Repolode
Submit
strands-agents

strands-agents/box

An open source sandbox engine for AI agents that restricts what they can execute, read, write, and reach on the network, with default-deny policies.

View on GitHubWebsite
Stars
498
Forks
41
Open issues
92
Last commit
17 hours ago

What is it?

Strands Box runs AI agents inside an operating-system sandbox and adds semantic policies written in Dogwood. Access is configured in box.toml for files, programs, and network, while rules in policy.dw decide which operations are allowed, based on their arguments, earlier actions, and elapsed time. Operations checked by the policy engine are denied unless a permit rule allows them, and forbid rules override permits.

The policy engine sits outside the agent process. Strands Shell, Monty for Python, an egress gateway, and an MCP broker send their operations to it, so a file read through one interpreter can affect whether a later outbound HTTP request is allowed. The gateway can inject API credentials or AWS SigV4 signatures into permitted requests, so the agent never receives the underlying secrets. Policy decisions are recorded in OTLP JSON.

Box is harness-agnostic, so you choose which agent program or binary to run. It is a Rust project, currently in preview and limited to local execution on macOS with Apple silicon, with Linux support planned. It can also be linked as a Rust library.

Key features

  • 01Restricts an agent's file, program, and network access through OS isolation.
  • 02Evaluates default-deny permit and forbid rules written in Dogwood.
  • 03Shares one policy engine and event history across shell, Python, network, and MCP calls.
  • 04Checks outbound connections and HTTP requests by method and path.
  • 05Injects API credentials or AWS SigV4 signatures so the agent never sees secrets.
  • 06Records policy decisions as OTLP JSON.

Use cases

  • Running a coding agent that should not read secrets or reach arbitrary hosts.
  • Limiting which external APIs an agent can call and with which HTTP methods.
  • Keeping API keys out of an agent's process while still letting it make authorized requests.
  • Auditing what an agent attempted to do through policy decision logs.

Quick start

  1. 1

    Run the official download script from the README

  2. 2

    Check the installed version

    ./box-core/box --version
  3. 3

    Clone the repository

    git clone https://github.com/strands-agents/box.git
  4. 4

    Build the box binaries from source

    cargo build --release -p strands-box -p strands-box-containment

Things to know

  • Preview release that currently supports local execution only on macOS with Apple silicon.
  • The getting-started guide also requires Node.js 22.21 or later and access to Claude Opus 5 on Amazon Bedrock.

In collections

Sandboxes for AI agentsOpen-source AI agent frameworks & appsMCP servers

Topics

#agent-sandbox#ai-safety#sandboxing#zero-trust#policy#rust#mcp#credential-management#agentic-ai#agents

FAQ

What is box?
An open source sandbox engine for AI agents that restricts what they can execute, read, write, and reach on the network, with default-deny policies. Strands Box runs AI agents inside an operating-system sandbox and adds semantic policies written in Dogwood. Access is configured in box.toml for files, programs, and network, while rules in policy.dw decide which operations are allowed, based on their arguments, earlier actions, and elapsed time. Operations checked by the policy engine are denied unless a permit rule allows them, and forbid rules override permits.
Is box free to use? What license does it have?
box is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is box still maintained?
Actively maintained. The last commit to box was on Nov 6, 2026.
What can I use box for?
Running a coding agent that should not read secrets or reach arbitrary hosts. Limiting which external APIs an agent can call and with which HTTP methods. Keeping API keys out of an agent's process while still letting it make authorized requests. Auditing what an agent attempted to do through policy decision logs.
How do I install box?
Run the official download script from the README Check the installed version: ./box-core/box --version Clone the repository: git clone https://github.com/strands-agents/box.git Build the box binaries from source: cargo build --release -p strands-box -p strands-box-containment
Where can I get box?
The source code and installation instructions are on GitHub: https://github.com/strands-agents/box

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects