Overview
Run coding agents in a sandbox with governed access to credentials, network, files, and tools
Stashbase runs coding agents such as Claude Code and Codex inside a sandbox: a native OS sandbox or an isolated Docker container. An agent profile decides what the agent can reach: which credentials, hosts, files, MCP tools, and dependencies.
The agent never sees secret values: it gets placeholders that work only for approved requests. See how it works.
Quick start
Create a profile with stashbase agent init and run your first sandboxed agent.
Credentials
Give agents placeholders that work only for approved hosts.
Docker sandbox
Run the agent in an isolated container instead of the native sandbox.
Protect files
Keep .env files, keys, and other sensitive paths out of reach.
Control MCP tools
Choose which tools an agent can discover and call on each server.
Check dependencies
Check packages before the agent installs them.
Environment schema
Show agents which secrets exist without exposing values.
Sessions and logs
See what each agent requested and which policy allowed or blocked it.
The full Agents guide covers setup, profile configuration, supported tools, and the security boundary.