Strands Box
Open-source local agent sandbox from AWS's Strands team: OS isolation plus default-deny Dogwood policies over shell, Python, network and MCP calls, with credential injection.
Tags
Description
Strands Box runs any agent program (harness-agnostic) in a kernel-enforced sandbox where the only way out is a policy layer. You set direct file/program/network grants in box.toml and semantic rules in policy.dw (Dogwood policy language). Strands Shell, Monty (Python), an egress gateway and an MCP broker send every operation to the embedded Dogwood Local Engine; rules can depend on arguments, earlier actions and elapsed time (e.g. allow git push only after npm test passed, or cap MCP calls per hour). The gateway injects API credentials or AWS SigV4 signing so the agent never sees secrets, and decisions are recorded as OTLP JSON. Written in Rust, usable as a CLI or a Rust library. Developer preview: macOS on Apple silicon only, Linux planned; for multi-tenant cloud use AWS recommends pairing it with a per-session microVM.
Agent access
Related
- Strands Agents: Open-source, model-driven SDK and ready-made harness for building AI agents in Python and TypeScript, with MCP, multi-agent patterns, memory, guardrails, tracing and evals.
- Anthropic Sandbox Runtime (srt): Lightweight OS-level sandbox enforcing filesystem and network restrictions on agents, MCP servers and arbitrary processes, without a container.
- Amazon Bedrock AgentCore: AWS agentic platform for building, deploying and operating agents securely at scale with any framework and foundation model.
- Docker Sandboxes: Docker's `sbx` CLI runs coding agents like Claude Code and Codex in isolated microVM sandboxes, locally for free or on metered Docker-managed cloud compute.
- SPACE (Perplexity): Perplexity's open-sourced sandbox platform: Firecracker microVM sandboxes behind an HTTP API, with templates, pause/suspend, warm pools and an E2B compatibility wrapper.
Sources
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)