ephemora-cell vs OpenSandbox
Capability-based WASM sandbox for MCP tools and agent-generated code: wasmtime + WASI with fuel, memory, time and I/O caps per run, sub-ms warm execution and signed (JCS/ES256) execution records. — versus — CNCF-landscape sandbox platform for AI agents: multi-language SDKs, unified API, CLI and MCP over Docker/Kubernetes runtimes — coding agents, GUI agents, evals and RL training.
opensandbox exposes sandboxes over Docker/K8s via SDKs and MCP; Cell is the in-process WASM alternative when you don't need a whole OS per execution.
| ephemora-cell | OpenSandbox | |
|---|---|---|
| Stars | 40 | 15k |
| Forks | 5 | 1.4k |
| Language | Python | Python |
| License | Apache-2.0 | Apache-2.0 |
| Last activity | yesterday | 2 days ago |
| Topics | security, agents | agents, local |
| Curated connections | 6 | 5 |
ephemora-cell — the curator's take
Use Ephemora Cell when the thing you need to run is small, untrusted and frequent - an MCP tool, a plugin, a snippet the agent just wrote - and you want a receipt: every run returns status, fuel consumed, elapsed ms and the enforced policy in a canonicalized, signable record. 0.17 ms warm start beats any container or microVM by orders of magnitude. The catch is the WASM boundary: your workload has to compile to a .wasm/WASI module, so this is not 'run arbitrary Python or a Docker image'. For full-OS sandboxes (shell, packages, browsers) reach for cubesandbox, forkd, superserve or opensandbox instead; Cell sits *under* an MCP server as an execution primitive, not beside it as a platform. 40 stars, one author - solid tests (424) but treat the signing story as early.
OpenSandbox — the curator's take
The platform play in agent sandboxing: one API over Docker and Kubernetes runtimes, SDKs in multiple languages, an MCP server, and OpenSSF/CNCF hygiene — built for the org that needs sandboxes as shared infrastructure across coding agents, GUI agents, eval harnesses and RL training, not a per-project tool. NOT the isolation ceiling: container runtimes trade the hard KVM boundary microVM sandboxes give you for operational familiarity — if untrusted code is the threat model, weigh a Firecracker-class runtime instead; if platform ergonomics on your existing K8s is the goal, this is the mature option.