When building coding agents (like Claude Code, Devin, or SWE-Bench benchmark agents), the agent must execute Python code, inspect test failures, and apply diffs in an isolated environment.

The traditional approach relies on Cloud MicroVMs (like Daytona or E2B). While secure, cloud sandboxes introduce severe operational friction:

  • Cold-Start Latency: 1.5s to 4s to provision a microVM per execution.
  • Cloud Costs: $0.05 to $0.15 per execution hour adds up quickly when running thousands of automated benchmark tests.
  • Context Window Blowout: Uncontrolled stdout/stderr dumps can flood your agent's context window with thousands of lines of terminal spam.

To eliminate these bottlenecks, we engineered agent-code-sandbox.

The Hybrid Architecture: Sub-Millisecond AST Guard + Ephemeral VFS

agent-code-sandbox provides safe, isolated execution directly on the host machine in sub-millisecond time (<0.2ms overhead):

  1. Pre-Execution AST Static Analyzer: Parses the Python Abstract Syntax Tree before execution. It detects and blocks dangerous calls (os.system, subprocess, __import__('socket'), reflective escapes like getattr(eval, '__call__')) before any bytecode executes.
  2. Ephemeral Virtual File System (VFS): Mounts a temporary scratchpad directory with atomic git diff tracking. Every file created or edited by the agent is tracked in an isolated working tree.
  3. Adaptive Token Shield: Limits stdout and stderr to a configurable token budget (e.g. 1,000 tokens), automatically truncating large stack traces and preventing agent context blowout.

Hands-on Implementation

Install via pip:

pip install agent-code-sandbox

Execute code safely:

from agent_code_sandbox import CodeSandbox, SandboxConfig sandbox = CodeSandbox(config=SandboxConfig( timeout_seconds=5.0, max_output_tokens=800, allow_network=False )) # 1. Safe execution code = """ import math result = [math.factorial(i) for i in range(10)] print('Calculated factorials:', result) """ exec_result = sandbox.execute_python(code) print("Output:", exec_result.stdout) # 2. Blocked malicious execution (<0.2ms rejection) malicious_code = """ import os os.remove('/etc/hosts') """ blocked_result = sandbox.execute_python(malicious_code) print("Security Verdict:", blocked_result.security_rejection_reason) # Output: Security Verdict: FORBIDDEN_IMPORT_DETECTED: os

Native Model Context Protocol (MCP) Support

Expose code execution directly to your LLM tools:

python -m agent_code_sandbox.server

Tools exposed: execute_python, execute_command, inspect_code_security.

Sovereign Ecosystem & Open Source