Sandbox security

A Session environment isolates its working filesystem from other Sessions. Your application still controls which tools and external identities it makes available to the Agent.

Network access

Set the network policy when creating the Environment:

const environment = {
  type: 'openai_hosted',
  network: {
    access: 'restricted',
    allowed_domains: ['api.example.com'],
  },
};

access accepts enabled, disabled, or restricted. Domain allowlists apply to restricted access. Choose the policy required for your packages, setup commands, and tools.

Credential placement

Environment variables and inline stdio credentials are available to code running in that Sandbox. Treat them as credentials delegated to the Session, not as secrets hidden from the agent's code.

Use static_bearer or mcp_oauth Vault credentials for service-origin HTTP MCP authentication when the credential should remain outside the Sandbox. Session HTTP authentication and stored environment setup secrets are encrypted and omitted from public Session resources and events by the API.

Rebyte extension: sandbox_environment Vault credentials can be explicitly delegated through environment.vault_credentials. The selected Sandbox processes receive the actual values; the Agent and its code can read them. Rebyte does not inject them into model instructions or public resources, but code can disclose them in tool output or files. This is not a proxy that hides secrets from Sandbox code.

Bindings require an attached Vault in the Session's organization and an active, unexpired credential. Rebyte resolves the current value for new process launches. Rotation, deletion, and expiry do not change the environment of existing processes. Deleting a credential does not revoke its provider token. See Sandbox delegation for the contract, validation errors, and lifecycle limits. This extension is available from October 12, 2026.

Connection origin

Service-origin MCP requests run through Rebyte's service and use public HTTPS endpoints with validated DNS addresses and no redirects. Environment-origin MCP requests run in the Session VM and follow its network policy.

The Sandbox network policy does not govern service-origin requests or your application's function handlers. Review each execution location when deciding what access to grant.

Application permissions

Organization authentication scopes access to Sessions, environments, and Artifacts. Your application must enforce its own end-user authorization before using its organization key on a user's behalf. See Manage sessions.