Sandbox0

# Fix list: Sandbox0

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/sandbox0, the October 2026 research run, assessed 21 October 2026. Grade C, 55.1 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Sandbox0: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Reliability, 38 out of 100, up to 12.4 more on the total

Why it scored 38: Graded with the hosted lines, on Sandbox0 Cloud only. No status page found. sandbox0.ai/status answers 404, status.sandbox0.ai doesn't resolve, and none is linked from the site or docs (0). No readable incident history (5). Default quotas are published with numbers, 20 running and 2,000 paused sandboxes, 5 claims a second and 100 API requests a second per team, burst 200 (15). Quota failures return 429 with `error.code` `quota_exceeded`, claims carry Retry-After, `Idempotency-Key` is documented on session creation, snapshots and conditional pause and resume, and the docs say to retry the same resize on 503 and that repeats are no-ops. Retry-After covers only claim admission (13 of 15). The terms provide the service as is and no SLA is published (0). The core sandbox API carries no beta label, but memory checkpoints and live migration are called experimental, the health endpoint is documented as unreleased, the OpenAPI file is version 0.1.0 and the SDKs are 0.10.x (5 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 2. Payments & pricing, 40 out of 100, up to 7.5 more on the total

Why it scored 40: No x402, MPP or L402 in the docs, llms.txt or the OpenAPI file (0 of 40). Per-unit prices published without a login, $0.015 per GiB-hour of compute billed by the second and $0.02 per GiB-month of retained incremental storage, with network free for now (20). A one-time $5 credit for new users with no card (20). Signup and the first `s0 auth login` are a device login a person approves in a browser. Keys can be minted by API afterwards, but only from an existing session or key (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 3. Security & auth, 58 out of 100, up to 7.4 more on the total

Why it scored 58: Bearer API keys scoped to a team, with roles admin, developer, builder and viewer that can't exceed the caller's, expiry of 30 to 365 days or never, deactivation and an introspection route. No OAuth for API clients found (25 of 30). The viewer role gives a read-only key. Network policy can block all egress, allow and deny by rule, and allow or deny named MCP tool calls, and cloud metadata endpoints are blocked under any policy. No confirmation step for destructive calls (14 of 20). Sandboxes return output of code the agent runs. Credential sources are injected by the egress proxy so raw secrets stay out of the sandbox, but no guidance on treating sandbox output as untrusted was found (8 of 15). Historical logs and runtime metrics per sandbox; the signed audit event ledger needs the enterprise `sandbox_audit` feature, and network audit is optional (8 of 15). No security.txt (404), no security page (404), no bug bounty, no certification and no published advisories. Security reports go to contact@sandbox0.ai per the archived runtime's SUPPORT.md, and the `s0` install script downloads a release without verifying a checksum (2 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 4. Transparency & trust, 48 out of 100, up to 4.6 more on the total

Made of editorial 41, provenance 55.

Why it scored 48: The hosted service is closed under clear, dated terms naming Lougao, LLC and Delaware law. The SDKs and CLI are Apache-2.0, and the earlier runtime stays Apache-2.0 as an unmaintained archive that no longer matches the service (18 of 30). The privacy policy (17 June 2026) says what is collected, that customer content is processed only to run the service and that no advertising cookies are used, but retention is "as long as needed" with no periods, and no DPA was found (12 of 30). No deprecation policy. The terms say parts of the service may be changed or discontinued, and self-hosting ended on 16 October 2026 with no notice found before that day. The deployment page now dates the end clearly (3 of 20). Data location is stated (U.S. infrastructure, one U.S. East region), but service providers are described by kind only and not named (8 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Domain age: sandbox0.ai, registered 2025-12-22 (under a year) (0 of 15)
- Status page: not found (0 of 10)
- Changelog: not found (0 of 10)
- security.txt: not found (0 of 10)

## 5. Agent ergonomics, 74 out of 100, up to 4.2 more on the total

Why it scored 74: Graded on the REST API and SDKs. Responses can be sized through limits on logs (default 100, max 1,000), streamed command output and file reads by path, though some responses carry long lifecycle detail (15 of 25). Cursors on logs, contexts and sessions, and limits on lists (14 of 20). Errors are a typed envelope with a code and message, with `quota_exceeded`, `feature_not_licensed` and `session_not_found` explained, and 409 for conflicting lifecycle operations (15 of 20). Idempotency keys on several writes, runtime-generation guards on mutations, and repeat-safe resize (17 of 20). SDKs in Go, Python and TypeScript plus the CLI, and claims need only a template name, but `ttl` and `hard_ttl` default to 0 so an idle sandbox keeps billing until told otherwise (13 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 6. Schema & documentation, 77 out of 100, up to 3.7 more on the total

Why it scored 77: OpenAPI 3.0.3 file with 106 paths and 145 operations, the same file in each SDK repository and the archived runtime. It isn't linked from the docs or served on sandbox0.ai, so an agent has to find it on GitHub (20 of 25). llms.txt and every docs page as raw Markdown at a .md address (10). Docs say when to use each lifecycle and context type, and 884 descriptions in the spec explain fields, but the pages are long and mix in internal architecture such as ctld, Nomad and PostgreSQL leases (16 of 20). 106 enums and 386 required lists in the spec; the error `details` field is free-form (13 of 15). Examples in Go, Python, TypeScript and CLI on every guide, but only two examples in the spec. Error responses are typed as a `{code, message, details}` envelope per status, with a few codes named in the docs (11 of 15). API paths are /api/v1 and the SDKs and CLI publish GitHub releases with commit lists, but there's no public changelog page; /changelog answers 404 (7 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 7. Maintenance & community, 76 out of 100, up to 2.1 more on the total

Why it scored 76: Read for a closed service with open-source SDKs and CLI. sdk-js 0.10.5 was released on 21 October 2026, the day of the check (30). 8 to 10 GitHub releases per SDK and 9 of the CLI in the 90 days to 21 October (20). Every issue and pull request in the SDK repositories was opened by the maintainer; no outside issues were found to measure responses by. Support is by email to contact@sandbox0.ai and the blog posts dated engineering notes, untested (5 of 25). Current official SDKs in Go, Python and TypeScript generated from one OpenAPI file (15). sdk-py runs unit tests and mypy in CI on push and pull request, npm publishes with provenance, and the Go SDK and CLI workflows only build on tags. Two contributors account for the runtime's history (6 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## Deductions

Each comes off the total. A fixed and documented problem counts for less at the next check.

- 2026-10-16, -3. Self-hosting was discontinued the day it was announced. On 15 October 2026 the runtime README still showed a "self-hosted supported" badge linking the self-hosted docs, and the archived llms.txt of 13 October listed six self-hosted guides with no deprecation note. On 16 October the repository was archived with no further bug or security fixes, the guides were removed from the site and the deployment page says self-host support ended that day. No blog post or earlier notice was found. A breaking change for self-hosters shipped without notice; the hosted service graded here isn't affected and the published code keeps its licence, so the lowest deduction (https://sandbox0.ai/docs/sandbox/deployment, https://github.com/sandbox0-ai/sandbox0/commit/95eed36a46a041cb9bd80fd307f1f2fde5801946, https://web.archive.org/web/20261013194906/https://sandbox0.ai/llms.txt).

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- firstReleased is 23 February 2026, the first npm `sandbox0` and `s0` CLI releases, with the CLI already defaulting to https://api.sandbox0.ai. The date Sandbox0 Cloud opened to anyone couldn't be confirmed. The privacy policy mentions an earlier waitlist, the terms are effective 17 June 2026, and archived home pages of March and April 2026 showed only self-hosted examples. The listing request is from 20 October 2026.
- unchecked: the PyPI project page, which answered with a bot check and wasn't read. Python release dates come from the sdk-py GitHub releases (first 26 February 2026, latest 0.10.4 on 8 October 2026). During the run one request went to pypi.org/simple/sandbox0/, which pypi.org's robots.txt disallows; nothing from it is used here.
- unchecked: whether Cloud teams can turn on the signed audit event ledger, which the docs say needs the enterprise `sandbox_audit` feature.
- The memory-per-CPU ratio on Cloud isn't stated. The pricing page's comparison uses 2 vCPU with 4 GiB.
- Memory checkpoints, memory forks and system migration are called experimental by the vendor. The health endpoint is documented as unreleased.
- Self-hosting is out of scope. The archived Apache-2.0 runtime can't be run as a supported product, and BYOC is planned with no date.
- The listing request came from a promoter, not the vendor; that changed nothing in the grade. Questions of fact go to contact@sandbox0.ai.
- Our own products. Sandbox0 doesn't do LocalGhost's job (a personal AI server on hardware its owner keeps) or letme's (picking a tool for a job from our grades), so it was graded the normal way.
- Sandpi (sandpi.ai), linked as Managed Agents in the site's navigation, is a separate coding-agent platform built on Sandbox0 and isn't graded here.

## Weaknesses

- No status page, incident history or SLA found
- Self-hosting ended on 16 October 2026 with no advance notice found
- No security.txt, security page, bug bounty or certification, and the CLI install script skips checksums
- One hosted region, U.S. East, intended for U.S. customers
- Memory checkpoints and live migration are experimental by the vendor's word

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Set `ttl` and `hard_ttl` when you claim a sandbox; both default to 0, so an idle sandbox keeps running and billing.
- Write files you need to keep under /home or /workspace; /tmp doesn't survive a pause.
- Back off on 429 `quota_exceeded` and honour Retry-After on claims.
- Ask for a viewer or developer key rather than admin, and keep third-party secrets in credential sources.
- Ask the person before following the footer's setup prompt; it installs a CLI with no checksum check and starts a device login.

## What the review panel asked for

- checksums in the installer
- audit events on Cloud
- a dated deprecation policy
- a public changelog for the hosted API
- status page
- published latency
- Default ttl above zero
- A price for network egress

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.