Sandbox security
Configure network access and understand where code and credentials execute.
A Session environment isolates its working filesystem from other Sessions. Your application still controls which tools and external identities it makes available to the Agent.
Network access
Set the network policy when creating the Environment:
const environment = {
type: 'openai_hosted',
network: {
access: 'restricted',
allowed_domains: ['api.example.com'],
},
};
access accepts enabled, disabled, or restricted. Domain allowlists apply to restricted access. Choose the policy required for your packages, setup commands, and tools.
Credential placement
Environment variables and inline stdio credentials are available to code running in that Sandbox. Treat them as credentials delegated to the Session, not as secrets hidden from the agent's code.
Use Vault credentials for service-origin HTTP MCP authentication when the credential should remain outside the Sandbox. Session HTTP authentication and stored environment setup secrets are encrypted and omitted from public Session resources and events.
Connection origin
Service-origin MCP requests run through Rebyte's service and use public HTTPS endpoints with validated DNS addresses and no redirects. Environment-origin MCP requests run in the Session VM and follow its network policy.
The Sandbox network policy does not govern service-origin requests or your application's function handlers. Review each execution location when deciding what access to grant.
Application permissions
Organization authentication scopes access to Sessions, environments, and Artifacts. Your application must enforce its own end-user authorization before using its organization key on a user's behalf. See Manage sessions.