Sandboxes

• StorybookUI component workshop

  Free / OSS · OSS/MIT · 91.3k GitHub stars

  VerdictEssential for component-driven development.

  CatchConfiguration complexity grows. Build times can be slow. Keeping stories updated requires discipline.

• Spree CommerceBSD-3-Clause Ruby commerce OS; Free Sandbox, no platform fees

  Free / OSS · Freemium · 15.8k GitHub stars

  VerdictBSD-3 Ruby commerce. Self-host free; Sandbox has no CC. Not Medusa.

  CatchRuby commerce + REST/OpenAPI + Next.js storefront — not Medusa MIT Node OS. Solidus (BSD sibling) omitted: same Spree-fork slot. Distinct from Medusa.

• OAuth2 ProxyMIT CNCF Sandbox reverse-proxy auth gate vs external IdPs

  Free / OSS · OSS/MIT · 15.2k GitHub stars

  VerdictMIT CNCF reverse-proxy auth gate. Free forever; bring an external IdP — this is not one.

  CatchNOT an IdP and NOT a user store — it only gates apps against an upstream provider you already run or rent. Vs Authelia/Tinyauth (proxy SSO / portal), authentik (full IdP), and Dex (federated OIDC IdP that still is not an app-fronting proxy): oauth2-proxy sits in front of apps, talks out to an IdP, and never owns accounts. You still configure the upstream client, cookies/headers, and the protected upstreams.

• WasmtimeApache-2.0 Bytecode Alliance WebAssembly runtime

  Free / OSS · Apache-2.0 · 18.7k GitHub stars

  VerdictApache-2.0 Wasm runtime. Standards-track sandbox vs WasmEdge/Wasmer; not a container stand-in.

  CatchVs WasmEdge / Wasmer (alternate Wasm runtimes) and vs containers: Wasmtime is a Wasm runtime, not a Docker replacement for every workload. WASI/component maturity and host ABI choices still shape what you can port; not a general app platform by itself.

• AgentBoxTeleport a repo into parallel sandboxed agent VMs

  Free / OSS · OSS/MIT · 538 GitHub stars

  VerdictMIT parallel agent VM launcher. Reach for it when agents need isolated boxes, not another shared worktree.

  CatchVs E2B / Daytona (ephemeral sandboxes) and Coder (durable remote workspaces): AgentBox is the one-command teleport + multi-agent box launcher, not a full workspace control plane. Docker/OrbStack-class virtualization and cloud backend credentials are on you; cloud minutes are not “free forever.”

• OneCLIApache-2.0 team agent harness — sandboxed personal agents + credential gateway

  Free / OSS · Apache-2.0 · 3.6k GitHub stars

  VerdictOSS team agent harness with credential injection. Sandbox + gateway for many personal agents; not just another secrets vault.

  CatchVs AgentBox / Daytona / E2B: OneCLI is the team harness + credential gateway story, not a generic cloud sandbox product. Vs Infisical: secrets are a means; the product is running agents safely for many people. You still bring model spend and decide which agent CLIs to wire. Cloud convenience is optional — OSS self-host is the forever path.

• CuaOpen computer-use drivers, sandboxes, MCP, and CUA-S1 decision models

  Free / OSS · AGPL-3.0 · 30.2k GitHub stars

  VerdictMIT computer-use stack with CUA-S1. Reach for desktop/OS control and sandboxes; audit the AGPL omni extra and paid cloud fleet boundary.

  CatchVs BrowserSkill, Stagehand, and Browser Use: Cua is the broader computer-use driver/sandbox/model stack, not only browser automation or a browser-session attach bridge. Optional `omni` extras pull AGPL Ultralytics; cloud fleets are paid. Audit extras and treat a fleet as infrastructure spend, not as part of the MIT core.

• Context ModeElastic-2.0 MCP sandbox for tool output and session continuity

  Free / OSS · Elastic-2.0 · 30.8k GitHub stars

  VerdictElastic-2.0 source-available context middleware. Useful SQLite/FTS MCP sandbox; no hosted/managed offering without a careful license review.

  CatchElastic License 2.0 is source-available, not OSI open-source; do not treat the `open-source` label as MIT/Apache freedom. ELv2 restricts offering the software as a hosted or managed service, so review the license before embedding or commercializing a managed Context Mode deployment. Vs a plain MCP server: this is output/context infrastructure, not another domain tool.

• FlueAstro TypeScript harness for autonomous sandbox agents

  Free / OSS · Apache-2.0 · 8.5k GitHub stars

  VerdictApache-2.0 Astro agent harness. Use when you want programmable TypeScript agents with real sandboxes; bring your own models and host.

  CatchVs AgentBox and Octop: Flue is a TypeScript framework for authoring agent harnesses, not a multi-user agent platform or a generic sandbox/VM launcher. You still bring models, credentials, and operational judgment; a dead flue.dev marketing domain is not required — the GitHub repo is the source of truth.

• Agent SubstrateHigh-density secure sandbox runtime for idle-heavy agent workloads

  Free / OSS · Apache-2.0 · 5.5k GitHub stars

  VerdictApache-2.0 agent sandbox runtime. Reach for dense suspend/resume isolation on K8s; bring cluster ops.

  CatchVs AgentBox and Flue: Substrate is the dense sandbox/runtime control plane on Kubernetes, not a developer ADE and not a TypeScript harness framework. Ops cost is real — you need cluster competence. README notes it is not an officially supported Google product.

• PiMIT agent harness with coding CLI, unified LLM API, and TUI

  Free / OSS · OSS/MIT · 116k GitHub stars

  VerdictMIT coding-agent harness. Strong default when you want an OSS CLI + unified providers; sandbox it yourself before production credentials.

  CatchVs Prime Agent, OpenCode, OpenHands, and Claude Code: Pi is the Earendil coding-agent harness + CLI stack, not PrimeIntellect's RLM REPL, a general terminal wrapper, a full autonomous developer platform, or Anthropic's product CLI. Pi does not ship a built-in permission system for filesystem/process/network/credentials — it runs with the launching user's privileges; containerize (Docker/OpenShell/Gondolin patterns in-repo) before giving it secrets. New issues/PRs from new contributors are auto-closed by default pending maintainer review.

• LitterBoxMalware and payload detection sandbox with LitterBoxMCP

  Free / OSS · GPL-3.0 · 1.6k GitHub stars

  VerdictGPL-3 defensive payload sandbox with LitterBoxMCP. Keep for development analysis in a disposable lab; do not present it as production-grade isolation.

  CatchVs Agent Substrate and coding sandboxes: LitterBox is a malware/payload detection sandbox with an MCP surface, not a general coding workspace or agent runtime isolation layer. The README says “Development use only”; production isolation is an unsolved risk. Windows administration and Linux KVM/Windows-container requirements can be substantial, and GPL-3.0 copyleft still applies to distributed modifications.

• AgentVerse OSApache personal cloud OS for you + coding agents on one Ubuntu box

  Free / OSS · Apache-2.0 · 981 GitHub stars

  VerdictApache personal agent cloud when you will run Ubuntu+Tailscale yourself; skip if you wanted a managed IDE or a simple CLI harness.

  CatchVs Coder, Umbrel, and Pi: this is a full personal cloud OS for agents, not a workspace control plane alone, a home NAS app store alone, or a coding harness. Alpha 0.2 on a single-person test box — no multi-user accounts yet; needs Ubuntu + ZFS/Incus/Tailscale ops weight. Bring your own Claude Code/Codex subscriptions inside workspaces.

• DeerFlowMIT long-horizon SuperAgent harness — sandboxes, memory, skills, gateway

  Free / OSS · OSS/MIT · 84.1k GitHub stars

  VerdictMIT SuperAgent harness when you want sandboxes + skills + gateway in one OSS tree and will bring models plus Docker headroom.

  CatchVs OpenHands, LangGraph, and Mastra: DeerFlow is a full SuperAgent product harness with sandboxes/memory/gateway, not an open coding agent alone, a graph orchestration library, or a TypeScript workflow framework. BYO model API keys; Docker sizing is resource-heavy (multi-vCPU/GB guidance); star velocity is extreme (~83k).

• CubeSandboxApache concurrent lightweight agent sandbox — RustVMM/KVM, E2B-compatible

  Free / OSS · Apache-2.0 · 13k GitHub stars

  VerdictApache KVM sandbox when you need dense, E2B-shaped isolation on your own Linux hosts; confirm license text and hardware before betting the fleet.

  CatchVs E2B, Daytona, and Cloudflare Sandbox: this is a self-hosted RustVMM/KVM sandbox control plane, not a hosted sandbox SaaS, a workspace platform, or an edge isolate runtime. GitHub license detect shows NOASSERTION even though LICENSE is Apache-2.0 — verify the tree before compliance sign-off (a detection caveat). Linux + KVM on x86_64 (ARM64 maturing); ops weight is real.

• RakazoApache OSS persistent AI teammates — BYO model and sandbox

  Free / OSS · Apache-2.0 · 4.6k GitHub stars

  VerdictApache self-host teammate stack when you want persistent bots you own with pluggable models/sandboxes; budget Docker and keys, not just the UI.

  CatchVs OpenClaw and DeerFlow: Rakazo is a self-host teammate product (web/desktop/mobile + sandboxes), not a multi-channel messaging agent alone or a SuperAgent research harness. Default install is curl|bash of install-images.sh; beta; BYO model + optional paid sandbox providers; Treg has its own license rider if you embed it.

• AIO SandboxApache one container: browser+shell+files+VS Code+Jupyter+MCP

  Free / OSS · Apache-2.0 · 6.2k GitHub stars

  VerdictApache self-host all-in-one sandbox when one shared FS with browser+IDE+MCP beats a managed microVM — lock the API key and read the seccomp note before exposing it.

  CatchVs E2B, Daytona, and CubeSandbox (Thu managed/microVM sandbox lane): this is a self-host all-in-one container workstation, not hosted Firecracker sandboxes, a managed workspace SaaS, or a KVM density control plane. Quickstart docs use `--security-opt seccomp=unconfined`; set `SANDBOX_API_KEY` or API/Jupyter/VNC stay open by default.

• FrontierAgentApache-2.0 agent runtime + TUI with Agent Team board

  Free / OSS · Apache-2.0 · 5.3k GitHub stars

  VerdictApache-2.0 Agent Team runtime when research/file parallel sub-agents beat a general coding IDE CLI — treat Apodex API promo as optional.

  CatchVs Pi / OpenCode / Claude Code: those are coding harnesses/products; FrontierAgent is a research/file Agent Team runtime from Apodex, not a general IDE coding product. Apodex model/API promo is a temporary freemium lane — OSS path does not depend on it.

• Coding Tools MCPApache-2.0 model-neutral 18-tool coding runtime over MCP

  Free / OSS · Apache-2.0 · 1.2k GitHub stars

  VerdictApache-2.0 coding-runtime MCP when chat clients need workspace-jailed hands — not Desktop Commander host OS control; mid-★ Agents/MCP fill.

  CatchVs Desktop Commander MCP: that is desktop-host terminal/files/processes; this is the chat-client→coding-agent hands layer (patches, interactive sessions, git) for any MCP client. Mid-★ (~1158) kept as Agents/MCP fill — Landlock is Linux-only; use Docker/VM for untrusted work.

• OpenShellApache-2.0 agents/sandbox policy runtime — deny-by-default kernel governance

  Free / OSS · Apache-2.0 · 16.6k GitHub stars

  VerdictApache-2.0 policy runtime when agents need deny-by-default sandbox governance — not E2B/Daytona cloud seats; rank the YAML, not the ★.

  CatchVs E2B / Daytona / CubeSandbox: those are hosted Firecracker sandboxes, freemium stateful env computers, or self-hosted RustVMM/KVM density — OpenShell’s catch is deny-by-default kernel governance + credential injection as policy, not a sandbox SaaS seat. Telemetry defaults on (disableable). ★10,805 in about 60 weeks (~180 a week), so treat the star count with caution; rank on substance, not the counter.

• Monty (Pydantic)MIT in-process Rust Python sandbox — OSS Monty only

  Free / OSS · OSS/MIT · 8.7k GitHub stars

  VerdictMIT in-process Python sandbox when agents need Pydantic Monty OSS — not E2B/AIO/CubeSandbox cloud or KVM seats; ignore the ★ spike.

  Catch★8499 in about 41 weeks (~207 a week): judge it on the sandbox shape, not the star count. Vs E2B / AIO Sandbox / CubeSandbox: those are hosted Firecracker seats, broader sandbox/browser/MCP runtimes, or self-hosted RustVMM/KVM density — Monty’s catch is in-process Rust Python sandbox from Pydantic, not a sandbox SaaS seat. Do not confuse OSS Monty packages with Full Monty commercial; pin the MIT crates/npm/PyPI names.

• Cloudflare OSApache-2.0 AI productivity OS reference design — local trial via pnpm run-local

  Free / OSS · Apache-2.0 · 11.5k GitHub stars

  VerdictApache-2.0 local trial and reference design for a capability-secured company AI workspace — run it with pnpm run-local; production means Workers Paid, and workerd self-host is not ready.

  CatchEarly access: the README calls v2 an early-access rewrite with rough edges. Production deploy targets your Cloudflare account and leans on Dynamic Workers, which need Workers Paid ($5/mo minimum) — the free path is the local trial only. Self-host on your own servers via workerd is marked COMING SOON (low-level config only today). Cloudflare is not seeking outside contribution, so this is a fork-and-own codebase, not a community project. Vs cloudflare-mcp (MCP over the Cloudflare API) and open-design/OpenChatX: this is a full company AI workspace, not a connector or a single agent harness.

• GitHub Agentic WorkflowsMIT gh extension — Markdown agent jobs compiled to Actions with safe outputs

  Free / OSS · OSS/MIT · 5.4k GitHub stars

  VerdictMIT agentic GitHub Actions when you want triage/review/CI-investigation bots with read-only agents and buffered writes — pin versions and budget minutes plus tokens.

  CatchMaturity: pre-1.0 and the README itself says use with caution at your own risk; releases `>=0.83.3 <0.85.4` were retired after a security advisory — pin a current version. Cost is real: every run spends Actions minutes plus your engine’s tokens/seat. Permissions, tools, and network access are configurable, so a careless frontmatter undoes the sandbox. Vs claude-code-action: that runs Claude Code on PR/issue events; gh-aw is a multi-engine workflow compiler with a write-buffer safety model.

• gVisorApache-2.0 userspace container sandbox — OCI runtime runsc for agent isolation

  Free / OSS · Apache-2.0 · 19.7k GitHub stars

  VerdictApache-2.0 OCI sandbox runtime when agent or untrusted containers need more than runc — Linux-only, syscall gaps, and you bring the orchestrator.

  CatchLinux only (kernel 5.6+ recommended). Not every syscall is implemented — exotic workloads fail or fall back. Heavy file and network I/O pay a measurable overhead versus runc. This is a runtime, not an SDK or an orchestration product: you still wire Docker/K8s/agent harnesses yourself. Vs Firecracker/Cloud Hypervisor (microVMs) and plain seccomp: gVisor is the userspace kernel middle path.

• OmnigentApache-2.0 meta-harness over Claude Code, Codex, Cursor, Pi and custom agents — sessions on any device, policies, sandboxes

  Free / OSS · Apache-2.0 · 10.9k GitHub stars

  VerdictMost complete open-source way to run several coding agents under one roof with approvals and sandboxes — powerful but young, heavy to install, and telemetry-on by default.

  CatchAnonymized usage telemetry is on by default; the opt-out lives in their docs, so flip it before you point it at work code. Heavy toolchain: Python 3.12+, uv, git, Node 22 with pnpm for the web UI, tmux for terminal wrappers, and bubblewrap is mandatory on Linux. First commit was June 2026, so APIs and harness support move fast. A meta-harness is a second layer to debug when an agent misbehaves. Vs Herdr (terminal runtime for agent herds): Omnigent is the bigger server-plus-web-UI play with policies and remote sandboxes.

• Agent SandboxApache-2.0 Kubernetes Sandbox CRD + controller — warm pools for agent runtimes

  Free / OSS · Apache-2.0 · 4.3k GitHub stars

  VerdictApache-2.0 sandbox orchestrator for Kubernetes when agent runtimes need stable, warm, stateful pods — pair it with gVisor or Kata for the actual isolation.

  CatchIt schedules and manages sandboxes; it does not isolate them. Isolation comes from the RuntimeClass you pair it with — gVisor (see the gvisor gem) or Kata Containers — and without one you just have ordinary pods. Assumes you already run and operate a Kubernetes cluster. Vs e2b (hosted sandbox API with an SDK): Agent Sandbox is the self-hosted orchestration layer on your own cluster, with no hosted control plane.

• MXCMIT Microsoft SDK for isolating untrusted agent code — Rust, .NET, Node

  Free / OSS · OSS/MIT · 2.9k GitHub stars

  VerdictMIT cross-platform sandbox SDK when your own app must run agent-generated code safely — Rust/.NET/Node only, isolation strength varies by host OS.

  CatchA library you embed in your app, not a runtime you point containers at. SDKs are Rust, .NET, and Node only — no Python. Backends depend on the host: macOS gets Seatbelt only, Windows needs Windows 11, and on Windows the Windows Sandbox, microVM, and Hyperlight backends are experimental. Vs gvisor (OCI runtime for containers) and openshell (sandboxed shell for agents): MXC is the in-process SDK lane.

• preloopMIT self-hosted GitHub Actions with microVM-isolated jobs

  Free / OSS · OSS/MIT · 222 GitHub stars

  VerdictSelf-hosted GitHub Actions with real VM isolation — promising, but young; try it beside your existing CI first.

  CatchYou run a server, not a one-shot CLI — expose it on a tailnet, tunnel or your own domain and keep it patched. It is a small, young project (first commit mid-2026), so expect rough edges and pin versions. Vs act (runs workflows locally in Docker containers with one command): preloop is the heavier choice when you want real isolation and a standing CI service you own.

• pipxMIT install Python apps in isolated environments

  Free / OSS · OSS/MIT · 13k GitHub stars

  VerdictStill the standard way to install Python CLIs, though uv is catching up.

  Catchuv tool install covers the same job and is much faster, so many people have switched. Each app gets its own environment, which uses more disk space. It is for apps, not libraries.

• E2BFirecracker sandboxes for untrusted agent code

  Free tier · Freemium

  VerdictSafe sandboxes for agent-generated code. Hosted convenience.

  CatchHosted by default. You are sending code to E2B infrastructure. Self-hosting is possible but requires more work. Another external dependency in your agent stack.

More with this tag (1)

• Daytona — Freemium agent sandboxes — stateful envs, SDK/API/CLI