v0.1 prototype · MIT · open source

Code mode, sandboxed.

Code mode means your agent writes one script that calls your tools. modebox runs that script in a WebAssembly sandbox and pauses it mid-run when a call needs you. A fresh sandbox starts in about 0.2 ms.

$ npm install modebox

$ pip install modebox

$ cargo install modebox

macOS and Linux · Windows isn't supported yet

sandbox · mb_7f3a2crunning

01const overdue = await db.find({ overdue: true });

booted from snapshot · ~0.2 ms4 KiB pages

01 pause

How a pause works

modebox freezes the run where it stopped, keeps only what changed, and picks it back up after you say yes. Nothing runs twice.

02 inside

What runs where

The agent's code runs in a sealed box. Its only way out is one door, where modebox lets a request through, asks you, or says no. Everything else is out of reach.

03 at a glance

Memory map

addresssegmentwhat it doescost

0x0000engineQuickJS-ng in WebAssembly. Booted once, copied per run.~0.2 ms

0x4000boundaryOnly the tools you hand it. MCP servers become typed functions.2 imports

0x8000pauseSeals the run into a token, ~16 KB in our benchmark. Resume later, in any process with the same key; nothing re-runs.single-use

0xC000filesOne API over local, S3, R2, GCS and Azure. Writes wait for you.staged

0x10000shellsh() under Seatbelt or bubblewrap + seccomp. Network off, or listed hosts only.per host

04 use it

Pick how you run it

Over MCP, or from your own code.

$ cargo install modebox

modebox.json

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"]
    }
  },
  "approve": ["github.*"]
}

$ claude mcp add --scope project modebox -- modebox mcp -c modebox.json

$ npm install modebox

agent.ts

import { createRunner, requireApproval } from "modebox";

const runner = createRunner({ continuationSecret: process.env.SECRET });
const hostFunctions = {
  payments: { refund: requireApproval(refund) },
};

// `script` is the code your agent wrote.
const r = await runner.run({ source: script, hostFunctions });

if (r.status === "interrupted") {
  // Later, even in another process:
  await runner.run({
    hostFunctions,
    continuation: r.continuation,
    resolutions: [{ interruptionId: r.interruptions[0].id, value: true }],
  });
}

$ pip install modebox

agent.py

import asyncio
import os
import modebox

runner = modebox.Runner(continuation_secret=os.environ["SECRET"])
host_functions = {"payments": {"refund": modebox.require_approval(refund)}}

async def main():
    # `script` is the code your agent wrote.
    r = await runner.run(script, host_functions=host_functions)

    if r.status == "interrupted":
        # Later, even in another process:
        await runner.run(
            host_functions=host_functions,
            continuation=r.continuation,
            resolutions=[modebox.approve(r.interruptions[0].id)],
        )

asyncio.run(main())

$ cargo add modebox-core anyhow tokio -F tokio/full

main.rs

use modebox_core::*;

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    let engine = Engine::new()?; // seals tokens with $MODEBOX_SECRET
    let mut tools = Toolbox::new();
    tools.add(Tool::new("payments.refund", refund).approval(Approval::Always));

    // `script` is the code your agent wrote.
    let r = engine.run(script, &tools, RunOptions::default()).await;

    if let Outcome::Suspended(s) = r.outcome {
        // Later, even in another process with the same $MODEBOX_SECRET:
        let approve = [(s.interrupts[0].id, Resolution::Approve)];
        engine.resume(&s.continuation, approve, &tools, RunOptions::default()).await;
    }
    Ok(())
}

opencode, Codex, Cursor and other agents: the setup guide.

Claude Code
opencode
Codex
Cursor
T3 Code
Node
Python
Rust