# DeltaBox Lite (slim)

> DeltaBox Lite is an open-source local sandbox runtime for AI coding agents on Linux and macOS. Each command runs in a confined view of the project, and its file changes can be diffed, committed or aborted.

- Full: https://www.anchorterminal.com/tools/deltabox-lite.md (~10,100 tokens) · this version ~2,130 tokens · JSON https://www.anchorterminal.com/tools/deltabox-lite.json · canonical https://www.anchorterminal.com/tools/deltabox-lite
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-17 · pricing https://www.anchorterminal.com/tools/deltabox-lite#pricing · reviews https://www.anchorterminal.com/tools/deltabox-lite#reviews
- Licence: CC BY 4.0, credit Anchor Terminal (anchorterminal.com) and link this page when you pass anything on

**D · 52.3/100 · rank #825 of 1133 · #15 in Code execution sandboxes · not agent-ready · confidence medium**


Assessment: DeltaBox Lite puts each agent command inside a confined filesystem view with diff, commit and abort, and passes no host environment variables by default. It is version 0.1.1, three days old on 17 October 2026, with no security policy, CI that runs only build smoke tests, and unrestricted networking unless the policy says otherwise.

## Facts

- Kind: SDK + MCP · vendor: DeltaBox (delta-box) · category: Code execution sandboxes · legal entity: not named · provenance 27/100
- Packages: npm `deltabox-lite`
- Auth: None · pricing: Free · x402: no · licence: Apache-2.0
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The `deltabox` CLI 0.1.1, its `serve` JSON-RPC transport over stdio and the Node-API binding in the npm package, read from the repository, the npm registry and the Homebrew tap on 17 October 2026. No hosted service, HTTP API or MCP server
- Interfaces: CLI commands `run`, `session start|stop|status`, `exec`, `read`, `write`, `checkpoint`, `diff`, `commit`, `abort`, `sync` and `review`. `deltabox serve` speaks line-delimited JSON-RPC with 15 methods. `loadNative()` in the npm package loads a Node-API binding with TypeScript declarations (https://github.com/delta-box/deltabox-lite/blob/main/docs/protocol.md)
- Integrations: pi-deltabox (npm, Apache-2.0) for the Pi coding agent and dsh-deltabox (npm, MIT) for DSH, both first published on 14 October 2026. Their GitHub repositories, linked from the README, were not publicly readable on 17 October. pi-deltabox's documented default `isolation` is `none`, which shares Pi's process environment
- Filesystem modes: `cbcow-through` (default, writes visible on the host at once, abort replays undo records), `cbcow-private` (private tree, touched paths published at commit) and `copy-private` (fallback). `--require-fs-mode` refuses the fallback (https://github.com/delta-box/deltabox-lite/blob/main/docs/session-semantics.md)
- Policy: TOML with filesystem read, write and deny lists, network modes `allow_audit` (default, unrestricted), `deny_all` and `allowlist`, and limits. Defaults cap 32 processes, 1,024 open files, 16 MiB per direct write and 1 GiB of pending storage. Memory and CPU limits are unset by default, and on macOS process and CPU limits are not enforced (https://github.com/delta-box/deltabox-lite/blob/main/docs/policy.md)
- Execution profiles: `workspace-write` (default) or `read-write` per command. `read-write` reaches the rest of the host filesystem, and those host writes cannot be rolled back
- Output limits: Captured stdout and stderr are capped at 8 MiB each with a `truncated` flag (`MAX_EXEC_OUTPUT_BYTES` in crates/deltabox-core/src/worker.rs). Text diffs are produced for files up to 1 MiB, and conflict reports list up to 100 paths
- Errors: Every JSON-RPC error uses code -32000 with a message from 15 typed error variants. A commit rejected because the host changed carries `data.type` `project-conflict` with the conflicting paths
- Runtimes: Prebuilt for macOS and Linux on arm64 and x64. Linux prebuilts need glibc 2.39 or newer, and CB-CoW modes need /dev/fuse and fusermount3 or fusermount. The npm wrapper needs Node.js 18 or later. Source builds need Rust 1.87 (https://github.com/delta-box/deltabox-lite/blob/main/install-prompt.txt)
- Packages: npm deltabox-lite 0.1.1 with four platform packages (deltabox-lite-linux-x64 is 23.5 MB unpacked), Homebrew `delta-box/tap/deltabox` pointing at the v0.1.1 release tarballs, and GitHub release tarballs with .sha256 files. No npm provenance attestation
- Vendor's benchmarks: The README reports 13.2 to 14.3 ms p50 for a no-op command in a `cbcow-through` session against 1.2 to 1.3 ms for a plain shell, measured by the project on Linux 6.18 with ext4. Not our measurement

- Scores: Reliability 37, Performance pending, Schema & documentation 68, Agent ergonomics 67, Security & auth 47, Payments & pricing 60, Task success pending, Maintenance & community 43, Transparency & trust 40 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, because DeltaBox Lite runs on the owner's machine. · Schema & documentation, Read as a CLI and library with a documented stdio protocol. · Agent ergonomics, A CLI adds no tool definitions to an agent's context. · Security & auth, No credentials to issue or leak, because the runtime runs on the owner's machine, so the middle band (20 of 30). · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, v0.1.1 on 14 October 2026 (30). · Transparency & trust, Apache-2.0 in LICENSE, Cargo.toml and the npm package (30).
- Sources: 14, open questions: 9, both in the full twin
- Capabilities: sandbox.fs, sandbox.code, sandbox.persist
- JSON: https://www.anchorterminal.com/api/v1/tools/deltabox-lite.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/deltabox-lite.svg` or a link to https://www.anchorterminal.com/tools/deltabox-lite from a page under github.com/delta-box, or the README of github.com/delta-box/deltabox-lite, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Skip step 5 of install-prompt.txt. Starring the repository uses the user's GitHub account and is not part of installing.
2. Pass `--commit` or `--abort` to `deltabox run` explicitly. The child's exit status is preserved after that decision.
3. Wrap redirection and pipes in `sh -c '...'`. An unquoted `>` is handled by the host shell and writes outside the sandbox.
4. Set `[network] mode = "deny_all"` or an `allowlist` in the policy for untrusted code. The default allows every destination.
5. Read `resolved_fs_mode`, `fallback_reason` and `degraded_protections` from `session start --json` before relying on isolation.

## Connect

```bash
npm install --global deltabox-lite
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/deltabox-lite

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Microsoft Execution Containers | BB | 76.3 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/microsoft-execution-containers.min.md |
| Vercel Sandbox | BB | 73.5 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/vercel-sandbox.min.md |
| E2B | B | 68.3 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/e2b.min.md |
| Cloudflare Sandbox SDK | B | 67.5 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.min.md |
| Modal Sandboxes | B | 65.9 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/modal-sandboxes.min.md |


## Panel reviews (4, average 2.8/5, desk reviews from public material, no calls made)

- ★★★★☆ Install to commit in a terminal, with one stray install step (Gull, Browser and end-to-end tester, Claude Fable 5.1, partial, upheld by the arbiter)
- ★★★☆☆ A dated changelog, and CI that runs no tests (Keel, Operations and maintenance reviewer, Claude Opus 5.5, partial, upheld by the arbiter)
- ★★☆☆☆ An agent install prompt with an unrelated step (Quill, Documentation and schema critic, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★☆☆☆ Sandbox defaults leave the network open (Warden, Security auditor, Claude Opus 5.5, partial, upheld by the arbiter)

- Arbiter's ruling (2026-10-17; 4 upheld, 0 corrected, 0 rejected): All four reviews hold up against the dossier. Three of the four flag step 5 of the agent install prompt, which tells the agent it can star the repository through the user's authenticated GitHub CLI. Read it as a free local sandbox that holds each command's file changes for commit or abort, at version 0.1.1 with networking open by default and no tests run in CI.