Cloudflare vs Vercel Sandbox (2026)

Agents act in outside systems through several routes. The MCP client connects an agent to remote MCP servers with OAuth, elicitation and reconnection after restarts, and Code Mode turns MCP servers and OpenAPI services into typed connectors that model written code calls while authentication stays in the host Worker. Agents also send and receive email, answer Slack and voice, receive webhooks, and can pay for HTTP services or MCP tools over x402 and the Machine Payments Protocol. Custom tools are ordinary functions handed to the model through the AI SDK, TanStack AI or a harness.

Sourcedevelopers.cloudflare.com/agents/tools/mcpread 2026-11-05

Credentials reach outside services without entering the sandbox. The firewall's credentials brokering adds an authorization header to outbound requests for named domains, with matchers on path, method, query and headers, request proxying sends chosen traffic through a proxy the customer runs, and Box Mount presents Box content to the agent as local files. The tools an agent calls with those credentials are the customer's own code, and the product carries no integration catalog or tool framework.

Sourcevercel.com/docs/sandbox/concepts/firewallread 2026-11-05

Multistep and multi agent work has its own runtimes. Workflows run durable steps with automatic retries and can wait months for an event or an approval, and the Agents SDK comes with patterns for prompt chaining, routing, parallelization and orchestrator and worker setups. Sub agents run as child Durable Objects with isolated storage and typed RPC, or as streaming tools of a parent agent, and a durable job queue and fibers keep long work alive through eviction and crashes.

Sourcedevelopers.cloudflare.com/agents/concepts/workflowsread 2026-11-05

There is no workflow logic in the product. Commands run blocking or detached from the customer's code, and lifecycle hooks run setup when a sandbox is created or resumed. Multi agent sandboxes give each agent its own Linux user and private home directory and share files through groups, which separates agents inside one machine without sequencing, routing or retrying their work.

Sourcevercel.com/docs/sandbox/concepts/persistent-sandboxesread 2026-11-05

Work reaches an agent from schedules, messages and events. The scheduler runs callbacks after a delay, at a date, on a cron expression or on an interval, and Think adds timezone aware recurring tasks. Agents receive email, Slack messages and mentions, voice over WebSocket, Chat SDK messenger webhooks such as Telegram, and webhook events routed to a dedicated agent instance, while a built in queue works through background tasks in order.

Sourcedevelopers.cloudflare.com/agents/agent-class/schedule-tasksread 2026-11-05

Work reaches a sandbox only when the customer's code or the CLI calls it. A stopped persistent sandbox resumes on the next SDK call that needs a running machine, and exposed ports serve traffic at a public URL while a session runs, but no schedule, webhook or inbound event starts or wakes a sandbox on its own.

Sourcevercel.com/docs/sandbox/concepts/persistent-sandboxesread 2026-11-05

Retrieval runs on maintained indexes. AI Search builds and manages indexes over R2 buckets, websites and uploaded files and returns relevant chunks, or a generated answer, to the agent, and Vectorize stores embeddings for custom retrieval. A searchable context block also gives each agent a full text index in its own Durable Object storage that it can query and add entries to.

Sourcedevelopers.cloudflare.com/agents/tools/ai-searchread 2026-11-05

No retrieval index or knowledge base over the customer's content comes with Sandbox. Files on the sandbox disk, Vercel Drives and S3 buckets mounted through FUSE are storage the agent's code reads, and any search or embedding layer runs as the customer's own code inside the microVM.

Sourcevercel.com/docs/sandboxread 2026-11-05

The Session API is a memory layer kept in each agent's own Durable Object SQLite database. Conversation history persists as a branching message tree with full text search and compaction that summarizes older messages without deleting them, and chosen messages or a whole session can be deleted.

Writable memory blocks, such as learned facts or a task list, are injected into every turn and updated by the agent itself through a set_context tool within a token budget. Memory belongs to the agent instance, usually one per user or conversation, and survives hibernation and eviction. These memory APIs are still marked experimental.

Sourcedevelopers.cloudflare.com/agents/concepts/conversation-state-and-memoryread 2026-11-05

Sandboxes are persistent by default. When a session stops, its filesystem is snapshotted automatically and the next SDK call resumes from it, snapshots can be kept for a set period or indefinitely, and Vercel Drives, in public beta, keep files across sandbox runs and can be shared between agents. The product does not remember anything for the agent. An agent keeps notes on a drive only when the application gives it file tools and instructions to do so, and running processes restart on resume.

Sourcevercel.com/docs/sandbox/concepts/persistent-sandboxesread 2026-11-05

Approvals are part of the runtime. A Workflow can wait with waitForApproval() for minutes or months and resumes when the agent's approve or reject method is called, and durable Code Mode marks chosen connector calls with requiresApproval, so model written code pauses before the tool runs and replays once someone approves. MCP elicitation asks the user for input or an out of band step in the middle of a call, and a browser run can pause while a person logs in or solves a captcha through a Live View link.

Sourcedevelopers.cloudflare.com/agents/concepts/agentic-patterns/human-in-the-loopread 2026-11-05

Sandbox has no approval step, review queue or escalation to a person. The firewall can switch a running sandbox to deny all or narrow its allowed domains without a restart, which limits what an agent's code can reach but does not hold an action until someone reviews it.

Sourcevercel.com/docs/sandbox/concepts/firewallread 2026-11-05

Cloudflare provides SOC 2, ISO and PCI reports to an account's Super Administrators and operates FedRAMP Moderate data centers. Access to the developer platform runs through account, domain and resource scoped roles, including Workers Platform Admin and its read only counterpart, Audit Logs Viewer and the Secrets Store roles, with dashboard single sign on, SCIM provisioning and audit logs. Agents check callers in the Worker before routing a request to them, and MCP servers built on Cloudflare can require OAuth 2.1 with scopes.

Sourcedevelopers.cloudflare.com/fundamentals/manage-members/rolesread 2026-11-05

Vercel's infrastructure holds SOC 2 Type II. Access to sandboxes follows Vercel's team roles (Owner, Member, Developer, Security, Billing, Viewer and Contributor) and, on Enterprise, project roles for administrators, developers and viewers, with permission groups for finer grants, and the SDK authenticates with project scoped OIDC tokens or access tokens. Each sandbox runs in its own Firecracker microVM with a dedicated kernel, and the firewall restricts egress by domain or address range and injects credentials so code inside never holds them.

Sourcevercel.com/docs/rbac/access-rolesread 2026-11-05

Agent activity is traced turn by turn. The Agents tab lists each agent's model, sessions, runs and token use, session replay shows messages, reasoning, tool calls and sub agent activity, and each trace is a waterfall of model calls, tool runs and approvals that exports through OpenTelemetry. Diagnostics channels emit structured events for schedules, jobs, workflows and MCP connections, and account audit logs record who changed what. Traces are kept for seven days, and recording message and tool payloads is opt in.

Sourcedevelopers.cloudflare.com/agents/runtime/observability/tracingread 2026-11-05

Each sandbox has a dashboard page with its configuration, an activity log of lifecycle events and its snapshots, the CLI lists every session a sandbox has run, and the Observability tab charts CPU and memory per sandbox, with alert monitors on Observability Plus. Command output streams through the SDK, and request proxying can route chosen traffic through a customer proxy for logging. What an agent decided between commands is not recorded, since the agent's loop runs in the customer's code.

Sourcevercel.com/docs/sandbox/concepts/persistent-sandboxesread 2026-11-05

Agent state can be pinned to a jurisdiction. Durable Objects created in the EU, US or FedRAMP jurisdiction run and store data only there, location hints place new objects near one of eleven regions from western North America to Oceania, and Regional Services control where requests are answered. Agents run on Cloudflare's global network, and the routing helper passes jurisdiction and location hints straight to the agent's Durable Object.

Sourcedevelopers.cloudflare.com/durable-objects/reference/data-locationread 2026-11-05

Sandboxes run in 19 regions, chosen per sandbox or set as a project default, with iad1 as the default, and snapshots and drives stay in the region they were created in. Secure Compute sends a sandbox's internet traffic through static IPs and reaches the customer's own AWS VPC over VPC peering. Sandboxes run only on Vercel's infrastructure.

Sourcevercel.com/docs/sandbox/pricingread 2026-11-05

Starting points come as harnesses, examples and skills. Think is an opinionated chat agent framework with built in tools, memory, messengers and scheduled tasks, Pi and OpenCode harnesses run inside a Durable Object, examples cover browser, chat, email, Slack and voice agents, and the agents starter template ships ready to deploy, alongside Agent Skills for coding agents. These are frameworks and examples a developer builds on, not finished agents a business adopts as they are.

Sourcedevelopers.cloudflare.com/agents/harnessesread 2026-11-05

The default universal image ships Node.js, Python and coding agents, rebuilt nightly from open source definitions, and one CLI command starts OpenCode, Pi, Claude Code or Codex inside a sandbox. Integrations cover Cursor Cloud Agents, Devin Outposts, Herdr, Hermes and Paseo, frameworks such as the AI SDK, LangChain, Mastra, Flue and TanStack AI, and the OpenAI Agents API. These are configured third party agents and building blocks, not prebuilt agents of Vercel's own.

Sourcevercel.com/docs/sandbox/ecosystemread 2026-11-05

The developer chooses the model for each call. One createAI provider reaches Workers AI models hosted on Cloudflare, AI Gateway catalog models, dynamic routes and vendor SDK models from the AI SDK or Pi AI, with AI Gateway in front of outside providers, and harnesses such as OpenCode and Pi accept the same choices.

Sourcedevelopers.cloudflare.com/agents/modelsread 2026-11-05

The customer chooses the agents and models that run in a sandbox. Any coding agent or framework can run inside it and model calls happen in the customer's code, and Vercel's examples route them through its optional AI Gateway with many providers or the customer's own keys. Sandbox itself imposes no model.

Sourcevercel.com/docs/sandbox/ecosystemread 2026-11-05

Developers drive the platform through the Cloudflare REST API, Wrangler and SDKs, and each agent exposes its own methods to browsers and servers through callable methods, a typed client SDK and HTTP or WebSocket routes. Cloudflare's managed remote MCP servers let an assistant read configuration and manage services across an account, and the Agents SDK builds stateless remote MCP servers on Workers.

Sourcedevelopers.cloudflare.com/agents/agent-class/callable-methodsread 2026-11-05

Outside code drives sandboxes through the open source @vercel/sandbox JavaScript and TypeScript SDK, the Python SDK in the vercel package and the sandbox CLI, covering creation from images or snapshots, commands, files, network policy updates, snapshots, drives, tags and listing. Authentication uses Vercel OIDC tokens or access tokens, so sandboxes can be driven from Vercel Functions, other clouds or CI systems.

Sourcevercel.com/docs/sandbox/sdk-referenceread 2026-11-05

Agents can be tested before release. The Workers Vitest integration runs tests against an agent in the real runtime, checking its responses, methods and state, the agents starter template ships with it configured, and wrangler dev runs the agent locally. Nothing scores model output or compares an agent's behavior across versions.

Sourcedevelopers.cloudflare.com/agents/getting-started/testing-your-agentread 2026-11-05

There are no test cases, scoring or quality gates of the product's own. Harbor runs Terminal Bench and other benchmark trials in sandbox microVMs, and Scale AI's AgentEnv evaluates agents in separate environment and agent sandboxes, but those harnesses do the scoring, not Sandbox.

Sourcevercel.com/docs/sandbox/ecosystemread 2026-11-05

Agents drive a real Chrome through Browser Run, which runs on the Workers Free and Paid plans. Model written code sends any Chrome DevTools Protocol command to a live session to navigate, run JavaScript, read the DOM and capture screenshots, and the agent can return to the same browser on later turns with its tabs, cookies and login intact while the session stays alive, up to 10 minutes idle by default. Quick actions return a page as Markdown, extracted data, its links or scraped elements. Live View and session recording, which let a person watch or replay a session, are in beta.

Sourcedevelopers.cloudflare.com/agents/tools/browserread 2026-11-05

No browser or desktop for an agent to drive comes with the product. The managed images carry language runtimes, coding agents and utilities, and an agent that needs a browser has to install and run one itself inside the microVM.

Sourcevercel.com/docs/sandbox/concepts/imagesread 2026-11-05