Topics / #sandboxing

Sandboxing projects on GitHub

Isolating programs in restricted environments to contain untrusted or potentially harmful execution

As of , the most-starred Sandboxing projects on GitHub are daytona (71.5K stars), agentscope (33.4K stars) and NemoClaw (22.8K stars). GitHub.Locker tracks 33 Sandboxing repositories with 233.9K stars combined. The fastest-growing on October 16 was DroidDeck, with +574 stars in a day.

33Projects
233.9KStars in total
+1.3KStars in a day
Browse in the catalog →github.com/topics/sandboxing ↗

Hot right now

Most stars gained in a day · Oct 16

+574

DroidDeck

Droid-Deck/DroidDeck · ★ 9.7K

DroidDeck brings the SteamOS Big Picture experience to Android, letting you run Valve's Steam client and Windows games via Valve's ARM64 Proton on an Adreno-powered Android handheld.

+529

SPACE

perplexityai/SPACE · ★ 1.1K

SPACE (Sandboxed Platform for Agentic Code Execution) is a sandbox platform that runs agent and user code inside isolated Firecracker microVMs, controlled through an HTTP API.

+49

agentscope

agentscope-ai/agentscope · ★ 33.4K

AgentScope 2.0 is a production-ready, easy-to-use Python framework for building and running LLM agents. It leans on the model's own reasoning and tool use instead of boxing it in with strict prompts and opinionated orchestration.

+20

oss-scanner

anthropics/oss-scanner · ★ 1K

OSS Scanner is a service run by Anthropic that scans enrolled open-source repositories for security vulnerabilities, building each project in an isolated VM and emailing the maintainer a reproducer plus a proposed patch for anything it finds.

The all-time top

33 projects · by stars

  1. #1 · daytonaio/daytona

    daytona

    Daytona is a secure, elastic infrastructure runtime for running AI-generated code inside isolated sandboxes, used by agents and developers through SDKs, an API, and a CLI.

    71.5K
  2. #2 · agentscope-ai/agentscope

    agentscope

    AgentScope 2.0 is a production-ready, easy-to-use Python framework for building and running LLM agents. It leans on the model's own reasoning and tool use instead of boxing it in with strict prompts and opinionated orchestration.

    33.4K
  3. #3 · NVIDIA/NemoClaw

    NemoClaw

    An open source reference stack from NVIDIA for running AI agents like OpenClaw, Hermes and LangChain Deep Agents more safely inside NVIDIA OpenShell sandboxes, with managed inference, network policy and lifecycle operations via its CLI.

    22.8K
  1. 4

    CubeSandbox

    13KTencentCloud/CubeSandbox · Go

    CubeSandbox is a high-performance, secure sandbox service for running untrusted AI agent code, built on RustVMM and KVM with hardware-isolated MicroVMs.

  2. 5

    waydroid

    12.4Kwaydroid/waydroid · Python

    Waydroid runs a full Android system in a container on top of a regular GNU/Linux system, letting you use Android apps alongside your Linux desktop.

  3. 6

    jinja

    11.8Kpallets/jinja · Python

    Jinja is a fast, expressive, extensible template engine for Python: you write placeholders in a template using Python-like syntax, then pass it data to render a final document such as HTML.

  4. 7

    omnigent

    10.9Komnigent-ai/omnigent · Python

    Omnigent is an open-source meta-harness for AI agents: a common orchestration layer over coding agents like Claude Code, Codex, Cursor, OpenCode, Hermes, and Pi, with policy enforcement, sandboxing, and real-time collaboration from any device.

  5. 8

    DroidDeck

    9.7KDroid-Deck/DroidDeck · Kotlin

    DroidDeck brings the SteamOS Big Picture experience to Android, letting you run Valve's Steam client and Windows games via Valve's ARM64 Proton on an Adreno-powered Android handheld.

  6. 9

    monty

    8.7Kpydantic/monty · Rust

    Monty is a minimal, secure Python interpreter written in Rust, built so AI models can run generated Python code without the latency and overhead of a container sandbox.

  7. 10

    capsule-fs

    8.4Kunicity-aos/capsule-fs · Rust

    capsule-fs is a filesystem toolkit for AI agents inside Unicity AOS (also called Astrid OS): it gives agents readfile, writefile, replaceinfile, listdirectory, grepsearch, createdirectory, deletefile and movefile tools, all mediated by the OS kernel's VFS airlock.

  8. 11

    smolvm

    6.8Ksmol-machines/smolvm · Rust

    smolvm is a CLI tool for running embeddable, portable, branchable virtual machines so you can safely run AI agents and untrusted code locally, with sub-second cold start on macOS, Linux, and Windows.

  9. 12

    sandbox-runtime

    5.6Kanthropics/sandbox-runtime · TypeScript

    srt (Anthropic Sandbox Runtime) is a lightweight sandboxing tool that enforces filesystem and network restrictions on arbitrary processes at the OS level without needing a container, built to safely sandbox AI agents, local MCP servers, and bash commands.

  10. 13

    just-bash

    4.4Kvercel-labs/just-bash · TypeScript

    just-bash is a simulated bash environment with a virtual filesystem, built so coding agents can run shell-like commands in a safe sandbox instead of touching the real file system. The repo describes the project as 'Bash for Agents'.

  11. 14

    sdk-rust

    4.3Kastrid-runtime/sdk-rust · Rust

    This is the Rust SDK for building Astrid 'capsules' - sandboxed WASM modules that act as user-space processes in the Astrid OS model, with safe typed access to kernel services like filesystem, IPC, networking, storage, approval, and scheduling.

  12. 15

    WeChatBridge

    1.5Kfreestylefly/WeChatBridge · Swift

    WeChatBridge (微信流) is a native, lightweight macOS utility that forwards WeChat chat records to AI agents or archives them into Obsidian — fully local.

  13. 16

    MacPacker

    1.3Ksarensw/MacPacker · Swift

    MacPacker is a free, open source archive manager for macOS that lets you browse archives like folders, preview files without extracting, and drag out only the files you need. It's meant as a native 7-Zip replacement for the Mac.

  14. 17

    SPACE

    1.1Kperplexityai/SPACE · Rust

    SPACE (Sandboxed Platform for Agentic Code Execution) is a sandbox platform that runs agent and user code inside isolated Firecracker microVMs, controlled through an HTTP API.

  15. 18

    hydra

    1.1Kja7ad/hydra · Rust

    Hydra (HDM) is a fast, resilient download manager and accelerator that splits files across multiple connections and mirror sources, with a wget/curl-compatible CLI and a cross-platform desktop GUI.

  16. 19

    oss-scanner

    1Kanthropics/oss-scanner · Dockerfile

    OSS Scanner is a service run by Anthropic that scans enrolled open-source repositories for security vulnerabilities, building each project in an isolated VM and emailing the maintainer a reproducer plus a proposed patch for anything it finds.

  17. 20

    coop

    785trailofbits/coop · Rust

    coop is a Rust CLI that spins up disposable, isolated virtual machines so Claude Code and Codex can run with full tool access (Docker, git, compilers, package managers) without putting your host machine at risk.

  18. 21

    agentbox

    538madarco/agentbox · TypeScript

    AgentBox is a CLI that runs multiple coding agents in parallel, each in its own sandboxed VM, with a single command — on your PC, a self-hosted server, or in the cloud.

  19. 22

    box

    417strands-agents/box · Rust

    Box is an open-source sandbox for running AI agents that restricts what they can execute, read, write, and reach on the network, combining OS-level isolation with a policy engine (Dogwood) and credential injection so secrets never reach the agent.

  20. 23

    nvx

    404microsoft/nvx · Python

    NVX is an ultra-light micro-VM sandbox for running untrusted workloads with hardware-enforced isolation, built on OpenVMM and running Linux as the guest OS.

  21. 24

    Cobalt

    401BandarLabs/Cobalt · Rust

    Cobalt is an open-source application platform for Kobo e-readers: a launcher, an App Store, a Rust SDK, and a runtime with capability isolation that turn the reader into a device that runs real apps.

  22. 25

    moejs

    285Calcium-Ion/moejs · Go

    moejs is a JavaScript engine written entirely in Go, meant to run small JavaScript plugins safely and fast inside a Go host program.

  23. 26

    tinyagent

    253timczm/tinyagent · Python

    tinyagent is a lightweight Python AI agent with a core agent loop, built for a single trusted user and a single running instance, offering both a CLI and an in-process Python SDK.

  24. 27

    paragravity

    235edison-land/paragravity · Python

    ParaGravity (pgrav) is a native, non-invasive manager that runs multiple Google Antigravity (Gemini Pro) accounts side-by-side in separate, isolated windows on macOS and Windows.

  25. 28

    brig

    232brig-sh/brig · Go

    Brig is a Go CLI (brig) with a session daemon (brigd) that runs coding agents inside a microVM sandbox on your own machine, so an unattended agent can only damage the one project you hand it.

  26. 29

    quicksand

    218microsoft/quicksand · Python

    Quicksand is an async Python API for launching, controlling, and snapshotting QEMU virtual machines, built specifically for sandboxing AI agents.

  27. 30

    pi

    20015838328874/pi · Python

    pi-py is a self-hostable, extensible AI agent platform: a Python reimplementation of the 'pi' coding agent harness, shipped as a multi-user HTTP service with sandboxed tool execution, multi-tenant governance, an eval harness, and an RL data flywheel.

  28. 31

    dsh-auto-mode

    164NanmiCoder/dsh-auto-mode · TypeScript

    dsh-auto-mode adds an 'Auto' permission mode to DeepSeek Harness (DSH) that sits between restricted Workspace Write and unrestricted Full access. Routine project work runs sandboxed automatically, while only genuinely risky actions outside that sandbox get classified, approved once, or denied.

  29. 32

    awesome-ai-harness

    153weiwei966/awesome-ai-harness

    A curated reading list on 'harness engineering' — the runtime scaffolding (context management, tool design, agent loops, memory, sandboxing, evaluation) that turns a raw language model into a working agent, in English and Chinese.

  30. 33

    arc-code

    143jerber/arc-code · Python

    arc-code is a research harness that lets Claude Code (or Codex) play the ARC-AGI-3 benchmark games through a shell and filesystem, writing its own parsers, simulators and search code for each game instead of relying on built-in ARC-specific tooling.

Often tagged together