AIO Sandbox packages a browser, a shell, file operations, a VSCode Server, Jupyter, and Model Context Protocol (MCP) servers into one Docker container, giving an agent a single execution environment instead of several single-purpose ones. All components share a filesystem, so a file downloaded in the browser is immediately available to the shell, the file API, and the editor.
You start the container and reach everything through one HTTP API, with SDKs for Python, TypeScript, and Go. An optional API key protects the API, JupyterLab, and VNC, accepted as an X-AIO-API-Key header, an Authorization: Bearer header, or an api_key query parameter. Without it the services stay open. The container listens on all interfaces internally, so the documented examples bind the host side to loopback and put a reverse proxy or Ingress in front for cloud deployments.
The browser can be driven three ways: VNC for visual interaction, the Chrome DevTools Protocol for programmatic control, and MCP tools for higher-level automation. Python and Node.js code runs in isolated sandboxes, and port forwarding previews web applications started inside the container. Deployment examples cover Docker Compose and Kubernetes, and integration examples connect it to Browser Use, LangChain, the OpenAI SDK, and MiniMax's OpenAI-compatible endpoint.
Features
- Single container: browser, terminal, filesystem, VSCode Server, Jupyter, and MCP servers ship together with a shared filesystem
- One API surface: /v1/sandbox, /v1/shell/exec, /v1/file/read, /v1/file/write, /v1/browser/screenshot, and /v1/jupyter/execute cover the core operations
- SDKs: Python (agent-sandbox), TypeScript (@agent-infra/sandbox), and Go clients
- Preconfigured MCP servers: browser (navigate, screenshot, click, type, scroll), file (read, write, list, search, replace), shell (exec, createsession, kill), and markitdown (convert, extracttext, extract_images)
- Browser interfaces: VNC, the Chrome DevTools Protocol, and MCP tools all address the same browser
- Isolated code execution: Python and Node.js run in sandboxed interpreters inside the container
- Optional authentication: an API key gates the API, JupyterLab, and VNC through three accepted credential formats
- Deployment recipes: Docker Compose and Kubernetes manifests, plus a pinned mainland-China mirror image
