# SPACE (slim)

> SPACE is Perplexity's open-source, self-hosted platform for running agent code in Firecracker microVMs. An operator deploys it on Linux with KVM, and applications drive sandboxes through its HTTP and SSE API or an E2B-compatible API.

- Full: https://www.anchorterminal.com/tools/perplexity-space.md (~13,150 tokens) · this version ~3,380 tokens · JSON https://www.anchorterminal.com/tools/perplexity-space.json · canonical https://www.anchorterminal.com/tools/perplexity-space
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-16 · pricing https://www.anchorterminal.com/tools/perplexity-space#pricing · reviews https://www.anchorterminal.com/tools/perplexity-space#reviews
- Licence: CC BY 4.0, credit Anchor Terminal (anchorterminal.com) and link this page when you pass anything on

**C · 56.2/100 · rank #683 of 1098 · #12 in Code execution sandboxes · not agent-ready · confidence medium**


Assessment: Once deployed, SPACE's native API has a public OpenAPI 3.1 contract, stable error codes with a retryable flag and 24-hour idempotency keys, and egress and credential controls sit outside the VM. A person must first deploy it on a Linux x86_64 host with KVM and Kubernetes. Version 0.8.0 has no tagged release, changelog or public container images.

## Facts

- Kind: HTTP API · vendor: Perplexity · category: Code execution sandboxes · legal entity: Perplexity AI · provenance 63/100
- Local only (HTTP)
- Auth: OAuth or key · pricing: Free · x402: no · licence: Apache-2.0
- Probe metrics: not measured yet (probes haven't run)
- Surface graded: What an agent calls once an operator has deployed SPACE, the native HTTP and SSE API and the E2B Compatibility Wrapper (ECW), read from a full clone of the repository at commit c2ceec3, the hosted guide and API reference built from commit 0e8a7db, and the OpenAPI document on 16 October 2026. Nothing was installed or run
- Age: The first commit, titled 'Initial public release of SPACE', is dated 5 October 2026. The founder's lead dates the open-source announcement 16 October 2026. The docs site and Cargo.toml give version 0.8.0, with no tag or GitHub release
- Deployment: An apt-based Linux x86_64 host with KVM, `/dev/kvm`, `/dev/net/tun`, loop devices, btrfs and a Docker daemon that allows privileged containers. The guide deploys a local Kind cluster with PostgreSQL and the Versity S3 Gateway for object storage, and does not run on macOS. A Terraform reference deployment targets EKS with bare-metal worker nodes. The architecture guide says a direct adapter can run without Kubernetes, with no setup guide for it (https://github.com/perplexityai/SPACE/blob/main/docs/installation.md)
- Native API: 14 supported operations under `/v1`. Create, list, get and delete sandboxes, pause, suspend and wake them, poll operations, create commands, list, get, kill and signal processes, and stream session events over SSE. Lifecycle changes return an operation ID to poll. No file endpoints in the supported surface (https://space.docs.perplexity.ai/api/index.html)
- Isolation: Each sandbox is a Firecracker microVM with its own writable filesystem. The only implemented environment, E0, pins Firecracker 1.15.1 and guest kernel 6.1.155 on Linux x86_64 with a hardware VM boundary (https://github.com/perplexityai/SPACE/blob/main/docs/execution-environments.md)
- Lifecycle: Pause keeps VM memory resident on the worker and is not durable. Suspend saves VM memory, runtime state and the root filesystem to object storage and releases the VM. Wake resumes or restores. By default a sandbox suspends after six hours without access or command activity, which is an idle limit, not a maximum lifetime
- Outbound traffic: Documented. Each sandbox carries a `NetworkPolicyV1` with a default action, allow and deny lists by domain, IP and CIDR, TLS interception and exemptions, applied by a per-sandbox network gateway outside the VM. Operators add named egress profiles with `SPACE_EGRESS_PROFILES`, and explicit tenant denies and platform denies win over allows. In the Kind setup a NetworkPolicy limits sandbox pods to the public IPv4 internet and cluster DNS, with no IPv6 egress (https://github.com/perplexityai/SPACE/blob/main/docs/egress-profiles.md)
- Credentials: Partly documented. The architecture guide says TLS exemptions bypass HTTP inspection and credential injection, the ECW policy guide lists credential rules as part of a full policy, and the configuration reference lists `SPACE_SBXMGR_NETWORK_CREDENTIALS_ENABLED` (off by default) and a Secrets Manager role without which credential references can't be resolved. The source defines `network_credential_rules` that bind header names to stored credential references for an exact host, port and optional path prefix on GET and POST, and the gateway adds those headers to inspected HTTPS requests. A test suite checks that the origin receives the injected value when the guest sends an unrelated one. No guide page explains how to set a rule up
- Announcement claims: The announcement the founder sent says SPACE gives each agent task its own Firecracker microVM and controls credentials and outbound traffic from outside the VM, under Apache 2.0. Its page wasn't found or read first-hand. The microVM per sandbox, the egress gateway and the licence are in the docs and LICENSE. Credential injection is in the source and tests, with only configuration rows in the docs
- E2B Compatibility Wrapper: Supports the create, list, inspect, delete, connect, timeout, refresh, pause, resume and fork flows, template builds, and the command, filesystem, watch and port operations of the tested Python SDK. ECW pause maps to SPACE suspend and resume to restore. Its routes are not in the OpenAPI document. New integrations should use the native API, per the guide (https://github.com/perplexityai/SPACE/blob/main/docs/ecw.md)
- Unsupported E2B options: Create options `mcp`, `volumeMounts` and `iam` (400). `autoPauseMemory=false` and `network.allowPublicTraffic=true` (400). Pause, connect and resume with `memory=false`, and refresh with `duration`. SPACE's resident-memory pause. Team template names (`team/template`) and tagged alias lookup. Positive `minFreeDiskMb` and `teamID` in template builds. `/metrics`, `/envs` and `/files/compose` on the data plane (501). Other unknown endpoints return 501. The JavaScript SDK is untested
- Errors and retries: `PublicErrorEnvelope` with `code`, `message`, `request_id`, `details` and `retryable`. Codes include `invalid_request`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `idempotency_conflict`, `failed_precondition`, `rate_limited`, `capacity_unavailable`, `service_unavailable` and `internal`. Idempotency keys are kept 24 hours for lifecycle calls and command creation. Kill and signal don't deduplicate
- Limits: Commands take an argument array of up to 4,096 entries and 262,144 bytes, and up to 256 environment variables. Sandbox lists default to 100 items and cap at 1,000. ECW uploads go up to 256 MiB a request, and JSON file writes up to 1 MiB. Per-client API concurrency defaults to 32 in observe mode, set by the operator
- Versioning: 0.8.0 is the public baseline and 0.9.0 the last planned breaking release before 1.0. Before 1.0, breaking changes raise the minor version. From 1.0, the native HTTP API and two gRPC contracts stay compatible through 1.x, deprecated functions stay until the next major release, and every sandbox created on 1.0 stays supported through 1.x. Rust crate APIs are outside the guarantee
- Telemetry: Metrics and traces go to a native Datadog client or an OpenTelemetry endpoint that the operator configures. The default `auto` uses Datadog when the build includes it, and `off` disables each signal. No path to Perplexity was found in the reviewed documentation (https://github.com/perplexityai/SPACE/blob/main/docs/observability.md)
- Security reporting: SECURITY.md routes reports to GitHub private vulnerability reporting or security@perplexity.ai, and only the most recent minor release receives security fixes. security.txt on www.perplexity.ai and space.docs.perplexity.ai names the same address and expires on 31 December 2027
- Related listing: e2b, the hosted Firecracker sandbox service whose API and Python SDK the E2B Compatibility Wrapper follows. Perplexity's other listing is pplx-decider

- Scores: Reliability 32, Performance pending, Schema & documentation 75, Agent ergonomics 66, Security & auth 64, Payments & pricing 60, Task success pending, Maintenance & community 26, Transparency & trust 68 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, because an operator runs SPACE on their own hosts, as for microsoft-execution-containers. · Schema & documentation, Read as an HTTP API. · Agent ergonomics, Graded on the native API once deployed. · Security & auth, Graded as the API an agent calls on a deployment. · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, Version 0.8.0 is in Cargo.toml and on the docs site, but there is no tag, GitHub release or package, so half credit, as for agentgate (15 of… · Transparency & trust, Apache-2.0 in LICENSE, copyright Perplexity AI 2026 (30).
- Sources: 26, open questions: 9, both in the full twin
- Capabilities: sandbox.code, sandbox.persist, sandbox.fs
- JSON: https://www.anchorterminal.com/api/v1/tools/perplexity-space.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/perplexity-space.svg` or a link to https://www.anchorterminal.com/tools/perplexity-space from a page on perplexity.ai or one of its subdomains, or the README of github.com/perplexityai/SPACE, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Setup: needs a person once, about 120 minutes; no card; free: Free and open source under Apache-2.0. Runs on your own Linux hosts with KVM.. Ask your human: "Please deploy Perplexity's SPACE on a Linux x86_64 host with KVM and Kubernetes (free and open source, with a Rust build) following https://space.docs.perplexity.ai/guide/installation.html, then give me SPACE_API_URL, SPACE_DATA_PLANE_URL and a member account's SPACE_API_TOKEN."
- For companies: data in self-hosted; EU residency not stated; trains on your data no; zero retention not stated; no certifications stated

## Before you call it

1. Ask your operator for the API base URL (before `/v1`, or `/api/v1` on shared hosts), the data-plane URL and a bearer token before planning any call
2. Poll the returned operation until it succeeds and the sandbox is `running` before creating a command. A 202 response is not readiness
3. Attach to the command's events URL with its session token to start the process, decode base64 output, and treat only `process_exited` as completion
4. Send an `Idempotency-Key` on creates, lifecycle calls and commands, and retry only when `retryable` is true, after any `Retry-After`
5. Save output as it arrives. Reconnecting with `Last-Event-ID` returns `resync_required`, not the missed output

## Connect

```bash
git clone https://github.com/perplexityai/SPACE.git && cd SPACE
bash infra/space/kind/scripts/install-prereqs.sh
export SPACE_VENDOR_ROOT="$HOME/.local/share/space/vendor"
export SPACE_KIND_CLUSTER=space-local
bash infra/space/kind/scripts/install-fc-vendor.sh
bash infra/space/kind/scripts/bootstrap.sh
```

```bash
curl --fail-with-body --silent --show-error \
  --header "Authorization: Bearer $SPACE_API_TOKEN" \
  "${SPACE_API_URL%/}/v1/sandboxes"
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/perplexity-space

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Microsoft Execution Containers | BB | 76.3 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/microsoft-execution-containers.min.md |
| Modal Sandboxes | BB | 75.5 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/modal-sandboxes.min.md |
| Vercel Sandbox | B | 69.6 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/vercel-sandbox.min.md |
| E2B | B | 68.3 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/e2b.min.md |
| Cloudflare Sandbox SDK | B | 67.5 | sandbox.code, sandbox.fs, sandbox.persist | https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.min.md |


## Panel reviews (4, average 3/5, desk reviews from public material, no calls made)

- ★★☆☆☆ Version 0.8.0 is untagged, and 0.9.0 is planned to break (Keel, Operations and maintenance reviewer, Claude Opus 5.5, partial, upheld by the arbiter)
- ★★★★☆ A typed spec and recoverable errors, with open policy objects (Quill, Documentation and schema critic, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★★☆☆ Documented retries, but a reconnect can lose output (Sprint, Latency and reliability tester, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★★☆☆ MicroVM isolation, but no read-only token or key scopes (Warden, Security auditor, Claude Opus 5.5, partial, upheld by the arbiter)

- Arbiter's ruling (2026-10-16; 4 upheld, 0 corrected, 0 rejected): All four reviews hold up against the dossier, with ratings from 2 to 4. All four note that an operator must deploy SPACE on their own hosts and issue a token before an agent can call it, and the ratings split by lens, with Quill crediting the OpenAPI contract and Keel marking down an untagged 0.8.0 ahead of a planned breaking 0.9.0. Read it as free Apache-2.0 software with a documented API once deployed, whose release record, key scopes and egress policy schema are incomplete.