Skip to main content
Sandbox is a Linux environment with a shell, package managers, and outbound network. It is session-scoped: created lazily the first time a tool is called, and destroyed with the session.

​
The tools

Everything else — installing packages, moving files, running a build — happens through sandbox_exec.

​
Sizes

The default size is a platform setting, not a per-binding one.

​
Limits

Idle and maximum lifetimes are platform settings and differ between environments.

​
Cost

Metered per second the container is alive — not per command. A sandbox left idle still costs until it terminates. See noorle.com/pricing.

​
Autonomy

Privileged tier. At Supervised it pauses unless auto-approved; at Read-only it is denied. A Privileged allow that cannot be written to the audit trail is converted to a deny.

​
On MCP gateways

All Sandbox tools are withheld from callers a gateway cannot identify. The container’s identity is derived from the caller’s workspace anchor; an anonymous caller has none. Authenticate the caller and the tools appear.

​
Sandbox or Computer?

Both give you a Linux machine. They differ in lifetime and ownership:

​
Next