Engineering notes.

boxxkite's auth and abuse-control surface

The control-plane fronts a service that runs untrusted code. Its auth surface isn't one gate — it's a dual-credential model, MCP OAuth 2.1, browser-bound social login, optional SSO/SCIM, and a rate-limit bucket on every mutating route.

Run the control-plane locally, on SQLite, in one command

The multi-tenant control-plane runs zero-config against a throwaway SQLite database. Here's the real signup → login → API key → sandboxes flow you can exercise on a laptop with no cluster.

Relicensing boxxkite from MIT to Apache 2.0

v0.2.2 relicenses the whole project from MIT to Apache 2.0 — no code changed. The point of the move is one thing MIT is silent on: an explicit patent grant.

Building a Multi-Tenant Control-Plane for Ephemeral Agent Workloads

Notes for a platform engineer asked to let every team run untrusted agent code, without turning it into a per-team reinvention of pod lifecycle management.

MCP Gives Your Coding Agent Root on Your Laptop

A local MCP server runs as your OS user, with your permissions, on your machine. That's not a bug in any one server — it's the entire local-MCP model.

Anatomy of an Agent Sandbox Escape: What Actually Stops rm -rf /

A walk through what happens, layer by layer, when an agent runs a destructive command inside a sandbox pod — and why no single layer is doing all the work.

The Hidden Cost of Hosted Agent Sandboxes

Real, cited per-second pricing from E2B and Modal, compared against real GKE node pricing — including the honest crossover point where self-hosting stops winning.

Why Docker Containers Aren't Enough for Autonomous LLM Agents

Containers share a kernel by design. Once an LLM agent is writing and executing its own code, that shared kernel is exactly the boundary an attacker needs to cross.

Git Access for Your Research Agent, Scoped to Exactly What It Needs

Why boxxkite makes git tools an explicit opt-in on top of a network-dark default, and how that lets a research team's agent commit back to a shared repo without an open internet connection.

Processing Every Customer's Contracts and Invoices Without Ever Mixing Them

How a legal-tech or accounts-payable SaaS runs OCR and document extraction for every customer in its own network-dark pod, with the full document stack pre-installed.

Don't Trust the Sandbox Claim — Verify It Against Your Own CNI

A look at exactly which kernel and network mechanisms make boxxkite's sandbox network-dark, and how to independently verify them on infrastructure you operate.

Keeping Quant Research On-Prem: A Self-Hosted Agent Sandbox for Banks

How a bank's platform team runs an internal quant-research agent with persistent Python sessions entirely inside its own Kubernetes cluster, with no network path out.

Multi-Tenant Code Execution for Your AI Coding Agent Startup

Why a two-to-three person startup building a vertical AI coding assistant can ship structural, per-tenant isolation on day one instead of hand-rolling a sandbox.

Give Your Own Claude Desktop, Codex, or Cursor a Real Sandbox

How to self-host boxxkite as a personal MCP sandbox so your coding assistant executes untrusted snippets in an isolated, network-dark pod instead of on your laptop.

Shipping human takeover, and the RBAC gap we shipped it with

An audit log, a live watch stream, and an interactive takeover terminal — plus the access-control tradeoff we accepted to ship it, disclosed rather than hidden.

Closing the last plaintext hop: manager-to-sidecar TLS

Every sandbox pod now gets a fresh, pinned, self-signed cert at creation time — no CA, no service mesh required, and one deliberate deviation from the original design doc.

Measuring session-start latency, and what we found when we did

The README claimed boxxkite's warm pool beats a cold start. We built a benchmark to check — twice — and the honest result wasn't what we expected.