Dangerous Sandbox

What it is

Dangerous Sandbox is a remote, kernel-isolated environment for running AI agents and arbitrary code. It clones a GitHub repo into a fresh container, runs a command (or hands the repo to Claude Code with a prompt), and returns logs plus a structured filesystem diff showing exactly what changed.

The container is destroyed when the run finishes. Network is locked down except for runtimes that need it. Resource caps and timeouts apply to every run. Isolation is enforced by gVisor, not just Docker.

It exists because agentic coding tools want to run a lot of bash commands. The choices are: approve each one (slow), let them run unchecked on your laptop (risky), or move them off your machine entirely. This is option three.

Try it

Hand a repo and a prompt to Claude Code:

curl -N https://sandbox.dangeroussandbox.dev/runs \
  -H "Authorization: Bearer $YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "repo_url": "https://github.com/octocat/Hello-World",
    "command": "cd /work && claude --print --permission-mode acceptEdits \"add a HELLO.txt\"",
    "runtime": "claude",
    "anthropic_api_key": "sk-ant-..."
  }'

Or run any command in a pre-built language runtime:

curl https://sandbox.dangeroussandbox.dev/runs \
  -H "Authorization: Bearer $YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "repo_url": "https://github.com/octocat/Hello-World",
    "command": "python3 -c \"import numpy as np; print(np.random.randn(5,5).mean())\"",
    "runtime": "python"
  }'

Five language runtimes are available: minimal, python, node, go, rust, and claude. Logs stream over Server-Sent Events. The final filesystem diff arrives as a structured JSON event.

API keys are issued by request — email paxhuybers@gmail.com.

Use the CLI

sbx is a single-file Python CLI. Stdlib only, no dependencies, drop it in your ~/bin and go.

export SBX_URL=https://sandbox.dangeroussandbox.dev
export SBX_KEY=<your-key>
export ANTHROPIC_API_KEY=<your-anthropic-key>

sbx claude --repo https://github.com/octocat/Hello-World \
  "add a Python script that prints hello"

Logs stream live to your terminal. The exit code propagates. The diff summary lands at the end:

Created `/work/greet.py`.

sbx: exit=0 files=1 bytes=49

See it run