boxd vs Northflank (2026)

Agents on a machine act in outside systems through 128 integrations, including GitHub, Linear, Slack, Notion, Jira, Salesforce, HubSpot, Stripe and Zendesk, each with typed tools such as creating an issue or sending a message.

A person connects an account once through the provider's consent screen, personally or as a shared connection for the whole organization, and the platform then makes each call on the machine's behalf, so the credential never enters the machine.

The in machine run CLI and the @boxd/run SDK call these tools, and scripts reach any other API, database or cloud account with ordinary libraries.

Sourcedocs.boxd.sh/guides/integrations/connectionsread 2026-11-05

Agents reach outside systems through a short, fixed set of built in routes. A cloud harness pushes to Git through a proxy that limits its credentials to the harness branch and refreshes them automatically, workload identity issues short lived tokens for AWS, Google Cloud and Azure, and workflow message steps post to Slack, a webhook or a pull request comment. Any other API key can be added to outbound requests at egress so the agent's code never holds it, but the tools that use it are the customer's own code, and agents get no integration catalog or tool framework.

Sourcenorthflank.com/product/sandboxesread 2026-11-05

Background jobs give automations a managed lifecycle.

A script that registers a schedule or trigger runs as a job that survives reboots, waits for a missing connection instead of failing, and restarts with exponential backoff for up to five attempts before it is marked failed. boxd's fan out pattern has a coordinator create one machine per worker, run a coding agent headless in each and let a lead agent merge the reports, and a fork brings a machine's jobs along paused so nothing runs twice.

The sequencing, branching and hand offs in that pattern are code the customer writes against the SDK, and boxd has no workflow graph, step model or multi agent runtime of its own.

Sourcedocs.boxd.sh/guides/automations/jobsread 2026-11-05

Workflows chain builds, deployments, job runs, backups, conditions, approvals and messages in a visual editor or as JSON, with sequential, parallel and loop control and child workflows that can wait for completion, and the cloud agent loop carries agent built changes through previews, staging and production this way. A job can run an agent and the workflow waits for its result. These steps orchestrate releases and infrastructure around the agents, while the agent's own reasoning steps, hand offs and retries stay inside the customer's harness or code.

Sourcenorthflank.com/docs/v1/application/release/configure-workflowsread 2026-11-05

Work reaches a machine on schedules, events and inbound requests. An automation registers durations or cron expressions with every() and subscribes to integration events with .on(), such as a new Linear issue or a pull request through the boxd GitHub App, and 36 integrations emit triggers.

The platform holds the next due time and wakes a hibernated machine shortly before it, holds events that arrive while a machine wakes for up to 15 minutes, and fires a missed cron slot once on wake. A hibernated machine also wakes on the next HTTPS request, so an agent served from it answers webhooks at its own address.

Sourcedocs.boxd.sh/guides/automations/scriptsread 2026-11-05

Work starts from Git events, schedules and webhooks. Workflows and preview blueprints run on a push, a pull request, a tagged release, a completed check suite, a pull request label, a cron schedule no more often than every 10 minutes, or a GET or POST to a webhook URL, with the branch, commit and pull request passed into the run. Jobs also run on cron schedules or on demand through the API, so an agent job can start on a timer or when another system calls it.

Sourcenorthflank.com/docs/v1/application/release/configure-workflowsread 2026-11-05

No retrieval index, vector store or knowledge base over the customer's content comes with the platform. Files on a machine's disk, standalone disks that outlive a machine and data sets saved into a snapshot are storage the agent's code reads, not an index a query returns. Tools such as Notion, Confluence or Google Drive are searched through their own integrations, and any grounding layer is something the customer installs on the machine.

Sourcedocs.boxd.sh/llms.txtread 2026-11-05

No retrieval index or knowledge base over the customer's content is part of the platform. Volumes, S3 buckets mounted through FUSE and managed Postgres, MySQL, MongoDB or Redis hold data that an agent's code can read and write, and any vector store or retrieval layer is something the customer deploys on top of them.

Sourcenorthflank.com/product/sandboxesread 2026-11-05

Machines keep their working state between sessions. A machine on standby resumes in under a millisecond and a hibernated one wakes with its memory and processes intact, and coding agent sessions live on the persistent disk, so a job delegated in the morning can be resumed interactively later. Forks, checkpoints and snapshots copy or rewind that state.

Automations also get object(name), a named JSON store written on every assignment and restored on the next run, meant for cursors, dedup sets and counters. All of it is machine and script state the developer manages, with no memory layer of stated scope and lifetime that a buyer can review, edit or delete as memory.

Sourcedocs.boxd.sh/guides/automations/scriptsread 2026-11-05

State outlives a single run. A cloud harness keeps its home directory on a 5 to 100 GB volume through restarts and pauses, sandboxes keep attached volumes across pause and resume, and S3 buckets mounted through FUSE keep data after a sandbox is deleted. Northflank's stateful agent example gives each agent a managed Postgres database for memory and resumes its session against it. That memory is a database and volume the customer's own agent code writes and reads, with no memory layer of stated scope and lifetime managed by the platform.

Sourcenorthflank.com/product/sandboxesread 2026-11-05

A person can step into an agent's work while it runs. Every machine has a live desktop in the browser where its owner watches the agent's browser, takes over the keyboard to enter a password, solve a captcha or fix a form, and hands control back without stopping the agent. The preinstalled coding agents are told to share that desktop link whenever they need someone, so a login or approval happens in the browser the agent already opened. There is no approval gate, pause primitive or policy that holds an agent's action until a person reviews it.

Sourcedocs.boxd.sh/guides/desktopread 2026-11-05

Release workflows can wait on people. An approval step holds a workflow until the required number of approvals is given from its run page, so an agent built change can be stopped before it reaches staging or production, and cloud harness pushes are confined to the harness's own branch. Nothing holds an agent's direct API, CLI or MCP actions for review, since those run with whatever the token's role permits.

Sourcenorthflank.com/docs/v1/application/release/configure-workflowsread 2026-11-05

Organizations have three roles. Members use shared machines and create org billed ones, admins also invite and remove members, change roles, set defaults, create teams and revoke org API keys, and the single owner can demote admins. Admin invites need an interactive login, so an API key or a token minted inside a machine cannot send one.

People sign in with GitHub or Google, with SAML single sign on offered to enterprise customers on request. A DPA is available, and SOC 2 Type II and ISO 27001 are both in progress, not held. Each machine is a KVM microVM with its own kernel, and egress allowlists and host bound secrets are enforced on the host, outside the machine.

Sourcedocs.boxd.sh/guides/organizationsread 2026-11-05

Northflank holds SOC 2 Type II and ISO 27001 and supports HIPAA, with reports in its trust center. Fine grained roles grant create, read, update and delete permissions per resource type, can be limited to or excluded from projects, and drive API tokens, which inherit their role's permissions. Owner, admin and default roles come preset, organization roles span teams and can follow directory groups, and Enterprise adds SAML and OIDC single sign on with SCIM and just in time provisioning. Team policies limit which coding agents may run and can keep a harness private to its creator.

Sourcenorthflank.com/docs/v1/application/secure/use-role-based-access-controlread 2026-11-05

Automations are visible and the agent's own steps are not. The console's Automations page lists every background job with its triggers in plain English, the integrations it uses, its state, last run and last error, plus a generated write up and flow diagram for each script, and run logs prints or follows a job's log from inside the machine. Regional uptime and incidents appear on a public status page. A coding agent's prompts, tool calls and outputs are not traced by the platform, and no audit trail of member actions is offered.

Sourcedocs.boxd.sh/guides/automations/jobsread 2026-11-05

Every sandbox, job and harness streams logs and reports CPU, memory and network metrics through the dashboard and API, and workflow, job and template runs keep their run details.

On Enterprise, audit logs record every action from the UI, API and CLI, templates, release flows, Git events and the system, with the acting user, origin, affected resources, a before and after diff and the parent events that caused it, at organization, team, project and resource level, and forward to S3.

Log sinks, alerts and notifications to Slack, email, Teams or webhooks come on paid plans. An agent's prompts and tool calls inside its harness are not traced.

Sourcenorthflank.com/docs/v1/application/observe/audit-logsread 2026-11-05

Each machine runs in Frankfurt or New York, picked per machine from the CLI, console or SDK or set as an organization default, and its disk, memory, snapshots, checkpoints and backups stay in that region on Latitude.sh bare metal. Scale customers can have boxd operate the cluster inside their own cloud account, and the same release self hosts on AWS, Google Cloud or any KVM host, free up to 16 worker vCPUs and licensed above that, with air gapped installs supported. boxd gives conflicting accounts of its US region, with New York live in some places and coming soon with a waitlist in others.

Sourcedocs.boxd.sh/guides/regionsread 2026-11-05

Projects run in one of more than 17 Northflank Cloud regions, chosen at creation and fixed afterwards, with GPU sandboxes in GPU enabled regions. BYOC runs the same sandboxes and harnesses in the customer's own AWS, Google Cloud, Azure, Oracle, Civo, CoreWeave or Nebius account, with Kata microVM support for harnesses, and Northflank also manages bare metal, OpenShift and VMware clusters. Enterprise can run the control plane itself inside the customer's infrastructure, air gapped if needed, so no platform data leaves the network.

Sourcenorthflank.com/docs/v1/application/sandboxes/sandboxes-on-northflank-cloudread 2026-11-05

Machines arrive with Claude Code, Codex and OpenCode installed and configured through an instructions file that teaches each agent the platform, plus three preinstalled skills covering the in machine CLI, automations and the desktop, and a CLI skill for the laptop.

Guides walk through development workspaces, preview environments, CI runners, personal assistants, sandboxes, agentic SaaS, RL environments and agent swarms, and connectors exist for open source tools such as TanStack AI, Pydantic AI, Harbor and Scale AI AgentEnv. These are configured third party agents and recipes a developer builds from, not prebuilt agents of boxd's own.

Sourcedocs.boxd.sh/use-cases/coding-agentsread 2026-11-05

Cloud harnesses come preset for Claude Code, Codex, OpenCode, Pi and Cursor, or start empty for other tooling, and a Northflank skill and plugin teach coding agents the platform. Stack templates deploy common applications in one step, and templates and preview blueprints package infrastructure and releases for reuse. These are configured third party agents and building blocks a developer assembles, not prebuilt agents of Northflank's own.

Sourcenorthflank.com/product/cloud-agentsread 2026-11-05

The customer decides which agents and models run. Claude Code and Codex use the customer's own subscription, signed in once and served to every private machine in the organization, or an API key stored as a secret, OpenCode signs in on each machine, and any other agent or model that runs on Linux can be installed. boxd adds no model of its own and does not route between providers, and it does not use customer data to train or improve any model.

Sourcedocs.boxd.sh/use-cases/coding-agentsread 2026-11-05

The customer chooses the agent and the model behind it. A harness runs Claude Code, Codex, OpenCode, Pi or Cursor signed in with the customer's own API key or account, or starts empty for other tooling, and team policies decide which of those agents a team may run. Models can also be self hosted on GPUs from L4 to B200 for inference beside the agents, and Northflank routes no model traffic of its own.

Sourcenorthflank.com/product/cloud-agentsread 2026-11-05

Outside code drives the platform through TypeScript and Python SDKs, a gRPC API whose full api.proto service definition is public for generating stubs in any language, and a CLI that returns JSON from its commands. Each region has its own API endpoint, and organization API keys keep working after the person who created them leaves. The SDKs cover machines, forks, snapshots, checkpoints, disks, egress, secrets, domains, organizations and teams, and a filesystem API reads and writes files inside a machine from code.

Sourcedocs.boxd.sh/reference/grpc-apiread 2026-11-05

Every resource is reachable from outside through a REST API, a CLI, and JavaScript and Python clients, with endpoints for sandboxes, harnesses, jobs, workflows, templates, secrets, volumes and audit logs, plus exec, file copy, log tailing and metrics. A hosted MCP server takes a team API token as a bearer header and lets Claude Code, Codex, Cursor or OpenCode deploy services, manage jobs and databases and inspect resources. Templates and GitOps define the same resources as code.

Sourcenorthflank.com/docs/v1/api/introductionread 2026-11-05

There are no test cases, scoring or quality gates for an agent's behavior. The platform is where evaluations run, not how they are scored. Forks give every reinforcement learning rollout or benchmark trial a byte identical starting state, Moyai ran 279,577 Harbor benchmark machines on it, and a reproducibility check compares two forks run with the same seed, but rewards, datasets and scoring belong to the customer's own framework.

Sourcedocs.boxd.sh/use-cases/reproducible-rl-environmentsread 2026-11-05

There is no scoring, test case or quality gate for an agent's behavior. Sandboxes run reinforcement learning rollouts and evaluations at more than 50,000 environments in parallel from one image with shared volumes, but the rewards and scores come from the customer's own code.

Sourcenorthflank.com/product/sandboxesread 2026-11-05

Agents drive a real browser on the machine's own desktop. Every machine ships a browser automation CLI built for agents, backed by Chromium with anti bot fingerprinting and a persistent profile so logins stick, and scripts get the same browser through Playwright. A machine can also drive a Chrome window on the user's laptop over the DevTools protocol, for sites that only accept the user's own network, and the preinstalled agents get a browser tool for it automatically. Any GUI app installed on the machine opens on the same desktop.

Sourcedocs.boxd.sh/guides/launch-a-browserread 2026-11-05

Browser agents run on a browser image the customer picks, such as headless Chromium from browserless, with one sandbox per session that the agent drives over the private network through the DevTools protocol, behind egress rules set by domain. Northflank supplies the isolated compute and networking for it, not a browser or desktop of its own.

Sourcenorthflank.com/product/sandboxesread 2026-11-05