrics are marked local-only. Cloud API lists audit events/usage, not a complete runtime monitoring stack." [source](https://docs.microsandbox.dev/cloud/overview) |
| Preview environments | Not supported | "No documented preview environments capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Scheduled tasks | Not supported | "Dependency-audit recipe uses your host scheduler; no first-party cron service." [source](https://docs.microsandbox.dev/how-to/automation/dependency-audits) |
| Project template marketplace | Not supported | "No documented project template marketplace capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |
| Durable workflows | Not supported | "No documented durable workflows capability found in fetched site, complete docs index, README or linked API specifications." [source](https://docs.microsandbox.dev/getting-started/introduction) |

## Agent readiness

### Read: 11 of 11 signals present

11/11 signals (11 full, 0 partial)

- Llms txt: pass — "Apex and docs llms.txt fetched; docs index has ~300 doc links."
- Llms full txt: pass — "Apex full text 51,051 bytes; comprehensive docs full text 2,260,469 bytes retained as pointer."
- Robots AI policy: pass — "Apex robots explicitly allows GPTBot, ClaudeBot, anthropic-ai, PerplexityBot and others."
- JSON LD: pass — "Homepage Organization and SoftwareApplication JSON-LD."
- Sitemap: pass — "Apex sitemap.xml fetched with nontrivial page list."
- Meta quality: pass — "Descriptive title, description and Open Graph/Twitter metadata in fetched homepage HTML."
- Markdown negotiation: pass — "Mintlify .md content variants fetched for quickstart, cloud, API overview and SDKs."
- Content efficiency: pass — "HTML 112527 bytes; extracted readable text 5856 bytes (5.20%); script/style omitted."
- Docs discoverable: pass — "First-class homepage docs/quickstart links; GitHub homepageUrl and README point back to docs."
- Pricing machine readable: pass — "Server-rendered private-beta tiers/rates with numeric pools; uncertainty about promotion noted separately."
- Anti bot: pass — "Homepage, pricing, docs markdown and linked OpenAPI fetched without challenge. Two specific source failures are recorded separately."

### Drive: 8 of 11 signals present

8/11 signals (8 full, 0 partial)

- Public API: pass — "Cloud REST API and sandbox control SDKs documented."
- Openapi spec: pass — "Two valid docs-hosted OpenAPI 3.1.0 specs fetched; pointers retain size/provenance."
- MCP server: pass — "Documented stdio MCP package plus apex MCP server card."
- SDK packages: pass — "Five official SDKs: Rust/TS/Python/Go/Ruby."
- Auth docs: pass — "API overview documents org msb_ API keys, personal msb_pat_ tokens and Authorization: Bearer."
- Agent self serve creds: fail — "Private beta requires human invitation/manual approval. API-key and personal-token creation exists for authenticated users; not unrestricted agent signup."
- Webhooks: fail — "No signed webhooks found; audit events are polled REST resources."
- CLI tool: pass — "Official msb CLI with cloud backend selector."
- Error model: pass — "API overview shows JSON error.code, error.message and optional error.details."
- Rate limit docs: fail — "Organization/resource quotas disclosed; no API rate-limit response-header/backoff contract found."
- Agent config: pass — "Dedicated AI-agent docs, installable skills, stdio MCP and well-known server card/skills index."

## Coding harnesses

- Claude Code (Anthropic) — "claude mcp add --transport stdio microsandbox -- npx -y microsandbox-mcp; Agent Skills 'Works with Claude Code, Cursor, Codex, Gemini CLI, GitHub Copilot'." [source](https://docs.microsandbox.dev/getting-started/agents)
- Cursor (Anysphere) — "// ~/.cursor/mcp.json { microsandbox: npx -y microsandbox-mcp }; Agent Skills works with Cursor." [source](https://docs.microsandbox.dev/getting-started/agents)
- Codex CLI (OpenAI) — "Agent Skills 'Works with Claude Code, Cursor, Codex, Gemini CLI, GitHub Copilot ...'." [source](https://docs.microsandbox.dev/getting-started/agents)
- Gemini CLI (Google) — "Agent Skills 'Works with ... Gemini CLI ...'." [source](https://docs.microsandbox.dev/getting-started/agents)
- GitHub Copilot (GitHub) — "Agent Skills 'Works with ... GitHub Copilot'." [source](https://docs.microsandbox.dev/getting-started/agents)
- Windsurf (Codeium) — "// ~/.codeium/windsurf/mcp_config.json { microsandbox: npx -y microsandbox-mcp }." [source](https://docs.microsandbox.dev/getting-started/agents)
- OpenCode (opencode) — "// .opencode.json { microsandbox: { type: stdio, command: npx, args: [-y, microsandbox-mcp] } }." [source](https://docs.microsandbox.dev/getting-started/agents)
- Zed Agent (Zed) — "Zed settings: context_servers.microsandbox command npx -y microsandbox-mcp." [source](https://docs.microsandbox.dev/getting-started/agents)
- Pi (earendil-works) — "Run the Pi terminal coding agent against a project on your host." [source](https://docs.microsandbox.dev/how-to/agents/pi)

Plausible compatibility (derived, not stored):

- Aider
- Amp
- Antigravity
- Devin
- Droid
- Goose
- Hermes Agent
- Kilo Code
- Kiro CLI
- Qwen Code

## Open source

- Repository: https://github.com/superradcompany/microsandbox
- License: Apache-2.0
- Stars: 8666
- Forks: 474
- Self-host methods: package-manager, binary, source-build

## Company & presence

- Headquarters: Unknown — not disclosed on scanned pages.
- Founded: Unknown; repository created 2024-10-03.
- GitHub: https://github.com/superradcompany/microsandbox
- Discord: https://discord.gg/T95Y3XnEAK
- X / Twitter: https://twitter.com/microsandbox
- Blog: https://microsandbox.dev/blog
- Docs: https://docs.microsandbox.dev/
- Company site: https://superrad.company/

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.