Introducing /sandbox: Disposable micro-VMs for every agent

Today we're launching /sandbox — the primitive that gives your agent a disposable computer. An isolated Linux micro-VM, created in one call: run shell commands, write and read files, expose ports at public URLs, checkpoint the whole machine, fork copies of it, destroy it when done. Billed only for what it actually uses, isolated per tenant, with a hard billing failsafe. No cloud account, no Docker image, no infra.

The problem: agents need a safe place to run code right now

Agents generate code constantly — and the moment they do, they need somewhere to run it. Not a deployment. Not a container image and a cluster. Just a shell.

• Run generated code — execute the script the agent just wrote, look at the output, iterate.
• Untrusted execution — run code from users or the web without touching your own machines.
• Data wrangling — pull a file in, transform it with real tools (python3, jq, git), read the result back.
• Serve something instantly — start a dev server inside the box and get a public URL for it in one call.
• Scratch environments — a machine whose full state survives between sessions without paying for idle compute.

/compute answers "run my Docker image in production". /sandbox answers the question that comes before that: "give me a box, right now, that I can throw away."

How /sandbox works

Every sandbox is an isolated Linux micro-VM that boots in seconds. Naïve owns the infrastructure account; your agent just calls the primitive:

• create — a fresh machine, running in seconds. Pick a size (s/m/l) — it's a ceiling, not a reservation.
• exec — run any shell command; get back exit_code, stdout, stderr. Set cwd, env, and timeouts.
• files — write and read files (utf-8 or base64) anywhere in the box.
• expose — publish a guest port at a public URL (http) or address (tcp); unexpose to stop.
• checkpoint — capture the entire machine (disk + memory + open connections) without stopping it.
• fork — start a NEW sandbox from a checkpoint.
• park / sleep — stop paying while keeping state: park until an explicit resume, or sleep and wake automatically on traffic or the next exec. Both are free.
• resume — pick up exactly where the machine left off.
• destroy — tear it down and stop all billing.

CLI: a computer for your agent in one call

# Create a sandbox (usage-billed; may require approval)
naive sandbox create --name scratch --size s
 
# Run commands
naive sandbox exec <id> "python3 -c 'print(40 + 2)'"
naive sandbox exec <id> "git clone https://github.com/user/repo /app/repo && ls /app/repo"
 
# Files in, files out
naive sandbox write <id> /app/server.py --file ./server.py
naive sandbox read <id> /app/out.json
 
# Serve a port at a public URL
naive sandbox exec <id> "python3 -m http.server 8000 &"
naive sandbox expose <id> 8000
 
# Checkpoint the machine and fork a variant
naive sandbox checkpoint <id> --name golden
naive sandbox fork <id> --name variant-b
 
# Stop paying without losing anything
naive sandbox park <id>      # free until resume
naive sandbox sleep <id>     # free; wakes on traffic or exec
naive sandbox resume <id>
 
# Done
naive sandbox destroy <id>

Every command returns structured JSON with the sandbox status, metered usage, and next steps.

SDK: the same lifecycle, typed

import { createClient } from "@usenaive-sdk/node";
 
const naive = createClient({ apiKey: process.env.NAIVE_API_KEY });
const sandbox = naive.forUser("customer-42").sandbox;
 
const { sandbox: box } = await sandbox.create({ name: "scratch", size: "s" });
 
await sandbox.writeFile(box.sandbox_id, "/app/main.py", "print(40 + 2)");
const result = await sandbox.exec(box.sandbox_id, "python3 /app/main.py");
// { exit_code: 0, stdout: "42\n", stderr: "" }
 
const { url } = await sandbox.expose(box.sandbox_id, 8000); // public https URL
 
await sandbox.checkpoint(box.sandbox_id);
const fork = await sandbox.fork(box.sandbox_id, { name: "variant-b" });
 
await sandbox.park(box.sandbox_id); // free; full state kept

MCP-side, the same verbs ship as naive_sandbox_create, naive_sandbox_exec, naive_sandbox_write_file, naive_sandbox_expose, naive_sandbox_checkpoint, naive_sandbox_fork, naive_sandbox_park, and friends — so any MCP-speaking agent gets a computer tool out of the box.

Billed for what it uses, with a dead-man's switch

/sandbox is metered on observed usage from your credit balance — the same balance as every other primitive. You pay for the CPU, memory, and disk the machine actually uses while running (plus a small one-time creation fee per size), not for the ceiling you picked: an idle l box costs pennies, and a sleeping or parked one costs nothing. Park, sleep, or destroy the box and the meter stops.

And because a forgotten sandbox is the classic way to burn a budget, the meter is also the failsafe: running out of credits auto-destroys the sandbox, and a max-runtime cap catches anything left running too long. The sandbox row records why it stopped, so the agent can see "credits exhausted" instead of a silent disappearance.

Tenant-isolated and approval-gated

Every sandbox is an ownership row scoped to your company and user: list and by-id calls are ownership-guarded, and another tenant's sandbox id is a 404. The VMs run in Naïve's operator account, which only the Naïve API can reach — your agents never hold an infrastructure credential.

Like /compute, the risky verbs are governed: creating or forking a sandbox and running commands are approval-gated by default, so a human signs off before an agent starts spending or executing — and you can relax that per AccountKit when you trust the loop.

What you can build with /sandbox

Code-interpreter agents — generate code, run it, read the output, fix it, repeat — without ever touching your own machines.

Untrusted execution — run user-submitted or web-sourced code in a hardware-isolated box that's gone a minute later.

Repo surgery — clone a repository, run tests, apply patches, read the diff back.

Parallel exploration — prepare one machine, checkpoint it, and fork N copies to try N approaches at once.

Instant previews — start the dev server the agent just wrote and hand back a live public URL.

Long-lived scratchpads — park a machine at the end of a session for free, resume it tomorrow exactly where the agent left off — memory, processes, and all.

Get started

Drop this into any coding agent to wire up Naïve:

Read https://usenaive.ai/skill.md and use it to set up Naïve in my project.

• Read the docs: usenaive.ai/docs/getting-started/sandbox
• CLI reference: usenaive.ai/docs/cli/sandbox
• API reference: usenaive.ai/docs/api-reference/sandbox/overview
• Pair it with /compute
• Join the community on Discord