AIO Sandbox packages a browser, a shell, file operations, a VSCode Server, Jupyter, and Model Context Protocol (MCP) servers into one Docker container, giving an agent a single execution environment instead of several single-purpose ones. All components share a filesystem, so a file downloaded in the browser is immediately available to the shell, the file API, and the editor.
You start the container and reach everything through one HTTP API on port 8080, with SDKs for Python, TypeScript, and Go. Setting SANDBOXAPIKEY protects the API, JupyterLab, and VNC, accepted as an X-AIO-API-Key header, an Authorization: Bearer header, or an api_key query parameter; without that variable the services stay open. The container listens on 0.0.0.0 internally, so the documented examples bind the host side to 127.0.0.1 and put a reverse proxy or Ingress in front for cloud deployments.
The browser can be driven three ways: VNC for visual interaction, the Chrome DevTools Protocol for programmatic control, and MCP tools for higher-level automation. Python and Node.js code runs in isolated sandboxes, and port forwarding previews web applications started inside the container. Deployment examples cover Docker Compose and Kubernetes, and integration examples connect it to Browser Use, LangChain, the OpenAI SDK, and MiniMax's OpenAI-compatible endpoint.
Features
- Single container: browser, terminal, filesystem, VSCode Server, Jupyter, and MCP servers ship together with a shared filesystem
- One API surface: /v1/sandbox, /v1/shell/exec, /v1/file/read, /v1/file/write, /v1/browser/screenshot, and /v1/jupyter/execute cover the core operations
- SDKs: Python (agent-sandbox), TypeScript (@agent-infra/sandbox), and Go clients
- Preconfigured MCP servers: browser (navigate, screenshot, click, type, scroll), file (read, write, list, search, replace), shell (exec, createsession, kill), and markitdown (convert, extracttext, extract_images)
- Browser interfaces: VNC, the Chrome DevTools Protocol, and MCP tools all address the same browser
- Isolated code execution: Python and Node.js run in sandboxed interpreters inside the container
- Optional authentication: SANDBOXAPIKEY gates the API, JupyterLab, and VNC through three accepted credential formats
- Deployment recipes: Docker Compose and Kubernetes manifests, plus a pinned mainland-China mirror image
