Plimsoll

Plimsoll is an Apache-2.0 sandbox service for running code written by an AI agent or another untrusted source. Its distinguishing contract is not merely that a run is called a sandbox: each result reports the isolation tier actually used, and a caller can require a minimum tier before anything is dispatched. The project lists process, container, kernel, and vm in ascending strength. A request that cannot meet its floor is refused rather than silently running with weaker isolation.

What it provides

Reported isolation, not a marketing label: clients receive the provider and tier for every run. The daemon checks the configured provider at startup, while the client can check the result again.
Several execution backends: local QuickJS in WebAssembly is for development only; Docker can use runc or gVisor; hosted E2B and Docker Cloud Sandboxes provide VM-backed options. The available boundary depends on the selected provider and configuration.
Credential broker and grants: a run can call explicitly permitted routes through a broker. The broker, outside the sandbox, attaches a per-run credential, so the code does not receive the underlying API key or unrestricted network access.
Run records: requests and results carry hashes. The separate plimsoll-attest program can sign checked records, reject a missing link, and replay a run.
Agent-framework integrations: the repository documents packages or guides for Vercel AI SDK, Google ADK, Agno, CrewAI, Trigger.dev, and Mastra, plus MCP-oriented deployment patterns.

A practical workflow

Start with an agent task that needs to execute a small transformation or test. Run the provided go run ./examples/minimal example first: it needs no daemon or credential, but it is explicitly a process tier example and is not a boundary for hostile code. For code you do not trust, configure a provider such as Docker with gVisor or a VM provider, set a minimum isolation tier in the caller, and allow only the exact API routes needed through a grant. Record the returned tier and run record alongside the agent result, then make a deliberately disallowed request to verify that it is refused before rollout.

Pricing and limits

Plimsoll is free, self-hosted Apache-2.0 software. It has no first-party hosted price table. You pay for the infrastructure and any provider you choose, such as Docker hosts, E2B, Docker Cloud Sandboxes, and the model or API services used by the agent. Do not assume that a vm tier is free, or that a local Docker setup offers VM isolation.

How it compares

E2B is a hosted SDK for microVM sandboxes; Plimsoll can use E2B but adds its own minimum-tier contract, grants, and run-record handling. OpenSandbox supplies a general sandbox protocol and runtimes. Plimsoll is narrower: it focuses on making the execution boundary and a run's evidence visible to the caller.

Risks and next step

The maintainers describe Plimsoll as pre-1.0, single-author software with no third-party security audit and intentionally breaking changes. Its reported tier is provider evidence, not hardware attestation. Treat its policies and backend configuration as part of your security review, especially for sessions that retain files or interpreter state. Read the getting-started guide, try a refusal path, and only then connect an agent that can handle sensitive code or credentials.

FAQ

Does Plimsoll make untrusted code safe by itself?

No. It reports and enforces the configured boundary, but the effective protection depends on the provider, policy, host, and threat model. The local process provider is explicitly unsuitable for hostile code.

Can an agent call an API without seeing its key?

Yes, when you configure a grant and broker route. The broker attaches a minted credential outside the sandbox; unlisted routes are not permitted by that grant.