AIO Sandbox MCP
A Docker container bundling browser, terminal, files, VS Code and MCP services for running agent actions safely in isolation
- 6,331 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Executes arbitrary shell commands and code inside the container on the agent's request
- Without a configured access key the container's services are unauthenticated
- Gives the agent control over the sandbox's browser and filesystem
Install
- Works in
Manual install
docker run --security-opt seccomp=unconfined --rm -it -e SANDBOX_API_KEY=your-secret-key -p 127.0.0.1:8080:8080 ghcr.io/agent-infra/sandbox:latestRuns the container locally, binding the port only to 127.0.0.1. MCP services become available at http://localhost:8080/mcp.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Executes arbitrary shell commands and code inside the container on the agent's request
- Without a configured access key the container's services are unauthenticated
- Gives the agent control over the sandbox's browser and filesystem
This is third-party code. Review the repository files before installing.
What it does
AIO Sandbox spins up a single Docker container where a browser with VNC and CDP, a terminal, a filesystem, VS Code Server and Jupyter share one environment. The agent connects through an MCP endpoint or a Python, TypeScript or Go SDK to run commands, read and write files, drive the browser and execute code without touching the host machine. Files the browser downloads inside the sandbox are immediately visible to the shell and file tools because every component shares the same filesystem. The container can be locked down with an access key; without one its API, VNC and Jupyter stay open to anyone who reaches the port.
Who it is for. For developers building agent pipelines who want to run code, downloaded files and browser automation in an isolated environment instead of on their own machine.
Good fit when
- You need an isolated environment where an agent can safely run commands and code
- The agent needs a browser, terminal and file operations at once, sharing one filesystem
- Your own agent connects to a ready MCP hub instead of configuring separate MCP servers for browser, files and shell
Not a fit when
- You only need a simple task without code execution or a browser, where a plain MCP server is enough
- Docker is unavailable or not allowed in the working environment
- You need production multi-tenant isolation: this is a single container for one session, not a multi-tenant platform
Example request
Spin up AIO Sandbox locally and inside the container open this page, take a screenshot and save it as a fileMCP
- Transport
- http
- Authentication
- key is optional
Environment variables
SANDBOX_API_KEYsecret- Access key for the API, VNC browser and Jupyter. Without it the container's services are open to anyone who can see the port.
Limitations
Requires Docker and self-hosting; there is no ready hosted service. Without the SANDBOX_API_KEY variable the container's services stay unauthenticated, so the key must be set explicitly. The image is heavy: it bundles a browser, VS Code Server and Jupyter, so the container needs noticeable resources. Some README examples require extra SDKs and Playwright.
How to disable. Stop and remove the container (docker stop and docker rm) and remove the agent-sandbox or @agent-infra/sandbox SDK from your project dependencies.
FAQ
How does an agent get access to the sandbox?
Through the container's MCP endpoint at /mcp, or through the Python, TypeScript or Go SDKs that call the same REST API.
Should the container be password protected?
Yes, with the SANDBOX_API_KEY variable. Without it the API, the VNC browser and Jupyter are unauthenticated for anyone who can reach port 8080.
Discussion
No questions or reviews yet.
Related
MCP serversA Dagger MCP server that gives each agent its own container and git branch for safe parallel work
Superserve sandbox MCP server: an agent creates isolated Firecracker microVMs, runs commands in them and manages files
A self-hosted AgentOS for one workspace: plan-mode chat, private knowledge base, MCP tools, skills, memory and a sandbox
An open coding agent for the terminal, browser and desktop that works with models from OpenAI and Claude to Ollama
A CLI connects a model to a Docker-container terminal so an agent can run commands, create files and save its step history
pydantic-deepagents
pydantic-deepagents (pydantic-deep)
An open-source terminal AI assistant and Python framework with a Docker sandbox, agent tools and subagents
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| AIO Sandbox (this card) | no | key is optional | 6,331 | |
| Fence | yes | 1,020 | fence runs commands and agents like Claude Code in a sandbox | |
| Zerobox | no | 729 | a sandbox for commands and agent-written code | |
| Dory: Docker, Kubernetes and agent sandboxes on Mac | yes | not required | 1,636 | a Docker Desktop replacement for Apple Silicon Macs with a built-in |
README in short
The README describes AIO Sandbox as a unified agent sandbox: a browser with VNC and Chrome DevTools Protocol, a terminal, file operations, VS Code Server and Jupyter in one Docker image sharing a filesystem. It starts with docker run publishing port 8080, and code accesses it through the Python package agent-sandbox, the npm package @agent-infra/sandbox or a Go module. It walks through an example where a browser downloads a page, Jupyter converts it to Markdown and the shell reads the result, all on the container's shared disk. Apache-2.0 licensed.