Boxwren

Run untrusted agent code without trusting it.

Local-first WebAssembly sandbox. Deny-by-default fuel, memory, wall clock, filesystem, network, and environment — plus a kill switch and a stable execution report.

Install GitHub

Install

Library on crates.io. CLI on GitHub Releases. Python on PyPI.

cargo add boxwren

# CLI from a release (example: macOS arm64)
curl -L https://github.com/rejisterjack/boxwren/releases/latest/download/boxwren-aarch64-apple-darwin \
  -o boxwren && chmod +x boxwren
./boxwren demo

pip install boxwren-py

Features

One engine per process. Each run gets its own store, fuel, memory, and deadline.

Deny by defaultNo directories, network, or environment unless you grant them.
Hard limitsFuel, memory, wall clock, module size, and capped stdio.
Kill switchStop one run from another thread. Timeout is timed_out, not killed.
Execution reportSchema version 1 JSON: status, fuel, peak memory, filesystem / network / env events.
Library + CLI + bindingsRust crate, CLI, Python (PyO3), Go via C ABI.

Docs

Honest boundaries. Software fault isolation is not a VM.

Architecture Threat model Benchmarks Hosted Integrations docs.rs

Hosted & integrations

Optional boxwren-server API with accounts and API keys. Admit runs with Keywarden; snapshot reports in Undoom. Still SFI — not a hypervisor.

Open dashboard