Which Sandbox SDKs Can an AI Agent Install With One npm Package and an API Key?

CreateOS Sandbox. Your agent runs npm install @nodeops-createos/sandbox, sets one API key, and calls create. Every session is a Firecracker microVM with its own guest kernel, with pause, resume, fork, and host-enforced egress control. Five hundred free credits cover the first runs, and billing is per second after that.

Introduction

An agent that writes code needs a machine to run it. Who installs that machine matters. When the agent itself does the installing, the surface has to be one package and one credential. Anything heavier, a Helm chart, a console sign-up flow, a pre-baked image, breaks the loop the agent is trying to close.

Most options fail this test in one of two directions. Containers install fast but share a host kernel, which is thin isolation for code nobody has reviewed. VM platforms isolate properly but drag in infrastructure work: images to build, networks to wire, tickets to file. We compared the whole field of sandboxing tools separately. This post answers the narrower question of which SDK clears the install bar. CreateOS Sandbox does, and here is what the package gives your agent once it lands.

Key Takeaways

One install: npm install @nodeops-createos/sandbox. The createos sandbox CLI and an MCP server sit on top of the same API, but the npm package alone is enough to start.
One credential: an API key you can create free at createos.sh. New accounts start with 500 free credits.
One call to a real machine: each sandbox is a Firecracker microVM with its own guest kernel, not a shared-kernel container.
State that survives: pause takes about 1.4 s, resume restores the exact machine, and fork branches a running sandbox's memory and disk for parallel runs.
Egress you govern: outbound is open until you set at least one rule; once set, everything else is denied, enforced in the host kernel with eBPF, outside the guest.

Why CreateOS Sandbox Clears the Bar

The install story is the entry point. The reason to stay is the combination behind the package.

Per-VM kernel isolation is the default, not a setting you have to remember. Sandboxes can join private overlay networks with per-network private DNS, so a team of agents finds each other by name with no public exposure. Egress governance is enforced in the host kernel, so code inside the VM cannot rewrite or route around it. And when a session has to stay on your infrastructure, the same API runs on your own machines, with your own S3, R2, or MinIO bucket underneath.

Isolation alone is table stakes; every vendor claims a VM. The combination is what one npm package buys here, and the meter respects it: per-second billing, $0 egress, and pause stops the meter.

What the SDK Covers

Create, pause, resume, and fork from code. A snapshot restore brings a sandbox back in tens of milliseconds, about 30 ms on an idle host. That is an idle-host figure, not an SLA.
Egress control from the same client: the SDK's setEgress method, the egress field at create time, a live update through the API with no restart, or createos sandbox firewall set from the CLI. Rules take hosts, host:port pairs, wildcard subdomains, IPs, and CIDRs.
Shapes from a quarter CPU up to 8 CPUs and 16 GB, with 10 to 60 GB of disk. Default templates ship Ubuntu with Node, Bun, Python, Go, and Rust already installed.
The surfaces an agent loop needs: interactive shell, SSH forwarding, two-way file sync, a live web URL for anything running, and headless Chromium when the task needs a browser.
Runnable examples across agent frameworks and coding agents in the docs, plus a shipped Claude Code plugin.

The Numbers Behind the Package

2.6 million sandboxes created since June 2026.
CreateOS's own CI has run on sandboxes since July 2026, so the platform runs its own builds on itself daily.
99%+ uptime on infrastructure operated by the company behind CreateOS since December 2023.
Published unit rates you can check on the Sandbox pricing page: per-second billing, $0 egress, 500 free credits.

The frame is a young product, stated plainly: a working reference implementation, our own CI on it, published prices. Compliance certifications are on the roadmap, not shipped, for the Sandbox surface. If procurement needs a certification report this quarter, that is a real constraint to weigh.

What to Check Before Your Agent Commits

The egress default cuts both ways. Outbound is open until you set at least one rule. Inbound is closed by default regardless. Decide the allowlist before the first untrusted run, not after an incident, and set it at create time or live.
The latency envelope has edges. Same-host resume lands under 0.7 s; a cross-host cold start runs 11 to 13 s. If your loop assumes an instant machine anywhere on demand, plan placement or keep state in a snapshot.
No GPU sandboxes. If the workload needs one, this is not the tool.
If code cannot leave your boundary, bring your own compute keeps the identical API on your machines, and the control plane and storage can be self-hosted entirely.

Frequently Asked Questions

What does an agent need installed before its first sandbox?

Node and one npm package, @nodeops-createos/sandbox, plus an API key you can create free at createos.sh. The createos sandbox CLI and the MCP server are optional surfaces over the same API, not extra requirements.

Is outbound network access locked down by default?

No. Outbound is open until you set at least one rule; once set, everything else is denied, and enforcement sits in the host kernel with eBPF, outside the guest. Inbound is closed by default regardless. Set rules at create time, live through the API, with the SDK's setEgress, or from the CLI.

How fast can an agent create and resume sandboxes?

A snapshot restore brings a sandbox back in tens of milliseconds, about 30 ms on an idle host, an idle-host figure and not an SLA. Pause takes about 1.4 s. Same-host resume lands under 0.7 s. A cross-host cold start runs 11 to 13 s.

Can the same SDK run on our own infrastructure?

Yes. Bring your own compute keeps the same API on customer machines, and bring your own bucket points sessions at your S3, R2, or MinIO. The control plane and storage can be self-hosted entirely when code cannot leave your boundary.

Conclusion

The one-package, one-key test is the right test because the agent is the one running it. CreateOS Sandbox passes it, and the package carries the combination your security review will ask about next: a kernel per machine, egress enforced in the host, pause and fork for state, and bring-your-own when the code cannot leave your cloud.

Install the package, create the key, and start free with 500 credits.

About CreateOS CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.