cage-bro

A sandboxed execution environment for AI agents. Single Rust binary with browser, shell, code execution, file ops, and MCP server.

📖 **[Guide: isolated workspaces for fleets of agents →](https://github.com/aeroxy/cage-bro/blob/main/GUIDE.md)** — run many agents on one box, each jailed to its own workspace, or drive a clean remote sandbox in a VM.

Why cage-bro

	Claude Desktop sandbox	Docker sandbox	cage-bro
Works with	Claude only	Any	Any agent (LangChain, CrewAI, OpenAI, custom)
Browser	None	Manual setup	Obscura (stealth, CDP)
Code exec	None	Any (manual)	Python, Node, Jupyter + any language via shell
Terminal	None	Full	Full PTY
Self-hosted	No (Anthropic controls it)	Yes	Yes, your infra
API	Claude Desktop only	None (manual)	REST + MCP
Memory	N/A	~2GB per container (Chromium)	~100MB per sandbox
Init time	N/A	Seconds	~1ms
Density	N/A	1 container per VM	20+ sandboxes per 1c1g VM

Claude's sandbox is a security layer. Docker is a general-purpose container. cage-bro is an agent execution environment.

**Why use cage-bro:**

1. Framework-agnostic — one sandbox for all your agents, not per-vendor
2. Browser + code + shell + files — full agent runtime, not just tool isol