Secure microVM sandboxes · self-hostable

Give every agent a boundary.

GX Sandbox runs AI agents and the code they generate inside isolated Firecracker microVMs — with egress control, full audit, and the freedom to self-host. Full capability, contained.

free tier · billed per second · self-host or run on our cloud

microvm://demo
running
# create an isolated microVM$ sandbox create demo --image ubuntu:24.04→ demo · running # run code inside it$ sandbox run demo -- python3 solve.py→ done · exit 0 # hand it to a coding agent$ sandbox claude demo
Egress policy · default-deny
api.openai.com:443 allow
169.254.169.254deny
Built on proven primitives
FirecrackerOCI containersSSH · VS Code RemoteREST · Python · TypeScriptSelf-host · BYOC
Platform

Isolation, control, and audit — in one boundary.

isolation

Firecracker microVM per sandbox

A real hardware-virtualized kernel boundary, not a shared-kernel container. Untrusted, AI-generated code stays contained.

egress

Fine-grained egress policy

Control outbound traffic per project by IP/CIDR, port, protocol, direction, and domain. Default-deny as the baseline.

audit

Built-in audit & logs

Structured logs, a per-sandbox timeline, and one request ID across edge, control plane, and workers. Know who ran what.

deploy

Self-host & BYOC

Run the whole platform in your own cloud or on-prem, or the data plane in your subscription. Keep code and data in your boundary.

state

Snapshots & fast wake

Persistent sandboxes, an incremental Image Store, and snapshot-based wake for services keep cold starts short and state durable.

tenancy

Multi-tenant by design

Projects, scoped API keys, per-project quotas, and network policies isolate teams and tenants on a shared, managed cluster.

The model

The sandbox boundary is the permission boundary.

Your app declares a verified principal. GX Sandbox runs the agent with exactly that user’s permissions, gates every outbound connection, and streams a durable audit trail.

Your app
Verifies the user, declares a principal
verified principal
GX Sandbox microVM
the boundary
  • Runs the agent with the user’s permissions
  • Gates every outbound connection
  • Streams a durable audit trail
allow-listed egress
Data sources
SaaS & internal data, scoped to the user
coding agents · TypeScript SDK
// drive Claude Code from your appawait using claude = await sb.claude({  anthropicApiKey: process.env.ANTHROPIC_API_KEY,})for await (const ev of claude.turn("Fix the failing test and commit")) {  if (ev.type === "result") console.log(ev.result)} // or OpenAI Codex — same one-call surfaceawait using codex = await sb.codex({  version: "0.139.0", apiKey: process.env.OPENAI_API_KEY,})for await (const ev of codex.turn("Refactor src/parse.ts and add tests")) {  if (ev.method === "item/completed") console.log(ev.params)}
Coding agents

Claude Code & Codex, built into your product.

Don’t just run code — run the coding agents themselves. GX Sandbox starts Claude Code or OpenAI Codex inside an isolated microVM, and your app drives the session programmatically: stream every event, gate every approval, resume any session.

  • One SDK call opens an agent session inside the sandbox
  • Stream agent messages, tool calls, and file edits as typed events
  • Approve or decline commands and file changes from your own code
  • Resume sessions and read back full transcripts
  • Same boundary: egress policy and audit apply to the agent too
Interface

Drive it from your first line of code.

Create sandboxes, run commands, move files, forward ports, and deploy services — from the REST API, the Python and TypeScript SDKs, the CLI, or VS Code Remote-SSH.

  • REST API + Python & TypeScript SDKs + CLI
  • Commands, files, ports, processes, metadata
  • Deploy long-running services with a stable URL
  • SSH & VS Code Remote-SSH into any sandbox
quickstart
# create a sandbox — REST, SDK, or CLI$ curl -X POST $SANDBOX_API_URL/api/sandboxes \    -H "Authorization: Bearer $SANDBOX_API_KEY" \    -d '{"alias":"demo"}'→ {"sandbox_id":"sbx_…","state":"running"} # or with the TypeScript SDKimport { SandboxClient } from "@generativex/sandbox-sdk"const client = new SandboxClient()const sb = await client.sandboxes.create({ alias: "demo" })const out = await sb.run("python3 solve.py")
Pricing

Market-rate usage. Governance when you scale.

$0.0504 / vCPU-hr · $0.0162 / GB-hr billed per second

Free
$0to start

$50 one-time credit, 1–2 concurrent sandboxes.

Pro
$29/ mo

For individuals. Usage credit included, 10 concurrent.

TeamPopular
$49/ user / mo

SSO/RBAC, 90-day audit, egress policies, priority support.

Enterprise
Customself-host

WORM audit, SCIM, data residency, SLA, dedicated support.

Compare

The isolation and control other sandboxes leave out.

Same market-rate usage pricing as E2B and Daytona — plus a stronger isolation model, fine-grained egress, built-in audit, and the option to self-host.

Stronger isolation by default

Firecracker microVM per sandbox — vs shared-kernel containers or a managed runtime you can’t inspect.

Self-host, or keep data in your cloud

Most managed sandboxes are cloud-only. GX Sandbox self-hosts or runs its data plane in your subscription.

Audit & egress control included

Fine-grained egress policy and a built-in audit trail — the governance regulated teams actually need.

Who it’s for

AI agent platforms

Give each agent run its own isolated microVM with controlled egress and a full audit trail.

Code interpreters

Execute AI-generated code safely — data science, build-and-run, and long-lived devboxes.

CI & ephemeral compute

Spin up disposable environments per job, then reap them. Persistent state when you want it.

Regulated enterprises

Self-host or BYOC with egress control and audit, so AI features meet data-residency needs.

FAQ

How is this different from a laptop or a plain container?

Each sandbox is a Firecracker microVM — a hardware-virtualized boundary, stronger than a shared-kernel container. Agents keep full power (bash, Python, Node.js, OCI containers inside) without putting your host, other tenants, or your network at risk.

Can I use my own toolchain and container images?

Yes. Launch sandboxes from custom images, run OCI containers inside a sandbox, and deploy long-running services from an OCI image with a stable URL.

Can I run Claude Code or Codex inside a sandbox?

Yes — first-class. One SDK call starts Claude Code or OpenAI Codex inside the microVM, and your app drives the session over a WebSocket: stream events, handle approvals, resume sessions, and read transcripts. Interactive use works too, with `sandbox claude <id>` from the CLI.

Can I embed it in my own app or agent?

Yes. Drive everything — create sandboxes, run commands, manage files, forward ports, deploy services — from the REST API and the Python / TypeScript SDKs, or the CLI.

Can I self-host or keep data in my own cloud?

Yes. Enterprise supports full self-host and BYOC (the data plane runs in your own cloud), so code and data stay inside your boundary. This is the core reason regulated teams choose GX Sandbox.

How does pricing work?

Usage is billed per second at market-rate vCPU and memory prices, with a free tier to start. Teams add per-seat governance; Enterprise is a custom annual contract. See the pricing page for details.

Full capability, contained

Run AI code at full speed — isolated, governed, and auditable.