strands-agents/box
Run AI agents in a sandbox that restricts what they can execute, read, write, and reach on the network. Box combines OS isolation with default-deny Dogwood policies and credential injection that keeps secrets outside the agent. Written in Rust. Supports macOS on Apple silicon, with Linux support planned.
Older snapshot: check the original source for current information.
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
Strands Box An open source sandbox engine for AI agents. Strands Box is an open source sandbox for AI agents. It combines operating-system isolation with semantic policies written in Dogwood, so you can control what agents can access and the conditions under which they can act. Box is harness-agnostic. You choose the agent program or binary to run, configure its access in box.toml, and write its policies in policy.dw. The host OS enforces the direct access restrictions in box.toml. Strands Shell, Monty for Python, the egress gateway, and the MCP broker send the operations they handle to the embedded Dogwood Local Engine, which evaluates the rules in policy.dw. Box enforces its allow or deny decisions outside the agent process. Dogwood uses permit and forbid rules. Operations checked by the engine are denied by default: a matching permit must allow the operation, and a matching forbid overrides that permission. Box's interpreters…
Read the full README ↗ · Preview checked 2026-10-28T12:37:56.972Z
Inside the original README — Document outline
- Overview
- Key capabilities
- Use Box as a Rust library
- Architecture
- Getting started
- Change what the box allows
- Examples
- Build from source
- Documentation
- Reporting a problem
- License
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Links from the README
References supplied by the publisher, not independently verified endorsements. Check the destination before downloading files or entering credentials.
Documentation belongs to its respective authors. Reported project/model license: Apache-2.0. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
Run AI agents in a sandbox that restricts what they can execute, read, write, and reach on the network. Box combines OS isolation with default-deny Dogwood policies and credential injection that keeps secrets outside the agent. Written in Rust. Supports macOS on Apple silicon, with Linux support planned.
Repository facts
- Owner
- strands-agents
- Primary language
- Rust
- Stars
- 266
- Forks
- 10
- Open issues + pull requests
- 23
- License
- Apache-2.0
- Archived
- No
- Default branch
- main
- Created
- 2026-10-02T20:34:08.000Z
- Last push
- 2026-10-09T04:04:49.000Z
Topics and intended use
Owner-supplied topics: agentic-ai, agents, ai, ai-agents, ai-safety, containment, egress, harness, linux, llm, macos, mcp, policy, rust, sandbox, sandboxing, seatbelt, security, strands-agents, zero-trust
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-10-09T12:06:54.953Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.