Skip to main content
The sandbox gives your agent a secure, isolated environment to run code, manipulate files, and execute shell commands — separate from the TrueForge server and your infrastructure. Skills and Code Mode require a sandbox. Configure a provider once under Settings → Sandbox providers, then enable the sandbox on each agent that needs it.

​
TrueForge’s approach

There are two common patterns for combining agents with sandboxes: TrueForge uses sandbox as tool: the agent loop and credentials stay in the harness; the sandbox only runs code, file, and shell operations. That means:
  • Model and MCP credentials never enter the sandbox.
  • Conversation state survives a sandbox crash.
  • A sandbox is created only when the agent actually needs one — simple Q&A and MCP calls incur no sandbox cost.

​
Configuring a provider

Daytona is the only sandbox provider supported today. Support for additional providers is planned. Open Settings → Sandbox providers, pick the Daytona preset from the catalog, and paste your API key.
The provider presets come from the shipped sandbox catalog — see Initial Setup for how catalogs work and how to change what the UI offers.

​
Enabling the sandbox on an agent

The sandbox is off by default per agent. Turn it on in the agent builder when you need code execution, skills, or Code Mode. You can also set config.sandbox.enabled in the agent spec when creating agents via the SDK. Optional controls:
  • File downloads — let users download files the agent produces (on by default in the chat UI).

​
Lifecycle

  • Provisioned on demand when the agent needs code, files, skills, or Code Mode.
  • Reused across turns in the same session (files persist).
  • Stopped after idle time, then archived and eventually deleted per the provider settings.

​
Credential safety

  • Model and MCP credentials stay in the harness.
  • MCP calls from Code Mode scripts are bridged back to the harness — the sandbox never holds those tokens.