CreateOS Sandbox vs Declaw
Pick Declaw when you must show what agent code sends out, not only where it runs: its egress proxy redacts PII, scans for prompt injection, injects vault secrets and logs every request. Pick CreateOS Sandbox for sessions longer than Declaw's 72-hour Pro cap, lower per-vCPU rates, or forks that carry memory. Both isolate code in Firecracker microVMs.
Pricing at a Glance
CreateOS rates verified 17 October 2026. Declaw pricing as published on 17 October 2026. Rates billed per GB rather than per GiB, or as bundled sizes, are quoted as published rather than converted.
CreateOS Sandbox
Lower compute rate- Compute
- $0.0362 /vCPU-hr
- Memory
- $0.0116 /GiB-hr
Declaw
- Compute
- $0.0504 /vCPU-hr
- Memory
- See below
Declaw charges per second from a prepaid wallet: $0.0504 per vCPU-hour, $0.0162 per GB-hour of memory and $0.110 per GB-month of disk, plus $0.0001 to $0.0006 per ML guardrail scan, with paused time not billed and a $100 monthly minimum deposit on Pro, as of 17 October 2026.
Where CreateOS Sandbox Fits Better
What CreateOS Sandbox brings to this matchup, with a plain note on where Declaw has the edge.
No session cap, where Declaw ends sessions at 1 hour on Free and 72 hours on Pro.
Forks carry memory: a fork clones a paused sandbox's full snapshot. Declaw forks inherit the filesystem.
Lower compute rates: $0.03616363 per vCPU-hour and $0.01159025 per GiB-hour against Declaw's $0.0504 and $0.0162 per GB.
A certification to show auditors: CreateOS is SOC 2 Type II and ISO 27001 certified, with reports available under NDA. Declaw does not publish a held certification.
Where Declaw is strong
Declaw builds inspection into the sandbox: every outbound request passes a host-side proxy that can redact PII, scan for prompt injection, inject vault secrets the VM never sees, apply OPA/Rego policies, and write audit logs mapped to OWASP, NIST, MITRE and EU AI Act controls.
Which to Pick
Pick CreateOS Sandbox if
- Agent sessions run for more than 72 hours.
- You want forked copies to start with the parent's memory.
- You need a vendor with SOC 2 Type II and ISO 27001 reports today.
Pick Declaw if
- You must redact PII or scan for prompt injection in agent traffic.
- You need audit logs mapped to compliance frameworks.
- You sandbox stdio MCP servers and want their traffic inspected.
Head-to-Head Comparison
Every dimension side by side, checked on 17 October 2026 against each vendor's own docs and pricing pages. "Not published" means we could not find it on the vendor's pages, not that the feature is missing.
| Dimension | CreateOS Sandbox | Declaw |
|---|---|---|
| Isolation | Firecracker micro-VM with its own guest kernel | Firecracker microVM; outbound traffic routed through a host-side security proxy |
| Pause and resume | Saves disk, memory and CPU state; vCPU billing stops while paused, memory and storage still bill | Pause keeps in-memory state; paused time not billed |
| Fork | Fork a paused sandbox into many independent copies | Filesystem-level fork from a sandbox snapshot |
| Outbound network default | Open with no rules; deny-by-default once any host, IP, CIDR or wildcard rule exists, enforced on the host outside the VM | Open by default except metadata and private ranges; domain/CIDR rules, OPA/Rego, vault secrets |
| Inbound access | Closed by default; opt-in HTTPS URL | Authenticated reverse-proxy URL per HTTP port |
| Largest size | 8 vCPU / 16 GB on Enterprise; 8 / 8 on Pro, 4 / 4 on Beginner, 1 / 1 on Free | Free 4 vCPU / 4 GB; Pro 16 vCPU / 16 GB |
| Concurrency | 1 / 5 / 20 / 30 by plan (Free to Enterprise); paused sandboxes count | Free 25, Pro 500, Enterprise custom |
| Session length | No cap; optional idle auto-pause from 60 s to 24 h, off by default | Max 1 h Free, 72 h Pro, Enterprise custom |
| Billing | Per second: $0.03616363 per vCPU-hour, $0.01159025 per GiB-hour, storage $0.0001584 per GB-hour; no egress fees (50 GiB bandwidth budget per sandbox) | $0.0504 per vCPU-hour, $0.0162 per GB-hour; guardrail scans extra; paused time free |
| SDKs and interfaces | TypeScript, Go, Python, Rust, C#, Java (all but TypeScript pre-1.0), CLI, MCP, REST | Python, TypeScript and Go SDKs (open source), CLI, REST, MCP wrapper |
Common Questions
What does Declaw's security proxy add on top of egress rules?
It inspects content. Declaw's proxy can redact PII, scan for prompt injection, inject vault secrets and log each request. CreateOS egress rules decide which destinations a sandbox may reach, enforced on the host outside the VM, and CreateOS does not record commands or network traffic inside a sandbox.
Is paused time billed on Declaw and on CreateOS?
Declaw does not bill paused time. CreateOS stops vCPU billing while a sandbox is paused but keeps charging memory and storage, since the full memory image is kept so the sandbox can resume where it stopped.
How long can a Declaw session last?
Up to 1 hour on Free and 72 hours on Pro, with custom limits on Enterprise; the server destroys the sandbox at its timeout. CreateOS has no session cap, and its optional idle auto-pause saves state rather than deleting it.
Can Declaw run on-prem?
Yes, through enterprise on-prem or BYOC installs operated by the Declaw team, not self-service. CreateOS works the same way here: self-hosting and BYOC are for enterprise customers only and are onboarded by our team.
Sources
Checked 17 October 2026.
See CreateOS Sandbox for yourself
Book a demo, or explore the Sandbox and its pricing.