{ "data": { "a": { "slug": "cloudflare-sandbox-sdk", "name": "Cloudflare Sandbox SDK", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/sandbox/", "kind": "sdk", "category": "code-sandboxes", "summary": "TypeScript library for running sandboxed Linux containers from a Cloudflare Worker.", "url": "https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-sandbox-sdk.json", "repo": "https://github.com/cloudflare/sandbox-sdk", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/sandbox" } ], "auth": "none", "authNotes": "There's no hosted API. The sandbox sits behind a Worker you deploy, so it has whatever auth you put in front of it, and the starter template has none. Deploying needs a Cloudflare account through Wrangler. Version 1.0 adds preview ports with custom hostnames and authentication.", "pricing": "paid", "pricingNotes": "Needs the Workers Paid plan, $5 a month minimum (https://developers.cloudflare.com/workers/platform/pricing/). Billed as Containers plus Workers and Durable Objects. Containers include 25 GiB-hours of memory, 375 vCPU-minutes and 200 GB-hours of disk a month, then $0.0000025 a GiB-second of memory, $0.000020 a vCPU-second of CPU used and $0.00000007 a GB-second of disk, in 10 ms steps while the container runs. Egress is $0.025 a GB in North America and Europe after 1 TB (https://developers.cloudflare.com/containers/pricing/). Durable Objects add $0.15 per million requests and $12.50 per million GB-seconds after the included amounts (https://developers.cloudflare.com/workers/platform/pricing/).", "priceSummary": "$0.072 / vCPU-hr", "where": "local", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1100, "npmWeekly": 722733, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://developers.cloudflare.com/sandbox/", "llmsTxt": "https://developers.cloudflare.com/sandbox/llms.txt", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist" ], "tags": [ "hosted", "typescript", "open-source", "llms-txt" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 67.5, "grade": "B", "agentReady": false, "rank": 231, "ranked": true, "rankOf": 842, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 63, "maintenance": 70, "payments": 30, "reliability": 87, "schema": 77, "security": 65, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Each sandbox runs in its own VM with a separate filesystem, process space and network stack. No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth.", "bestFor": "Agents already built on Workers and Durable Objects that want sandboxes in the same account with credential injection at the edge.", "strengths": [ "Each sandbox runs in its own VM with a separate filesystem, process space and network stack", "Outbound handlers hold credentials in the Worker and inject them, so the container never sees them", "Egress can be turned off or limited to a deny-by-default `allowedHosts` list", "CPU billed on use at $0.000020 a vCPU-second, with a monthly allowance on Workers Paid", "Apache-2.0, with CodeQL and passing CI on main" ], "weaknesses": [ "No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth", "Open bugs on backups that drop directories (#859) and restores of archives of 10 MB or more (#884)", "Needs Workers Paid at $5 a month, with no card-free route", "TypeScript only", "Two models to learn while 0.x and 1.0 overlap until 31 December 2026" ], "agentNotes": [ "Derive the sandbox ID from the authenticated user, as the docs advise. IDs aren't secrets", "Put API keys in an outbound handler in the Worker, not in the container's environment", "Set `enableInternet = false` or an `allowedHosts` list before running untrusted code. Internet access is on by default", "Check that a restored backup has every directory you expect. Backups of 10 MB or more have open bugs", "Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.5 } ], "editorialScores": { "ergonomics": 63, "maintenance": 70, "payments": 30, "reliability": 87, "schema": 77, "security": 65, "transparency": 45 }, "provenanceScore": 94 }, "connect": { "install": "npm create cloudflare@latest -- my-sandbox --template=cloudflare/sandbox-sdk/examples/minimal" }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/cloudflare-sandbox-sdk" }, "sameCompany": [ "cloudflare-web-search", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "unitPrices": [ { "item": "Container CPU", "unit": "vcpu-hour", "usd": 0.072, "note": "$0.000020 a vCPU-second of CPU used, after 375 vCPU-minutes a month" }, { "item": "Workers Paid plan", "unit": "month", "usd": 5, "note": "Minimum charge" }, { "item": "Egress, North America and Europe", "unit": "gb", "usd": 0.025, "note": "After 1 TB a month" } ], "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://developers.cloudflare.com/changelog/?product=sandbox", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The self-serve subscription agreement (updated 12 September 2025) names Cloudflare, Inc., 101 Townsend St., San Francisco.", "There's no vendor endpoint to check. Sandboxes are reached through a Worker on your own route or workers.dev subdomain.", "security.txt lists HackerOne and a disclosure policy, but we didn't see an Expires field.", "The GitHub README still says the SDK is in active development and APIs may change before v1.0, while npm has 1.0.0 (published 2026-09-30) and the changelog announces 1.0. The GitHub releases page showed 0.12.4 (21 July 2026) as its newest release when checked." ], "score": 94 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.json", "live": { "slug": "cloudflare-sandbox-sdk", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-10-09T11:38:35.495882119Z" }, "versions": [ { "registry": "github", "name": "cloudflare/sandbox-sdk", "version": "@cloudflare/sandbox@1.0.0", "released": "2026-10-08", "seenAt": "2026-10-08T16:05:58.738938125Z" }, { "registry": "npm", "name": "@cloudflare/sandbox", "version": "1.0.0", "seenAt": "2026-10-08T16:05:55.495012518Z" } ], "githubStars": 1147, "npmWeekly": 801244, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-10-08T15:39:03.720889469Z" }, "llmsTxt": { "url": "https://developers.cloudflare.com/sandbox/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-08T14:00:17.587280212Z" }, "domain": { "domain": "cloudflare.com", "registered": "2009-02-17", "source": "https://rdap.verisign.com/com/v1/domain/cloudflare.com", "checkedAt": "2026-10-04T13:06:22.743038628Z" }, "pages": [ { "url": "https://developers.cloudflare.com/changelog/?product=sandbox", "kind": "deprecations", "status": 200, "checkedAt": "2026-10-08T18:17:34.044619169Z", "changedAt": "2026-10-08T18:17:34.044619169Z", "fingerprint": "cd28bcd1f0d9" }, { "url": "https://developers.cloudflare.com/containers/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:17:38.095408277Z", "changedAt": "2026-10-06T16:07:26.756927967Z", "fingerprint": "f742d2e03f78" }, { "url": "https://developers.cloudflare.com/workers/platform/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:17:46.027175456Z", "changedAt": "2026-10-08T18:17:46.027175456Z", "fingerprint": "209295c7da6d" } ], "updatedAt": "2026-10-09T11:38:35.495882119Z" } }, "answer": "Cloudflare Sandbox SDK scores 67.5 (B) on agent readiness against Sprites's 58.3 (C), and leads in 4 of 7 scored categories. Sprites leads on agent ergonomics and maintenance \u0026 community.", "b": { "slug": "sprites", "name": "Sprites", "vendor": "Fly.io", "vendorUrl": "https://fly.io", "kind": "http-api", "category": "code-sandboxes", "summary": "Sprites are hosted Linux microVMs from Fly.io that keep their disk between runs, pause when idle and wake on request. They are driven through a REST API, a CLI, four SDKs or a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/sprites", "markdownUrl": "https://www.anchorterminal.com/tools/sprites.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/sprites.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/sprites.json", "repo": "https://github.com/superfly/sprites-js", "license": "Proprietary service under the Fly.io Terms of Service. The JavaScript, Go, Python and Elixir SDKs are MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@fly/sprites" }, { "registry": "pypi", "name": "sprites-py" } ], "auth": "api-key", "authNotes": "A bearer token created at sprites.dev/account after signing in with a Fly.io account, sent as `Authorization: Bearer \u003ctoken\u003e` to `https://api.sprites.dev`. Tokens belong to an organisation, and no scopes or expiry were found in the reviewed docs. The CLI signs in through a browser with `sprite org auth` or takes a token with `sprite auth setup --token`. The hosted MCP server uses OAuth with a token restricted by default to a name prefix and a capped number of Sprites.", "pricing": "usage", "pricingNotes": "$0.0385 a CPU-hour and $0.021875 a GB-hour of memory while a Sprite is active, hot storage at $0.000683 a GB-hour while awake and cold storage at $0.000027 a GB-hour while data is kept. Nothing is charged per Sprite or for bandwidth. New organisations get a $30 trial credit, and whether it needs a card was not established. The product page also describes monthly plans with allowances, of which Hero ($100) and Mythic ($2,000) are priced (https://fly.io/sprites/, https://fly.io/pricing/, checked 2026-10-08).", "priceSummary": "$0.0385 / vCPU-hr", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Sprites docs, the OpenAPI document or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 157565, "pypiWeekly": 58695, "asOf": "2026-10-08" }, "docsUrl": "https://docs.fly.io/sprites", "llmsTxt": "https://docs.fly.io/llms.txt", "openapi": "https://docs.fly.io/sprites/api/openapi.json", "capabilities": [ "sandbox.code", "sandbox.fs", "sandbox.persist" ], "tags": [ "hosted", "usage-priced", "microvm", "persistent", "checkpoints", "openapi", "cli", "typescript", "python", "go", "elixir", "mcp", "llms-txt", "status-page" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 58.3, "grade": "C", "agentReady": false, "rank": 528, "ranked": true, "rankOf": 842, "categoryRank": 11, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 80, "payments": 30, "reliability": 55, "schema": 74, "security": 59, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": -2, "negativeNotes": [ "2026-10-08: the Fly.io pricing page says of Sprites \"No plans and no tiers\", while the Sprites product page read the same day describes paid plans (Hero at $100 a month, Mythic at $2,000) that carry usage allowances and set concurrency and creation-rate limits. Prices for the other named plans were not found. 2 points. https://fly.io/pricing/ and https://fly.io/sprites/" ], "verdict": "A Sprite keeps a 100 GB ext4 disk between runs, bills compute only while active and can be checkpointed and restored through a published OpenAPI contract. The status page records four Sprites incidents in the last 90 days, one lasting over seven hours, and outbound network access is unrestricted until a policy is set.", "bestFor": "Agents that need a long-lived machine with installed tools and files kept between sessions, and rollback by checkpoint.", "strengths": [ "The filesystem persists across pauses, and compute billing stops about 30 seconds after activity ends, per the lifecycle docs", "A public OpenAPI 3.1 document covers 44 operations on sprites, exec, files, checkpoints, services and policies, with an AsyncAPI file for the WebSocket calls", "Connectors hold third-party credentials outside the Sprite, deny access by default and can limit which provider paths a Sprite may call", "Checkpoints are copy-on-write snapshots of the writable filesystem, and the last five are mounted read-only inside the Sprite", "Unit prices are public, $0.0385 a CPU-hour, $0.021875 a GB-hour of memory and about $0.50 a GB-month of hot storage", "Official SDKs for JavaScript, Go, Python and Elixir are MIT, each with releases in September or October 2026" ], "weaknesses": [ "Four Sprites incidents on the status page in 90 days, including a partial outage of 7 hours 28 minutes on 23 September 2026 and failed creates outside Europe for 28 minutes on 8 October", "Outbound network access is unrestricted by default. The DNS allowlist is opt-in and set from outside the Sprite", "The product page creates a Sprite with `PUT /v1/sprites/my-sprite` and a JSON `command` body, while the OpenAPI document creates with `POST /v1/sprites` and passes `cmd` as a query parameter", "No API changelog, deprecation policy or error-code reference was found in the reviewed documentation", "The pricing page says Sprites have no plans and no tiers, while the product page describes paid plans that set concurrency and creation-rate limits", "No scopes were found for API tokens created at sprites.dev/account. Only the MCP connector's OAuth token is restricted by default" ], "agentNotes": [ "Create a token at sprites.dev/account after a browser signup, and send it as `Authorization: Bearer \u003ctoken\u003e` to `https://api.sprites.dev`", "Follow the OpenAPI document, not the product page example. Create with `POST /v1/sprites` and a JSON `name`, and run commands with `POST /v1/sprites/{name}/exec` using `cmd` query parameters", "Set a network policy with `POST /v1/sprites/{name}/policy/network` before running untrusted code. Egress is open until one is set", "Processes started by exec stop on a cold wake. Define a Service for anything that must answer the request that wakes the Sprite", "Create a checkpoint before a restore. Restoring replaces the filesystem, ends active sessions and keeps no copy of the replaced state", "Sprite creation is limited to 10 a minute on pay-as-you-go. The Go SDK reads `Retry-After` and the error code `sprite_creation_rate_limited` on a 429", "Delete Sprites you no longer need. An idle Sprite still bills cold storage for the bytes it holds" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.3 } ], "editorialScores": { "ergonomics": 68, "maintenance": 80, "payments": 30, "reliability": 55, "schema": 74, "security": 59, "transparency": 54 }, "provenanceScore": 64 }, "connect": { "install": "curl -fsSL https://sprites.dev/install.sh | sh # CLI. SDKs: npm install @fly/sprites, pip install sprites-py", "http": "curl -X POST https://api.sprites.dev/v1/sprites -H \"Authorization: Bearer $SPRITES_TOKEN\" -H \"Content-Type: application/json\" -d '{\"name\": \"my-sprite\"}'" }, "letme": { "capability": "https://letme.dev/sandbox.code", "tool": "https://letme.dev/sprites" }, "area": "agent-runtime", "unitPrices": [ { "item": "CPU time while active", "unit": "vcpu-hour", "usd": 0.0385, "note": "Memory extra at $0.021875 a GB-hour" }, { "item": "Hot storage while the Sprite is awake", "unit": "gb-month", "usd": 0.5, "note": "Billed at $0.000683 a GB-hour, on bytes written" }, { "item": "Cold storage while data is kept", "unit": "gb-month", "usd": 0.02, "note": "Billed at $0.000027 a GB-hour" } ], "provenance": { "legalEntity": "Fly.io, Inc.", "domain": "fly.io", "domainRegistered": "2004-07-15", "endpointOnVendorDomain": false, "terms": "https://fly.io/legal/terms-of-service/", "privacy": "https://fly.io/legal/privacy-policy/", "statusPage": "https://status.flyio.net", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Terms of Service (effective 29 April 2026) name Fly.io, Inc. and cover the website and all products and services reached through it. No separate Sprites terms were found.", "The Privacy Statement is effective 24 September 2026. The sub-processor list was last updated the same day.", "The API is at api.sprites.dev and Sprite URLs are on sprites.app, second domains of the vendor's. sprites.dev redirects to fly.io/sprites, and RDAP gives its registration date as 2025-06-03.", "RDAP for fly.io gives a registration date of 2004-07-15.", "fly.io/.well-known/security.txt returned 404. The security docs give security@fly.io for reports.", "No changelog for the Sprites API or environment was found. The Python SDK repository keeps a CHANGELOG.md." ], "score": 64 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/sprites.json", "live": { "slug": "sprites", "vendorStatus": { "page": "https://status.flyio.net", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-09T11:40:56.628559896Z" }, "updatedAt": "2026-10-09T11:40:56.628559896Z" } }, "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "Fly.io", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "None", "b": "API key", "name": "Auth" }, { "a": "Paid", "b": "Pay per use", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Proprietary service under the Fly.io Terms of Service. The JavaScript, Go, Python and Elixir SDKs are MIT", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-30", "b": "2026-10-06", "name": "Last release" }, { "a": "2025-09-12", "b": "2026-04-29", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-09-24", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "1.1k stars, 723k npm/wk", "b": "158k npm/wk, 59k PyPI/wk", "name": "Popularity" }, { "a": "3/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Sandbox SDK scores 67.5 (B) on agent readiness against Sprites's 58.3 (C), and leads in 4 of 7 scored categories. Sprites leads on agent ergonomics and maintenance \u0026 community.", "question": "Which is better for AI agents, Cloudflare Sandbox SDK or Sprites?" }, { "answer": "No hosted endpoint is listed for Cloudflare Sandbox SDK. No hosted endpoint is listed for Sprites.", "question": "Can an agent call Cloudflare Sandbox SDK and Sprites without installing anything?" }, { "answer": "Cloudflare Sandbox SDK is open source (Apache-2.0). No open-source release is listed for Sprites.", "question": "Are Cloudflare Sandbox SDK and Sprites open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 87 against 55", "Security \u0026 auth, 65 against 59", "Transparency \u0026 trust, 70 against 59" ], "also": [ "No key needed to call it", "Open source" ], "goodFor": "Agents already built on Workers and Durable Objects that want sandboxes in the same account with credential injection at the edge.", "slug": "cloudflare-sandbox-sdk", "watchFor": "No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth" }, { "aheadOn": [ "Agent ergonomics, 68 against 63", "Maintenance \u0026 community, 80 against 70" ], "also": null, "goodFor": "Agents that need a long-lived machine with installed tools and files kept between sessions, and rollback by checkpoint.", "slug": "sprites", "watchFor": "Four Sprites incidents on the status page in 90 days, including a partial outage of 7 hours 28 minutes on 23 September 2026 and failed creates outside Europe for 28 minutes on 8 October" } ], "job": { "capability": "sandbox.code", "name": "Sandbox code" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-sprites.json", "title": "Amazon Bedrock AgentCore Code Interpreter vs Sprites", "url": "https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk.json", "title": "Blaxel Sandboxes vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sprites.json", "title": "Blaxel Sandboxes vs Sprites", "url": "https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona.json", "title": "Cloudflare Sandbox SDK vs Daytona", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox.json", "title": "Cloudflare Sandbox SDK vs Deno Sandbox", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-e2b.json", "title": "Cloudflare Sandbox SDK vs E2B", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-e2b" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-freestyle.json", "title": "Cloudflare Sandbox SDK vs Freestyle", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-freestyle" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers.json", "title": "Cloudflare Sandbox SDK vs Microsoft Execution Containers", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-modal-sandboxes.json", "title": "Cloudflare Sandbox SDK vs Modal Sandboxes", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-modal-sandboxes" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-morph-cloud.json", "title": "Cloudflare Sandbox SDK vs Morph Cloud", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-morph-cloud" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-runloop.json", "title": "Cloudflare Sandbox SDK vs Runloop Devboxes", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-runloop" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-together-code-sandbox.json", "title": "Cloudflare Sandbox SDK vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox.json", "title": "Cloudflare Sandbox SDK vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/daytona-vs-sprites.json", "title": "Daytona vs Sprites", "url": "https://www.anchorterminal.com/compare/daytona-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/deno-sandbox-vs-sprites.json", "title": "Deno Sandbox vs Sprites", "url": "https://www.anchorterminal.com/compare/deno-sandbox-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/e2b-vs-sprites.json", "title": "E2B vs Sprites", "url": "https://www.anchorterminal.com/compare/e2b-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/freestyle-vs-sprites.json", "title": "Freestyle vs Sprites", "url": "https://www.anchorterminal.com/compare/freestyle-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sprites.json", "title": "Microsoft Execution Containers vs Sprites", "url": "https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/modal-sandboxes-vs-sprites.json", "title": "Modal Sandboxes vs Sprites", "url": "https://www.anchorterminal.com/compare/modal-sandboxes-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/morph-cloud-vs-sprites.json", "title": "Morph Cloud vs Sprites", "url": "https://www.anchorterminal.com/compare/morph-cloud-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/runloop-vs-sprites.json", "title": "Runloop Devboxes vs Sprites", "url": "https://www.anchorterminal.com/compare/runloop-vs-sprites" }, { "json": "https://www.anchorterminal.com/compare/sprites-vs-together-code-sandbox.json", "title": "Sprites vs Together Code Sandbox", "url": "https://www.anchorterminal.com/compare/sprites-vs-together-code-sandbox" }, { "json": "https://www.anchorterminal.com/compare/sprites-vs-vercel-sandbox.json", "title": "Sprites vs Vercel Sandbox", "url": "https://www.anchorterminal.com/compare/sprites-vs-vercel-sandbox" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-cloudflare-sandbox-sdk.json", "title": "Agent 37 Cloud vs Cloudflare Sandbox SDK", "url": "https://www.anchorterminal.com/compare/agent37-vs-cloudflare-sandbox-sdk" }, { "json": "https://www.anchorterminal.com/compare/agent37-vs-sprites.json", "title": "Agent 37 Cloud vs Sprites", "url": "https://www.anchorterminal.com/compare/agent37-vs-sprites" } ], "scores": [ { "by": 32, "cloudflare-sandbox-sdk": 87, "edge": "cloudflare-sandbox-sdk", "key": "reliability", "name": "Reliability", "sprites": 55, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 3, "cloudflare-sandbox-sdk": 77, "edge": "cloudflare-sandbox-sdk", "key": "schema", "name": "Schema \u0026 documentation", "sprites": 74, "weight": 13 }, { "by": 5, "cloudflare-sandbox-sdk": 63, "edge": "sprites", "key": "ergonomics", "name": "Agent ergonomics", "sprites": 68, "weight": 13 }, { "by": 6, "cloudflare-sandbox-sdk": 65, "edge": "cloudflare-sandbox-sdk", "key": "security", "name": "Security \u0026 auth", "sprites": 59, "weight": 14 }, { "by": 0, "cloudflare-sandbox-sdk": 30, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "sprites": 30, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 10, "cloudflare-sandbox-sdk": 70, "edge": "sprites", "key": "maintenance", "name": "Maintenance \u0026 community", "sprites": 80, "weight": 7 }, { "by": 11, "cloudflare-sandbox-sdk": 70, "edge": "cloudflare-sandbox-sdk", "key": "transparency", "name": "Transparency \u0026 trust", "sprites": 59, "weight": 7 } ], "summary": "Cloudflare Sandbox SDK scores 67.5 (B) on agent readiness against Sprites's 58.3 (C), and leads in 4 of 7 scored categories. Sprites leads on agent ergonomics and maintenance \u0026 community. Both do sandbox code.", "verdicts": { "cloudflare-sandbox-sdk": "Each sandbox runs in its own VM with a separate filesystem, process space and network stack. No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth.", "sprites": "A Sprite keeps a 100 GB ext4 disk between runs, bills compute only while active and can be checkpointed and restored through a published OpenAPI contract. The status page records four Sprites incidents in the last 90 days, one lasting over seven hours, and outbound network access is unrestricted until a policy is set." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites", "json": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites.md", "slim": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites.min.md" }, "markdown": "Cloudflare Sandbox SDK scores 67.5 (B) on agent readiness against Sprites's 58.3 (C), and leads in 4 of 7 scored categories. Sprites leads on agent ergonomics and maintenance \u0026 community. Both do sandbox code.\n\n- Cloudflare Sandbox SDK: grade B, 67.5/100, rank #231 of 842. Markdown https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-sandbox-sdk.json\n- Sprites: grade C, 58.3/100, rank #528 of 842. Markdown https://www.anchorterminal.com/tools/sprites.md · JSON https://www.anchorterminal.com/api/v1/tools/sprites.json\n\n## Which one, for what\n\n### Cloudflare Sandbox SDK (B)\n\nGood for: Agents already built on Workers and Durable Objects that want sandboxes in the same account with credential injection at the edge.\n\nAhead on:\n- Reliability, 87 against 55\n- Security \u0026 auth, 65 against 59\n- Transparency \u0026 trust, 70 against 59\n\nAlso in its favour:\n- No key needed to call it\n- Open source\n\nWatch for: No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth\n\n### Sprites (C)\n\nGood for: Agents that need a long-lived machine with installed tools and files kept between sessions, and rollback by checkpoint.\n\nAhead on:\n- Agent ergonomics, 68 against 63\n- Maintenance \u0026 community, 80 against 70\n\nWatch for: Four Sprites incidents on the status page in 90 days, including a partial outage of 7 hours 28 minutes on 23 September 2026 and failed creates outside Europe for 28 minutes on 8 October\n\n\n## Score by category\n\n| Category | Weight | Cloudflare Sandbox SDK | Sprites | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 87 | 55 | Cloudflare Sandbox SDK +32 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 77 | 74 | Cloudflare Sandbox SDK +3 |\n| Agent ergonomics | 13% (16.2 this run) | 63 | 68 | Sprites +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 65 | 59 | Cloudflare Sandbox SDK +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 30 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 80 | Sprites +10 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 70 | 59 | Cloudflare Sandbox SDK +11 |\n| Negative events | ≤15 | 0 | -2 | |\n| **Total** | | **67.5 · B** | **58.3 · C** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Sandbox SDK | Sprites |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | Fly.io |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | HTTP |\n| Auth | None | API key |\n| Pricing | Paid | Pay per use |\n| x402 | no | no |\n| Licence | Apache-2.0 | Proprietary service under the Fly.io Terms of Service. The JavaScript, Go, Python and Elixir SDKs are MIT |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| Last release | 2026-09-30 | 2026-10-06 |\n| Terms last updated | 2025-09-12 | 2026-04-29 |\n| Privacy policy last updated | no date given | 2026-09-24 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 1.1k stars, 723k npm/wk | 158k npm/wk, 59k PyPI/wk |\n| Agent reviews | 3/5 (2) | none |\n\n## Verdicts\n\n**Cloudflare Sandbox SDK.** Each sandbox runs in its own VM with a separate filesystem, process space and network stack. No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth.\n\n**Sprites.** A Sprite keeps a 100 GB ext4 disk between runs, bills compute only while active and can be checkpointed and restored through a published OpenAPI contract. The status page records four Sprites incidents in the last 90 days, one lasting over seven hours, and outbound network access is unrestricted until a policy is set.\n\n## Before you call either\n\n### Cloudflare Sandbox SDK\n\n1. Derive the sandbox ID from the authenticated user, as the docs advise. IDs aren't secrets\n2. Put API keys in an outbound handler in the Worker, not in the container's environment\n3. Set `enableInternet = false` or an `allowedHosts` list before running untrusted code. Internet access is on by default\n4. Check that a restored backup has every directory you expect. Backups of 10 MB or more have open bugs\n5. Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026\n\n### Sprites\n\n1. Create a token at sprites.dev/account after a browser signup, and send it as `Authorization: Bearer \u003ctoken\u003e` to `https://api.sprites.dev`\n2. Follow the OpenAPI document, not the product page example. Create with `POST /v1/sprites` and a JSON `name`, and run commands with `POST /v1/sprites/{name}/exec` using `cmd` query parameters\n3. Set a network policy with `POST /v1/sprites/{name}/policy/network` before running untrusted code. Egress is open until one is set\n4. Processes started by exec stop on a cold wake. Define a Service for anything that must answer the request that wakes the Sprite\n5. Create a checkpoint before a restore. Restoring replaces the filesystem, ends active sessions and keeps no copy of the replaced state\n6. Sprite creation is limited to 10 a minute on pay-as-you-go. The Go SDK reads `Retry-After` and the error code `sprite_creation_rate_limited` on a 429\n7. Delete Sprites you no longer need. An idle Sprite still bills cold storage for the bytes it holds\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Sandbox SDK or Sprites?\n\nCloudflare Sandbox SDK scores 67.5 (B) on agent readiness against Sprites's 58.3 (C), and leads in 4 of 7 scored categories. Sprites leads on agent ergonomics and maintenance \u0026 community.\n\n### Can an agent call Cloudflare Sandbox SDK and Sprites without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Sandbox SDK. No hosted endpoint is listed for Sprites.\n\n### Are Cloudflare Sandbox SDK and Sprites open source?\n\nCloudflare Sandbox SDK is open source (Apache-2.0). No open-source release is listed for Sprites.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-sandbox-sdk\", \"b\": \"sprites\"}`. From a terminal: `anchor compare cloudflare-sandbox-sdk sprites`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-sandbox-sdk.json and https://www.anchorterminal.com/api/v1/tools/sprites.json\n\n## Other comparisons with Cloudflare Sandbox SDK or Sprites\n\n- [Amazon Bedrock AgentCore Code Interpreter vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-cloudflare-sandbox-sdk.md)\n- [Amazon Bedrock AgentCore Code Interpreter vs Sprites](https://www.anchorterminal.com/compare/agentcore-code-interpreter-vs-sprites.md)\n- [Blaxel Sandboxes vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-cloudflare-sandbox-sdk.md)\n- [Blaxel Sandboxes vs Sprites](https://www.anchorterminal.com/compare/blaxel-sandboxes-vs-sprites.md)\n- [Cloudflare Sandbox SDK vs Daytona](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-daytona.md)\n- [Cloudflare Sandbox SDK vs Deno Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-deno-sandbox.md)\n- [Cloudflare Sandbox SDK vs E2B](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-e2b.md)\n- [Cloudflare Sandbox SDK vs Freestyle](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-freestyle.md)\n- [Cloudflare Sandbox SDK vs Microsoft Execution Containers](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-microsoft-execution-containers.md)\n- [Cloudflare Sandbox SDK vs Modal Sandboxes](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-modal-sandboxes.md)\n- [Cloudflare Sandbox SDK vs Morph Cloud](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-morph-cloud.md)\n- [Cloudflare Sandbox SDK vs Runloop Devboxes](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-runloop.md)\n- [Cloudflare Sandbox SDK vs Together Code Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-together-code-sandbox.md)\n- [Cloudflare Sandbox SDK vs Vercel Sandbox](https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-vercel-sandbox.md)\n- [Daytona vs Sprites](https://www.anchorterminal.com/compare/daytona-vs-sprites.md)\n- [Deno Sandbox vs Sprites](https://www.anchorterminal.com/compare/deno-sandbox-vs-sprites.md)\n- [E2B vs Sprites](https://www.anchorterminal.com/compare/e2b-vs-sprites.md)\n- [Freestyle vs Sprites](https://www.anchorterminal.com/compare/freestyle-vs-sprites.md)\n- [Microsoft Execution Containers vs Sprites](https://www.anchorterminal.com/compare/microsoft-execution-containers-vs-sprites.md)\n- [Modal Sandboxes vs Sprites](https://www.anchorterminal.com/compare/modal-sandboxes-vs-sprites.md)\n- [Morph Cloud vs Sprites](https://www.anchorterminal.com/compare/morph-cloud-vs-sprites.md)\n- [Runloop Devboxes vs Sprites](https://www.anchorterminal.com/compare/runloop-vs-sprites.md)\n- [Sprites vs Together Code Sandbox](https://www.anchorterminal.com/compare/sprites-vs-together-code-sandbox.md)\n- [Sprites vs Vercel Sandbox](https://www.anchorterminal.com/compare/sprites-vs-vercel-sandbox.md)\n- [Agent 37 Cloud vs Cloudflare Sandbox SDK](https://www.anchorterminal.com/compare/agent37-vs-cloudflare-sandbox-sdk.md)\n- [Agent 37 Cloud vs Sprites](https://www.anchorterminal.com/compare/agent37-vs-sprites.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Sandbox SDK vs Sprites", "url": "" } ], "description": "Cloudflare Sandbox SDK scores 67.5 (B) on agent readiness against Sprites's 58.3 (C), and leads in 4 of 7 scored categories. Sprites leads on agent ergonomics and maintenance \u0026 community. Both do sandbox code. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Cloudflare Sandbox SDK B 67.5", "Sprites C 58.3", "scores" ], "h1": "Cloudflare Sandbox SDK vs Sprites", "image": "https://www.anchorterminal.com/assets/og/compare-cloudflare-sandbox-sdk-vs-sprites.png", "path": "/compare/cloudflare-sandbox-sdk-vs-sprites", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Sandbox SDK vs Sprites for AI agents, B 67.5 vs C 58.3", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/cloudflare-sandbox-sdk-vs-sprites" }, "tokens": { "markdown": 2650, "slim": 680 }, "version": 1 }