Vercel Sandbox
Also known as: Vercel Sandboxes, @vercel/sandbox
Vercel Sandbox runs untrusted and agent generated code in Firecracker microVMs on Vercel's cloud, with persistence by default, an egress firewall that brokers credentials, and billing on active CPU time.
Vercel Sandbox runs untrusted and agent generated code in isolated Linux microVMs on Vercel's infrastructure. It is a product of Vercel, Inc., sold inside Vercel's Hobby, Pro and Enterprise plans beside its frontend cloud, and teams use it for code interpreters, coding agents, AI app builders, clean test environments and benchmark runs.
Each sandbox is a Firecracker microVM with a dedicated kernel and root access that starts in milliseconds from a managed image, a custom image in Vercel Container Registry or a snapshot, with a 64 GB disk and up to 32 vCPUs and 64 GB of memory on Enterprise. Sandboxes are persistent by default, so stopping one snapshots its filesystem and the next SDK call resumes it. A session lasts up to 45 minutes on Hobby and 24 hours on Pro and Enterprise, while a persistent sandbox can be resumed indefinitely.
The firewall switches between allow all, deny all and allowlists by domain or address range at runtime, brokers credentials into outbound requests so secrets never enter the sandbox, and can route traffic through the customer's own proxy. Drives, in public beta, add storage that outlives a sandbox and can be shared between agents, and multi agent sandboxes give each agent its own Linux user and home directory.
Pricing is usage based. Pro and Enterprise pay $0.128 per hour of active CPU, counted only while code is using the CPU, $0.0212 per GB hour of provisioned memory and $0.60 per million sandbox creations in iad1, with rates varying by region, while Hobby includes 5 CPU hours, 420 GB hours of memory and 5,000 creations a month at no charge. Vercel's infrastructure holds SOC 2 Type II, access follows Vercel's team and project roles, and sandboxes run in 19 regions chosen per sandbox, with static IPs and VPC peering through Secure Compute.
Vercel Sandbox fits teams already building on Vercel or with the AI SDK that want isolated execution with fine grained egress control and billing that skips time spent waiting on model calls. It fits less well where a buyer needs to run sandboxes inside its own cloud or data center, wants running processes and memory kept across a pause, or needs a browser or desktop for its agents, since the product restores the filesystem only and ships no browser.
Vendor details
Canonical URL
https://vercel.com/docs/sandbox
Category
Agent infrastructure
Funding status
Vercel Sandbox is a product of Vercel, Inc., sold as part of the Vercel cloud platform.
Company status
first party product
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
The @vercel/sandbox JavaScript and TypeScript SDK, the Python SDK and the sandbox CLI drive sandboxes from Vercel Functions, other clouds or CI. Integrations cover the AI SDK, Chat SDK, LangChain, Mastra, Flue, TanStack AI, the OpenAI and Anthropic SDKs, the OpenAI Agents API, Cursor Cloud Agents, Devin Outposts, Herdr, Hermes, OpenCode, Paseo, Harbor, Scale AI AgentEnv and Box Mount, with custom images stored in Vercel Container Registry.
In practice
Your AI app writes Python, and that code has to run without touching production. Vercel Sandbox runs each script in its own Firecracker microVM with outbound traffic denied, and bills only the CPU time the code actually uses.
Your agent must call GitHub and your model provider, but you can't hand it the tokens. The sandbox firewall adds the credentials to requests for those two domains on the way out, so the code inside never sees them.
Your coding agent's workspace has to survive between tasks. A persistent sandbox snapshots its files when it stops and resumes from them on the next call, with a Drive holding notes that several agents share.
Sources & related URLs
Research sources
Agentic Index coverage score
6.0 / 14 capabilities · 43%
| Integrations & Tool Calling | Partial |
|---|---|
|
Credentials reach outside services without entering the sandbox. The firewall's credentials brokering adds an authorization header to outbound requests for named domains, with matchers on path, method, query and headers, request proxying sends chosen traffic through a proxy the customer runs, and Box Mount presents Box content to the agent as local files. The tools an agent calls with those credentials are the customer's own code, and the product carries no integration catalog or tool framework. Sourcevercel.com/docs/sandbox/concepts/firewallread 2026-11-05 |
|
| Workflow Orchestration | Not documented |
|
There is no workflow logic in the product. Commands run blocking or detached from the customer's code, and lifecycle hooks run setup when a sandbox is created or resumed. Multi agent sandboxes give each agent its own Linux user and private home directory and share files through groups, which separates agents inside one machine without sequencing, routing or retrying their work. Sourcevercel.com/docs/sandbox/concepts/persistent-sandboxesread 2026-11-05 |
|
| Knowledge Grounding & RAG | Not documented |
|
No retrieval index or knowledge base over the customer's content comes with Sandbox. Files on the sandbox disk, Vercel Drives and S3 buckets mounted through FUSE are storage the agent's code reads, and any search or embedding layer runs as the customer's own code inside the microVM. Sourcevercel.com/docs/sandboxread 2026-11-05 |
|
| Human Oversight & Guardrails | Not documented |
|
Sandbox has no approval step, review queue or escalation to a person. The firewall can switch a running sandbox to deny all or narrow its allowed domains without a restart, which limits what an agent's code can reach but does not hold an action until someone reviews it. Sourcevercel.com/docs/sandbox/concepts/firewallread 2026-11-05 |
|
| Security, Identity & Governance | Full |
|
Vercel's infrastructure holds SOC 2 Type II. Access to sandboxes follows Vercel's team roles (Owner, Member, Developer, Security, Billing, Viewer and Contributor) and, on Enterprise, project roles for administrators, developers and viewers, with permission groups for finer grants, and the SDK authenticates with project scoped OIDC tokens or access tokens. Each sandbox runs in its own Firecracker microVM with a dedicated kernel, and the firewall restricts egress by domain or address range and injects credentials so code inside never holds them. Sourcevercel.com/docs/rbac/access-rolesread 2026-11-05 |
|
| Observability & Auditability | Partial |
|
Each sandbox has a dashboard page with its configuration, an activity log of lifecycle events and its snapshots, the CLI lists every session a sandbox has run, and the Observability tab charts CPU and memory per sandbox, with alert monitors on Observability Plus. Command output streams through the SDK, and request proxying can route chosen traffic through a customer proxy for logging. What an agent decided between commands is not recorded, since the agent's loop runs in the customer's code. Sourcevercel.com/docs/sandbox/concepts/persistent-sandboxesread 2026-11-05 |
|
| Memory & State Persistence | Partial |
|
Sandboxes are persistent by default. When a session stops, its filesystem is snapshotted automatically and the next SDK call resumes from it, snapshots can be kept for a set period or indefinitely, and Vercel Drives, in public beta, keep files across sandbox runs and can be shared between agents. The product does not remember anything for the agent. An agent keeps notes on a drive only when the application gives it file tools and instructions to do so, and running processes restart on resume. Sourcevercel.com/docs/sandbox/concepts/persistent-sandboxesread 2026-11-05 |
|
| Deployment & Data Residency | Full |
|
Sandboxes run in 19 regions, chosen per sandbox or set as a project default, with iad1 as the default, and snapshots and drives stay in the region they were created in. Secure Compute sends a sandbox's internet traffic through static IPs and reaches the customer's own AWS VPC over VPC peering. Sandboxes run only on Vercel's infrastructure. Sourcevercel.com/docs/sandbox/pricingread 2026-11-05 |
|
| Prebuilt Agents / Templates / Packs | Partial |
|
The default universal image ships Node.js, Python and coding agents, rebuilt nightly from open source definitions, and one CLI command starts OpenCode, Pi, Claude Code or Codex inside a sandbox. Integrations cover Cursor Cloud Agents, Devin Outposts, Herdr, Hermes and Paseo, frameworks such as the AI SDK, LangChain, Mastra, Flue and TanStack AI, and the OpenAI Agents API. These are configured third party agents and building blocks, not prebuilt agents of Vercel's own. Sourcevercel.com/docs/sandbox/ecosystemread 2026-11-05 |
|
| Triggers & Channel Coverage | Not documented |
|
Work reaches a sandbox only when the customer's code or the CLI calls it. A stopped persistent sandbox resumes on the next SDK call that needs a running machine, and exposed ports serve traffic at a public URL while a session runs, but no schedule, webhook or inbound event starts or wakes a sandbox on its own. Sourcevercel.com/docs/sandbox/concepts/persistent-sandboxesread 2026-11-05 |
|
| Model Flexibility & Routing | Full |
|
The customer chooses the agents and models that run in a sandbox. Any coding agent or framework can run inside it and model calls happen in the customer's code, and Vercel's examples route them through its optional AI Gateway with many providers or the customer's own keys. Sandbox itself imposes no model. Sourcevercel.com/docs/sandbox/ecosystemread 2026-11-05 |
|
| APIs / SDKs / MCP Extensibility | Full |
|
Outside code drives sandboxes through the open source @vercel/sandbox JavaScript and TypeScript SDK, the Python SDK in the vercel package and the sandbox CLI, covering creation from images or snapshots, commands, files, network policy updates, snapshots, drives, tags and listing. Authentication uses Vercel OIDC tokens or access tokens, so sandboxes can be driven from Vercel Functions, other clouds or CI systems. Sourcevercel.com/docs/sandbox/sdk-referenceread 2026-11-05 |
|
| Testing, Debugging & Optimization | Not documented |
|
There are no test cases, scoring or quality gates of the product's own. Harbor runs Terminal Bench and other benchmark trials in sandbox microVMs, and Scale AI's AgentEnv evaluates agents in separate environment and agent sandboxes, but those harnesses do the scoring, not Sandbox. Sourcevercel.com/docs/sandbox/ecosystemread 2026-11-05 |
|
| Browser / Computer-use | Not documented |
|
No browser or desktop for an agent to drive comes with the product. The managed images carry language runtimes, coding agents and utilities, and an agent that needs a browser has to install and run one itself inside the microVM. Sourcevercel.com/docs/sandbox/concepts/imagesread 2026-11-05 |
|
The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded
Pricing
Free allotment on Hobby, then $0.128 per active CPU hour and $0.0212 per GB hour of memory on Pro.
Active CPU hours, provisioned memory GB hours and sandbox creations
Included quota
Hobby includes 5 active CPU hours, 420 GB hours of provisioned memory, 5,000 creations, 20 GB of data transfer, 15 GB of snapshot and 15 GB of drive storage, with 10 concurrent sandboxes and 45 minute sessions. Pro allows 10,000 concurrent sandboxes, 24 hour sessions and up to 8 vCPUs and 16 GB per sandbox, and Enterprise up to 32 vCPUs and 64 GB.
What is public
Vercel publishes every Sandbox meter with its iad1 rate, the Hobby allotment, concurrency, session, vCPU, memory and disk limits per plan, and worked cost examples.
Billing mechanics
Active CPU counts only the time code is using the CPU, so waiting on model calls costs nothing in CPU, while memory is billed on the amount provisioned for as long as the sandbox runs, in one minute increments. Each sandbox creation is a separate meter, and snapshots and drives bill per GB month.
Cost watchouts
Provisioned memory bills for the whole time a sandbox runs, idle or not, and automatic snapshots of persistent sandboxes bill as snapshot storage until they expire. Traffic to exposed ports and data sent out to the internet are billable, while downloads into the sandbox are free. Rates outside iad1 differ by region.
Variable cost rationale
Cost follows CPU time actually used, memory provisioned while a sandbox runs, the number of sandboxes created and stored snapshots, so long sessions or large fleets cost many times a short test.
Additional watchouts
A default 2 vCPU sandbox with 4 GB of memory costs about $0.085 an hour in memory alone while it runs, plus active CPU at $0.128 an hour per busy vCPU.
Overage / add-ons
Hobby pauses sandbox creation once its allotment is used. Pro usage draws first on the plan's $20 monthly credit and is then billed at the rates shown.
Sales call required
Mixed (some tiers require a call)
Free / trial
Hobby includes 5 active CPU hours, 420 GB hours of memory and 5,000 sandbox creations a month
Lowest paid plan
Pro usage at $0.128 per active CPU hour and $0.0212 per GB hour of memory
Commercial notes
Sandbox is bought through a Vercel Hobby, Pro or Enterprise plan, alongside Vercel's frontend cloud, AI Gateway and v0.
Key ambiguities
Enterprise pricing and quotas are custom, and per region rates outside iad1 sit behind a region selector.
Missing data
Enterprise rates and the Pro plan's own seat price sit outside the Sandbox price list.
Related vendors
- AgentOps — Agent observability and debugging platform: open source SDKs trace…
- AgentPhone — AgentPhone gives the AI agents a team builds their own US or…
- Agno — Python agent framework and AgentOS runtime (formerly Phidata) for…
- AIsa — Resource and payment gateway for AI agents, with one key to 110+…
- Albato — Albato is a no code integration platform that sells an embedded,…
- AlphaBitCore — AI control plane for regulated financial firms: one gateway enforces…