SandBase Harness
Local-first AI agent runtime and MCP bridge with sandboxed sessions, memory, credentials, and audit replay.
- Source repo
- sandbaseai/sandbase-harness
- Stars
- ★ 635
- Last updated
- 11d ago
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 52/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- For developers needing to run generated code safely, use the local Docker sandbox to isolate tool executions.
- Not a fit if
- Teams wanting a one-command install without cloning and building from source
- Teams that need strong isolation out of the box without hardening
- Source review
- 52/100 · Major gaps
What does this agent do, and when should you use it?
SandBase Harness is a local-first, self-hosted runtime for AI agents, offering session management, sandboxed execution, tool governance, memory, credential vaults, and audit/replay. It includes a built-in console and integrates with MCP, listed on the official MCP Registry. The runtime supports multiple sandbox backends including local, Docker, Kubernetes, and self-hosted workers. It is model-agnostic, supporting OpenAI, Anthropic, and OpenAI-compatible providers like DeepSeek V4. Installation is straightforward via npm, with data stored locally in SQLite and files, requiring no hosted control plane. The project is widely referenced across many community directories and actively submitted to awesome lists.
SandBase Harness provides a CLI to initialize and start the runtime; once running, it offers persistent sessions, resumable event streams, audit logging and replay, MCP toolsets, credential vaults, and permission policies, all accessible via a local console. It executes tool calls within sandboxed environments (local, Docker, Kubernetes, self-hosted workers) and connects to multiple model providers through adapters. It implements MCP server standards, exposing tools for agents to use.
- For developers needing to run generated code safely, use the local Docker sandbox to isolate tool executions.
- For teams managing long-running agents, leverage persistent sessions and audit replay to monitor and debug.
- For organizations controlling agent tool access, configure MCP toolsets, credential vaults, and approval policies.
- For users wanting to switch between multiple models like OpenAI, Anthropic, and DeepSeek, use the unified adapter interface.
- For privacy-conscious users, deploy fully on-premises with data staying within your own infrastructure.
How do you install or deploy this agent?
Clone the repository and enter the directory: git clone --branch v0.3.8 --depth 1 https://github.com/sandbaseai/sandbase-harness.git && cd sandbase-harness. Install dependencies and build: npm ci && npm run build.
How do you use this agent?
Create a new agent project directory and initialize it: mkdir ../my-agents && cd ../my-agents && node ../sandbase-harness/dist/index.js init. Start the runtime: node ../sandbase-harness/dist/index.js start. Then open the local console at http://127.0.0.1:3000/dashboard.
What are this agent's strengths and limitations?
- Genuinely local-first, no hosted control plane required.
- Supports multiple execution sandboxes including Docker and Kubernetes.
- Includes audit logging and replay for traceability.
- Model-agnostic with adapters for multiple providers.
- Listed on the official MCP Registry, enhancing discoverability.
- Requires Node.js and npm for installation and build.
- Deploying to Kubernetes requires additional configuration.
- Isolation level depends on chosen backend; may need hardening.
- Community directory listings may lag; always refer to official sources.
How does this agent compare with similar options?
Unlike SandBase CLI, which is a lightweight bridge for connecting many clients, Harness provides a full runtime with sandboxing and session management.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| SandBase Harness This agent | 52 · Major gaps | CLIFree + model costs | ★ 635 | 11d ago | TypeScript | OpenAI API · Claude API |
| Auto Browser | 62 · Some gaps | Self-hosted serviceFree + model costs | ★ 914 | 3d ago | Python | OpenAI API · Claude API |
| OpenBot: AI Coworkers You Can Trust with Real Work | 57 · Major gaps | Self-hosted serviceFree + model costs | ★ 6.9k | today | TypeScript | — |
| ByteChef | 53 · Major gaps | Self-hosted serviceFree + model costs | ★ 1k | today | Java | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows role-based access control (API keys, CORS, sandboxing) but lacks fine-grained least privilege. User confirmation exists but partial. Data flow transparency via audit logs but not explicit. Sensitive data handling: tokens encrypted in tests, but not comprehensive. Dependency security: no vulnerability scan evidence. External effects: sandboxing indicates control but not detailed. Rollback: replay exists but not explicit rollback. Source attribution: not clear.
Self-consistency: code and tests align but not fully verified. Dependency availability: versions not pinned, affecting reproducibility. Failure messages: good error handling in tests but not comprehensive.
Audience and scenarios: clear from README. Capability boundaries: documented but not exhaustive. Trigger precision: not specified. Environment fit: supports multiple backends but configuration details lacking.
Information architecture: clear. Install notes: provided. Naming stability: versioned. Examples and FAQ: examples but no FAQ. Known limitations: not listed. License: Apache-2.0. Versioning changelog: present. Maintenance responsibility: not explicit.
Output usability: clear API with tests. Marginal value: unique local-first runtime. Cost benefit: no performance or cost data.
Claim traceability: README claims not fully mapped to code. Cross-source corroboration: multiple directory listings but not independently verified. Fact-inference separation: mixed.
- Publisher identity unverified; treat with caution.
- Dependency versions not pinned, affecting reproducibility.
- User confirmation mechanisms are partial; sensitive operations may lack prompts.
- Numerous external directory links in README; verify independently.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v0.3.8 SandBase Harness v0.3.8
Release notes excerpt
Highlights - Git-hosted DSH installs now build missing dist/ entries through prepare. - Runtime metrics count model usage once per model request and persist session token aggregates. - Confirmed tool calls are validated against raw AI SDK v4 stream lifecycle data, with malformed, incomplete, duplicate, and projection-only calls rejected. - Agent Plugin, MCP Registry metadata, README, DSH examples, and deployment docs are aligned to v0.3.8. Verification - TypeScript typecheck passed. - 596 tests passed; 14 environment-specific tests skipped. - Runtime and Console builds passed. …View on GitHub ↗ -
v0.3.7 SandBase Harness v0.3.7
Release notes excerpt
DeepSeek Harness clean-profile fix This release fixes the deterministic startup failures found while reproducing dshbase L3 verification. Fixed - Optional MCP environment variables remain string-valued when unset, satisfying the DSH MCP client schema. - The bundle launches its MCP entry from the package installed in the DSH Web profile, with no global npm link or custom PATH required. - DSH installation now uses the pinned source checkout directly instead of resolving the unrelated unscoped npm package. Real DSH verification …View on GitHub ↗ -
v0.3.6 SandBase Harness v0.3.6
Release notes excerpt
Operations Console hotfix SandBase Harness v0.3.6 restores the documented operations API and makes the advanced Console screens usable from the primary application shell. Fixed - /v1/webhooks, /v1/scheduled-deployments, /v1/outcomes, and session outcome evaluation now resolve as documented. - Existing /v1/x operations paths remain available for compatibility. - Webhooks, Scheduled Deployments, and Outcomes appear in Console navigation and render their intended screens. …View on GitHub ↗