The sandbox every AI agent should have been born with.
Every agent you run today has the keys to everything — your tools, your data, your infra. sypho gives it a sandbox instead: real boundaries it can't talk its way out of, enforced before any call reaches a real system.
Or see how the sandbox works →Every tool call gets inspected before it runs.
Not validated by convention, not trusted by default. Four checks, in order, on every single call — whether the model asked for it on purpose or hallucinated it.
Agent requests a tool
The model decides to call refund_payment, structured_data_save, whatever it has access to.
Runtime checks scope
Matched against the run's exact allowed tools — by name, glob, or pattern — and its remaining budget.
Call is marked
Allowed, denied, or held for a human to approve — decided by policy, not by what the agent intended.
Requires approvalResult hits the trace
Every call and its outcome is written to the run's trace — reachable by one deployment, one version, one run.
Four controls. One enforcement point.
Not a dashboard you configure and hope the agent respects. These are checks the runtime makes — the agent has no path around them.
Network-sealed sandbox
Every run gets its own container with no route to the outside — only the gateway sidecar can reach the network.
Exact tool scope
Tools are declared by exact name, glob, or pattern. Anything else is rejected before it reaches a real upstream.
Policy-held actions
Flag a tool as requiring approval and the runtime pauses it for a human — the agent can't talk its way past it.
Full run trace
Every call, result, and dollar spent — connected back to the exact deployment version that produced it.
Local, your cloud, your customer's cloud, or ours.
The runner is a lightweight binary plus Docker — the same network-isolated sandbox, wherever it runs.
Specifics, not promises.
Infrastructure claims should be checkable. Not "trust us" — here's exactly what's enforced and how.
tool_scope is frozen at creation from the deployment's manifest. Matching is exact name, glob, or /regex/ — a deny pattern always beats an allow pattern.require_approval. A matching call is blocked and surfaced to a human before it executes — independent of whether the agent asked nicely.read or read_write, scoped to specific keys, and can only be narrowed per run — never widened.Bring the framework you already use.
A manifest and a handful of environment variables — point your model client at the gateway and it's enforced for free.
$ sypho build --version 0.1.0
$ sypho deploy --version 0.1.0
$ sypho run my-agent:0.1.0