Sandbox Agents and Tools
On-premAir-gappedEdgeEvery agent and every tool runs in its own sandbox.
Each starts with no access to your files, network, or keys, and can make only the calls you grant, through any model you choose.
Prompt to sandbox
A sandbox for your agents
Ask any model for an MCP server, a function, or a whole app. Cosmonic Desktop builds what it writes into a WebAssembly component of a few hundred kilobytes, and runs it in a sandbox that can reach only what it declared.
Your coding agent writes and runs code in your name: MCP servers, scripts, and tools, all with access to your files, network, and keys.
Run agent code in a sandbox instead, where every app starts with no access to any of it until you grant it.
Open source coreCNCF wasmCloud
At scale
And run thousands at once
Even locally.
Containers
Cosmonic sandboxes
A fresh sandbox per call is cheap, and idle ones cost nothing, so you can sandbox everything you run without taxing your laptop. Real numbers vary with what your workloads do.
How it works
Move fast and trust nothing
Most software runs with too much access to your files, keys, network, and more.
Cosmonic sandboxes can only reach what you allow. It isn’t that the code tries something and gets blocked. It has no way to try.
Can reachonly what you granted
Never grantednever requested, never reachable
More on the AI sandbox for agent code →
What you build
Sandbox all the things
Containers give code far more access than it needs, and they get heavy when you run a lot of them. Put AI-generated apps, MCP servers, and other untrusted code in a sandbox instead: usually a few hundred kilobytes to a few megabytes, with only the capabilities you grant.
Agents
The agent itself, boxed in with the tools it calls.
MCP servers
Give a model a tool without giving it your machine.
Agent-written code
The script your agent just wrote, no trust required.
Functions
One job, small and quick to start.
Workflows
Chain apps into a pipeline; swap a step without a rebuild.
Apps
The whole thing, front to back, running the same way everywhere.
Two ways in
Start on your laptop. Ship on your cluster.
Run the sandbox on your own machine
Runs entirely on your machine, online or off. Everything local is free, and stays free.
- Works with any coding agent that speaks MCP: Claude Code, Codex, Gemini, opencode, local models
- Inspect exactly what each app can reach
- The same manifest you deploy to production
- macOS, Windows, and Linux
Ship sandboxes on Kubernetes
The same sandbox and the same manifests as Desktop, now at production scale. Free to start.
- Thousands of sandboxes per node, scaling to zero when idle
- Per-workload capability grants and egress policy
- Declarative workloads, running beside the containers you already have
- EKS, AKS, GKE, OpenShift, VMware, on-prem, air-gapped
Frequently asked questions
What does it mean to sandbox an AI agent?
The agent and every tool it calls each run in their own sandbox, not on your machine. Each starts with no access to your files, network, or keys. You grant specific calls, such as one tool reading users from your CRM, and anything you did not grant cannot be reached at all, so a prompt injection or a bad tool call has nowhere to go.
Can the agent use any model?
Yes. The agent reaches its model through an LLM gateway that is itself a granted capability, so you can switch between Claude, ChatGPT, Gemini, DeepSeek, Perplexity, Mistral, or a local model through Ollama without changing what the agent or its tools are allowed to touch.
What does Cosmonic Desktop actually run?
Anything you want contained: ready-made MCP servers and apps from its built-in catalog, the code your agent writes, functions, workflows, and whole applications. Each one runs in a sandbox that starts with no access to your files, network, or keys until you grant it.
How is this different from a container?
A container starts with broad access to the machine that launched it. A Cosmonic sandbox starts with none: an app can reach only what you granted. Sandboxes are also much smaller and quicker to start, so you can afford to run thousands of them, and they run beside the containers you already have rather than replacing them. The AI sandbox guide compares containers, microVMs, and WebAssembly in depth.
Do I need Kubernetes?
No. Cosmonic Desktop runs entirely on your own machine, with no cluster involved. Kubernetes only enters the picture when you want to ship to production, where Cosmonic Control runs the same sandbox and the same manifests on clusters you already have.
Which AI tools does it work with?
Cosmonic Desktop ships an MCP server, so any coding agent that speaks MCP can build and deploy into the sandbox, including Claude Code, Codex, Gemini, opencode, and local models. Nothing here is tied to one vendor.
Build fast. Run securely.
Put the sandbox on your cluster in an afternoon, or run the whole thing on your laptop for free this evening.