Ephemeral Sandbox MCP
A Rust sandbox for parallel coding agents: each gets its own workspace over one shared project, and changes publish as one set.
- 124 ★ on the repository
- Last commit
Broad access
Why this level
- Agents run commands and write files inside a Docker sandbox, and the isolation is not designed for untrusted code.
- The gateway token opens sandbox management.
Install
- Works in
Manual install
curl -LO https://github.com/Ephemeral-AI-Lab/ephemeral-sandbox/releases/latest/download/ephemeral-sandbox-linux-amd64.tar.gzThe first README command (Linux amd64): then unpack the archive and start `bin/start-sandbox-linux-docker-gateway`. `bin/setup-codex-mcp` configures MCP for Codex.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Agents run commands and write files inside a Docker sandbox, and the isolation is not designed for untrusted code.
- The gateway token opens sandbox management.
This is third-party code. Review the repository files before installing.
What it does
Ephemeral Sandbox runs several coding agents against one codebase. Each agent gets an isolated workspace session inside a shared sandbox instead of working in one mutable checkout. The base project history lives in a LayerStack layer available to every session. Before publishing, the system checks concurrent changes and publishes the complete change set or nothing. The repository holds the headless core: gateway, manager, daemon, runtime, observability, CLI and MCP. Each MCP server exposes one tool group: sandbox management, running commands and working with files, or observing health, events and layers.
Who it is for. Teams running several agents in parallel over one repository who want to merge their changes safely.
Good fit when
- Three agents edit different modules of one project and their work must not interfere.
- Before merging you need to review the activity log and the provenance of each change.
- An agent gets a Docker sandbox for running commands and reading files instead of the working directory.
- A swarm experiment needs environments created and destroyed cheaply.
Not a fit when
- You need a hard boundary for mutually untrusted tenants: this is not a microVM.
- A single agent on an ordinary git branch is enough.
- Docker is not installed or reachable.
Example request
Create a sandbox for the project, open a separate workspace session for me, run the tests and show the event log before publishing changes.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
Docker must be installed and reachable. Isolation is meant for cooperating agents, not as a hard boundary between mutually untrusted tenants, so read the security model before choosing a deployment. The browser UI lives in the separate Console repository. Ready builds exist for Linux amd64, macOS arm64 and Windows amd64. The gateway token is kept in `~/.ephemeral-sandbox/gateway.token`; treat it as a secret. The repository's last commit dates from August 2026.
How to disable. Stop the gateway, remove sandboxes through `sandbox-manager-cli`, then delete the MCP entries from the client configuration and the unpacked build directory.
FAQ
How do I run Ephemeral Sandbox on Linux?
Download `ephemeral-sandbox-linux-amd64.tar.gz`, unpack it and start `bin/start-sandbox-linux-docker-gateway`. Docker must be reachable. macOS and Windows have their own scripts.
How do I connect an agent over MCP?
For Codex there is `bin/setup-codex-mcp`. Each MCP server exposes one group: `sandbox-mcp --set management`, `runtime` or `observability`.
Does it protect against untrusted code?
No. It isolates workspace sessions for cooperating agents and is not a hardened boundary between tenants. The security model is described in the documentation.
Where is the browser interface?
In the separate Ephemeral Sandbox Console repository. It connects to a running gateway.
What does atomic publication mean?
Before publishing, the system checks concurrent edits and publishes the complete set or nothing. No partially applied result remains.
Discussion
No questions or reviews yet.
Related
MCP serversA self-hosted agent code sandbox on Kubernetes: REST API, MCP server, E2B compatibility and skills for managing it.
Runtm runs Claude Code, Codex and other agents in isolated sandboxes and deploys the app they build to a live HTTPS endpoint
Containarium: isolated boxes for AI agents
Containarium
A platform on your own server that gives each agent its own Linux box with SSH and MCP tools for commands and files
Isolated Linux microVMs for agent code: the official Vercel skill on the SDK, network rules and snapshots.
The sv command runs Claude Code, Codex and other agents in a separate macOS user under sandbox-exec, with no virtual machine.
AgentBox runs Claude Code, Codex and Open Code in separate virtual machines on your PC, a self-hosted server or a cloud.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Ephemeral Sandbox (this card) | no | not required | 124 | |
| Agent-Sandbox | no | key is optional | 230 | a Kubernetes sandbox with a REST API and E2B compatibility; Ephemeral Sandbox splits one sandbox into workspace sessions for several agents |
| AIO Sandbox | no | key is optional | 6,285 | a container with a browser, terminal and VS Code for one agent; Ephemeral Sandbox handles parallel sessions and change publishing |
README in short
The README explains the idea of workspace sessions over a shared base, gives start scripts for three operating systems and compares the CLI with MCP. The security model lives on the project site.