What counts as a sandbox hour?+-
One sandbox-hour is one hour of a standard sandbox (up to 4 vCPU, 2 GB RAM). Larger configurations consume proportionally more. Billed per-second.
Can I try without a credit card?+-
Yes. The Sandbox tier is free forever with 25 hours/month. No credit card required.
What happens if I exceed my plan limits?+-
On the Sandbox tier, your sandbox queues until next month. On Launch and Scale, you pay overage at your tier's rate (€0.19/hr or €0.15/hr). We'll notify you at 50%, 80%, and 100% of your allowance.
Do you offer annual billing?+-
Yes. Annual Launch is €15/month (billed €180/year). Annual Scale is €63/month (billed €756/year). Both save 20%.
What's included in all templates?+-
Every tier gets access to all sandbox templates: playground (Rust, TypeScript, JavaScript, PHP, SQL, Zig), Python 3.11, Node.js 20, and AI tool templates (Claude Code, Codex, Gemini CLI).
What are Claude Managed Agents?+-
Claude Managed Agents let Anthropic run the agent loop, model, and skills while every tool call (bash, read, write, edit, glob, grep) executes inside an isolated OmniRun Firecracker microVM. With a self-hosted environment, those tool calls run on your own infrastructure via a worker that polls Anthropic's work queue.
Does Anthropic see my code with self-hosted sandboxes?+-
Tool calls run inside microVMs on your own box, so the files and repositories stay in your perimeter. Anthropic still runs the model, so your prompts and the conversation flow through Anthropic's API -- that part is governed by your Anthropic data agreement. The setup is eligible for Anthropic's ZDR and HIPAA-BAA programs.
Where are sandboxes hosted?+-
Hetzner data centers in Germany (EU). All data stays in the EU. SOC 2 Type II audit in progress.
Can I restrict which hosts a sandbox can reach?+-
Yes. Untrusted code runs with no network by default (internet: false is a true L3 air-gap); agent templates default to full egress since real agents need package registries and git. internet: true forces full outbound, internet: false air-gaps. For something in between, an opt-in SNI egress proxy restricts a sandbox to an allow-list of hosts -- it inspects each TLS handshake and only forwards connections whose server name matches your list. It is off by default and, when enabled, blocks every host not listed (including package registries like pypi or npm), so enable it for workloads that don't need them.