# Vercel Sandbox

The safest way to run code you didn’t write

Source: https://wheredoirunthis.com/products/vercel-sandbox · JSON: https://wheredoirunthis.com/api/products/vercel-sandbox · Read on 2026-10-12

## At a glance

- Type: Sandbox
- Kind: Hosted
- Isolation: Firecracker microVM
- Free tier: Not documented
- Starting price: $20/mo per seat
- GPU: No
- Regions: 19
- Coverage: 22 of 61 assessed capabilities supported
- Agent readiness: read 9 of 11 signals, drive 9.5 of 11 signals

## Links

- Homepage: https://vercel.com/sandbox
- Docs: https://vercel.com/docs/sandbox
- Pricing: https://vercel.com/docs/sandbox/pricing
- Repository: https://github.com/vercel/sandbox

## Pricing

- Model: Hobby free personal/non-commercial; Pro $20 per developer seat/month plus usage ($20 included usage credit); Enterprise custom. Sandbox meters active CPU, allocated memory, creations, data transfer, snapshots and Drives.
- Unit: active vCPU-hour; provisioned GB-memory-hour; Sandbox creation; GB transfer; snapshot/Drive GB-month; Drive read/write GB
- Free tier: Hobby: 5 active CPU-hours/month, 420 GB-memory-hours/month, 5,000 creations/month, 20 GB transfer/month, 15 GB lifetime snapshot storage; 15 GB lifetime Drive storage and 30 GB reads/writes/month.

| Tier | Price | Includes | Notes |
| --- | --- | --- | --- |
| Hobby | $0/month | Personal/non-commercial; 10 concurrent, 45-minute sessions, up to 4 vCPU.; 15 GB snapshot storage is lifetime allowance, not monthly recurring; separate 15 GB Drive storage lifetime, 30 GB Drive reads/writes monthly. |  [source](https://vercel.com/docs/sandbox/pricing) |
| Pro | $20/developer seat/month + usage | 10,000 concurrent; 24-hour sessions; 8 vCPU max; $20 shared usage credit.; $20 shared monthly usage credit, not a duplicated set of Hobby free Sandbox quotas. Pro Flat Rate CDN includes 1 TB monthly data transfer and 1 million CDN requests, shared with other project traffic. |  [source](https://vercel.com/docs/sandbox/pricing) |
| Enterprise | Custom | 10,000 concurrent; 24-hour sessions; 32 vCPU max; negotiated terms. |  [source](https://vercel.com/docs/sandbox/pricing) |

- Overages: iad1: $0.128/active CPU-hour; $0.0212/GB-memory-hour; $0.60/million creations; Pro Sandbox transfer included in Flat Rate CDN (lowest capacity includes 1 TB/month shared traffic), Enterprise published transfer $0.15/GB; $0.08/GB-month snapshots; Drive $0.05/GB-month + $0.0015/GB reads + $0.004/GB writes. CPU/memory/Drive rates vary by region.
- Card required: Not documented
- Source: https://vercel.com/docs/sandbox/pricing

## Runtime

- **GPU & accelerators**: No [source](https://vercel.com/docs/sandbox)
- **BYOC (Bring your own cloud)**: No [source](https://vercel.com/docs/sandbox)
- **Secrets management**: Host-controlled credential brokering injects headers outside untrusted code; Sandbox management OIDC/access tokens; caller-provided env for processes. [source](https://vercel.com/docs/sandbox/concepts/firewall)
- **Storage options**: 64 GB ephemeral NVMe with SDK 3.0+ or custom images (deprecated runtimes 32 GB); session filesystem persisted by snapshots; reusable regional Drives beta (up to 4 mounted); OCI images via VCR; external object stores mounted via FUSE. [source](https://vercel.com/docs/sandbox)
- **Supported workloads**: Untrusted/AI-generated code, Coding-agent execution, Isolated tests and app previews, Linux commands and privileged Docker/FUSE [source](https://vercel.com/docs/sandbox)
- **Persistence**: Filesystem auto-snapshot on stop/timeout; resume starts a new session from snapshot. Persistence is default; opt-out discards filesystem. Processes need onResume restart. [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes)
- **Data jurisdiction**: 19 Sandbox regions; default iad1; per-sandbox selection on every plan; failover regions Pro/Enterprise. [source](https://vercel.com/docs/sandbox/concepts/regions)
- **Resource limits & quotas**: Hobby 10 concurrent, 45-minute sessions, up to 4 vCPU; Pro/Enterprise 10,000 concurrent, 24-hour sessions, up to 8/32 vCPU; 2 GB RAM/vCPU; 15 exposed ports; 64 GB ephemeral disk on SDK 3.0+/custom images; default session timeout 5 minutes. Persistent Sandbox lifetime spans sessions. [source](https://vercel.com/docs/sandbox/pricing)
- **SDK languages**: JavaScript/TypeScript, Python [source](https://vercel.com/docs/sandbox)
- **Network & egress controls**: allow-all, deny-all or domain allowlists; dynamically update policy; credential brokering and HTTPS header transformations; Secure Compute traffic follows configured policy. [source](https://vercel.com/docs/sandbox/concepts/firewall)
- **Snapshots & forks**: Manual and automatic filesystem snapshots; fork starts new Sandbox from snapshot; snapshot retention configurable. [source](https://vercel.com/docs/sandbox/concepts/snapshots)
- **Deployment methods**: Sandbox SDKs, sandbox CLI, REST /v2/sandboxes, project dashboard and OAuth Vercel MCP Sandbox tools. [source](https://vercel.com/docs/sandbox)
- **Isolation**: Firecracker microVM — "Each sandbox runs in its own Firecracker microVM with a dedicated kernel." [source](https://vercel.com/sandbox) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "vercel-sandbox" [source](https://vercel.com/docs/agent-resources/vercel-plugin) |
| AI app builder | Not supported | "Build a v0-style app builder" [source](https://vercel.com/docs/sandbox/ecosystem) |
| Autonomous QA agent | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Built-in coding agent | Not supported | "Sandbox provides an isolated workspace to edit files and run the app." [source](https://vercel.com/docs/sandbox/ecosystem) |
| BYOK for LLMs | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Credential-injection proxy | Supported | "Credential brokering is deactivated." [source](https://vercel.com/docs/sandbox/concepts/firewall) |
| LLM gateway | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| MCP client | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| MCP-server hosting | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| MCP server | Supported | "create_sandboxes_sessions_session_id_snapshot_v3" [source](https://vercel.com/docs/agent-resources/vercel-mcp/tools/sandboxes) |
| Model inference API (first-party) | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Preinstalled coding agent | Supported | "coding agents, utilities" [source](https://vercel.com/docs/sandbox/concepts/images) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Supported | "sandbox.domain(port)" [source](https://vercel.com/docs/sandbox/sdk-reference) |
| Custom domains | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Direct public IPv6 | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Edge KV store | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Egress controls | Supported | "await sandbox.update({ networkPolicy: 'deny-all' });" [source](https://vercel.com/docs/sandbox/concepts/firewall) |
| Email send / receive | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Public preview URLs | Supported | "Run development servers" [source](https://vercel.com/docs/sandbox) |
| Private networking | Partially supported | "reach your own AWS VPC over VPC peering" [source](https://vercel.com/docs/sandbox/concepts/secure-compute) |
| Built-in reverse proxy | Supported | "You can open up to 15 ports and access them through a sandbox URL" [source](https://vercel.com/sandbox) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| BYOC | Not supported | "on the same infrastructure that powers Vercel's builds" [source](https://vercel.com/sandbox) |
| Deploy into customers' VPCs | Not supported | "reach your own AWS VPC over VPC peering" [source](https://vercel.com/docs/sandbox/concepts/secure-compute) |
| Secrets management | Supported | "Protect your credentials" [source](https://vercel.com/docs/sandbox/concepts/firewall) |
| Self-host / OSS core | Not supported | "View the Sandbox repository on GitHub contained the SDK and CLI codebase." [source](https://vercel.com/docs/sandbox) |
| Sharing | Partially supported | "shared with your team" [source](https://vercel.com/docs/sandbox/concepts/images) |
| SSO / SAML | Partially supported | "SAML Single Sign-On (SSO)" [source](https://vercel.com/pricing) |
| Teams | Supported | "team-scoped references" [source](https://vercel.com/docs/sandbox/concepts/images) |
| Workload identity | Not supported | "Vercel OIDC tokens" [source](https://vercel.com/docs/sandbox/concepts/authentication) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "sandbox run echo" [source](https://vercel.com/docs/sandbox/cli-reference) |
| E2B-compatible API | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Filesystem API | Supported | "sandbox.writeFiles" [source](https://vercel.com/sandbox) |
| Git deploy | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| HTTP data API | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| OpenAPI spec | Supported | "Vercel API" [source](https://openapi.vercel.sh/) |
| Private container registry | Supported | "push an OCI image to Vercel Container Registry (VCR)" [source](https://vercel.com/docs/sandbox/concepts/images) |
| Public API | Supported | "POST /v2/sandboxes" [source](https://vercel.com/docs/rest-api/sandboxes/create-a-named-sandbox) |
| SDK | Supported | "JS SDK Reference" [source](https://vercel.com/docs/sandbox) |
| SSH access | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Desktop / computer-use sandbox | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| GPU compute | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Live-state (memory) snapshots | Not supported | "captures its current filesystem" [source](https://vercel.com/docs/sandbox/concepts/snapshots) |
| Multi-region | Supported | "Vercel Sandbox is available in 19 regions:" [source](https://vercel.com/docs/sandbox/concepts/regions) |
| Object storage | Not supported | "The files live in the provider, not the sandbox." [source](https://vercel.com/docs/sandbox/ecosystem) |
| Persistent disk | Supported | "Persistence is the default." [source](https://vercel.com/docs/sandbox/concepts/persistent-sandboxes) |
| Sandbox templates / custom images | Supported | "your own custom images" [source](https://vercel.com/docs/sandbox/concepts/images) |
| Scale to zero | Supported | "Stop sandboxes promptly" [source](https://vercel.com/docs/sandbox/pricing) |
| Selectable isolation runtime | Not supported | "Every sandbox is the same isolated Firecracker microVM" [source](https://vercel.com/sandbox) |
| Snapshots / forking | Supported | "You can create or fork any number of sandboxes from the same snapshot." [source](https://vercel.com/docs/sandbox/concepts/snapshots) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Ephemeral instant DB (no-signup) | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| First-party database | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Vector search | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Built-in observability | Supported | "Observability → Sandboxes" [source](https://vercel.com/sandbox) |
| Preview environments | Not supported | "Run development servers" [source](https://vercel.com/docs/sandbox) |
| Scheduled tasks | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Project template marketplace | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |
| Durable workflows | Not supported | "Run untrusted or agent-generated code in isolated Linux microVMs." [source](https://vercel.com/docs/sandbox) |

## Agent readiness

### Read: 9 of 11 signals present

9/11 signals (8 full, 2 partial)

- Llms txt: pass — "https://vercel.com/docs/llms.txt: docs, pricing, API, MCP and Sandbox links."
- Llms full txt: pass — "https://vercel.com/docs/llms-full.txt: 1,039,417-byte comprehensive text, HTTP 200, bounded pointer retained."
- Robots AI policy: partial — "https://vercel.com/robots.txt: User-Agent: *; Content-Signal search=yes, ai-input=yes, ai-train=no; no explicit major AI UA allow directive."
- JSON LD: fail — "https://vercel.com/sandbox raw HTML extraction found no application/ld+json scripts."
- Sitemap: pass — "robots Sitemap: https://vercel.com/sitemap.xml; fetched nontrivial 1,201,678-byte XML (pointer)."
- Meta quality: pass — "Sandbox – Vercel title; descriptive meta description and OG title/description/url."
- Markdown negotiation: pass — "/sandbox.md and /docs/sandbox.md fetched HTTP 200, clean markdown with canonical metadata."
- Content efficiency: partial — "Raw landing 920155 HTML characters / 17136 readable characters = 1.8629%; extraction excludes scripts/style (retained pointer and extraction signals)."
- Docs discoverable: pass — "Get started links /docs/vercel-sandbox in main product hero, followed to canonical /docs/sandbox."
- Pricing machine readable: pass — "https://vercel.com/docs/sandbox/pricing: machine-readable Hobby/Pro/Enterprise table plus 19-region CPU/memory rates."
- Anti bot: pass — "Public landing/docs/spec/robots/changelog fetches succeeded without a blocking challenge; privacy/careers required rendering due SPA shell, not an observed anti-bot block."

### Drive: 9.5 of 11 signals present

9.5/11 signals (9 full, 1 partial)

- Public API: pass — "REST /v2/sandboxes CRUD and command/file/Drive endpoints documented."
- Openapi spec: pass — "OpenAPI 3.0.3 fetched at https://openapi.vercel.sh with 27 Sandbox paths."
- MCP server: pass — "https://mcp.vercel.com official OAuth remote MCP; documented Sandbox tools, approved-client restriction."
- SDK packages: pass — "Official @vercel/sandbox JavaScript/TypeScript and vercel.sandbox Python."
- Auth docs: pass — "Sandbox authentication explains OIDC project tokens and access tokens, including external environments."
- Agent self serve creds: pass — "https://vercel.com/docs/cli/tokens: vercel tokens create prints a new token, but requires a classic account-level personal access token first created in the dashboard; OAuth login sessions and team/project-only tokens cannot mint tokens. Full documented issuance credit, not autonomous signup or exercised behavior."
- Webhooks: fail — "Reviewed Vercel account webhooks: deployment/integration events, no Sandbox-lifecycle webhook signing/event API confirmed."
- CLI tool: pass — "Official sandbox CLI creation, connect/exec, snapshot/fork and Drive commands."
- Error model: pass — "https://vercel.com/docs/rest-api/errors: consistent error.code/error.message and rate_limited error.limit.remaining/reset/resetMs/total."
- Rate limit docs: partial — "Sandbox creation cap 20–40/min Hobby, 5,000/min Pro/Enterprise; REST error rate-limit reset fields. Response headers not confirmed."
- Agent config: pass — "SDK repo AGENTS.md; first-party named vercel-sandbox plugin skill; /.well-known/ai-catalog.json documentation graph discovery."

## Coding harnesses

- Cursor (Anysphere) — "Cursor Cloud Agents on Self-Hosted Machines" [source](https://vercel.com/docs/sandbox/ecosystem)
- Hermes Agent (Nous Research) — "Hermes terminal commands in Sandbox microVMs" [source](https://vercel.com/docs/sandbox/ecosystem)
- Claude Code (Anthropic) — "The base image already includes `claude`, `codex`, and `opencode`" [source](https://vercel.com/sandbox)
- Codex CLI (OpenAI) — "The base image already includes `claude`, `codex`, and `opencode`" [source](https://vercel.com/sandbox)
- OpenCode (opencode) — "The base image already includes `claude`, `codex`, and `opencode`" [source](https://vercel.com/sandbox)

## Compliance & regions

- SOC 2 Type II: certified (scope: hosted) — "Vercel has a SOC 2 Type 2 attestation for Security, Confidentiality, and Availability" [source](https://vercel.com/docs/security/compliance)
- ISO/IEC 27001: certified (scope: hosted) — "Vercel is ISO 27001:2022 certified" [source](https://vercel.com/docs/security/compliance)
- GDPR: self-attested (scope: hosted) — "Vercel supports GDPR compliance" [source](https://vercel.com/docs/security/compliance)
- PCI DSS: self-attested (scope: hosted) — "Self-Assessment Questionnaire D (SAQ-D) Attestation of Compliance" [source](https://vercel.com/docs/security/compliance)
- HIPAA: self-attested (scope: hosted) — "Signing Business Associate Agreements (BAAs) with eligible Pro and Enterprise customers" [source](https://vercel.com/docs/security/compliance)
- Regions: arn1 (Stockholm, Sweden), bom1 (Mumbai, India), cdg1 (Paris, France), cle1 (Cleveland, USA), cpt1 (Cape Town, South Africa), dub1 (Dublin, Ireland), fra1 (Frankfurt, Germany), gru1 (São Paulo, Brazil), hkg1 (Hong Kong), hnd1 (Tokyo, Japan), iad1 (Washington, D.C., USA), icn1 (Seoul, South Korea), kix1 (Osaka, Japan), lhr1 (London, United Kingdom), pdx1 (Portland, USA), sfo1 (San Francisco, USA), sin1 (Singapore), syd1 (Sydney, Australia), yul1 (Montréal, Canada)
- Regions note: 19 Sandbox regions, not inferred from deployment platform regions; default iad1. Drive region is fixed and must match attached Sandbox.

## Company & presence

- Headquarters: San Francisco, USA
- Privacy policy: https://vercel.com/legal/privacy-policy
- Terms of service: https://vercel.com/legal/terms
- GitHub: https://github.com/vercel/sandbox
- Docs: https://vercel.com/docs/sandbox
- Blog: https://vercel.com/blog
- Changelog: https://vercel.com/changelog
- Security: https://vercel.com/security

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.