Six honest reasons. If any of these sound like you, the answer is yes.
The situations everyone with an AI helper eventually hits, and what Nymra does about each one.
"My AI helper needs somewhere to actually work."
Nymra is that computer: locked down, disposable, and yours. When the job's done it goes to sleep and wakes later exactly where it left off.
"I've paid cloud bills for computers that just sat there."
A sleeping Nymra sandbox always costs $0. Parked work simply consumes nothing, and your agent's files stay safe on disk for as long as you want them.
"My AI needs a password to do its job."
You hand Nymra the password in a sealed envelope. The AI passes the envelope along; only Nymra opens it (in memory, for a moment) and scrubs every byte that comes back. The leak isn't forbidden. It's impossible.
"What did my AI just do?"
Every action lands on a receipt, hash-glued to the one before it. Change one letter anywhere and every receipt after it visibly breaks. Your AI keeps a diary it cannot forge, stamped nightly by an independent time authority.
"Runaway AI bills keep me up at night."
You fund a prepaid balance and set daily caps. When a cap is hit, a circuit breaker stops the work. The money physically can't be overspent. Every cent is receipted; ask for the honest bill anytime.
"A tool I loved got acquired, repriced, switched off."
Nymra runs on your machine. Your data is on your disk, your keys are in your hand, and a flat fee is the whole price. The only person who can turn it off is you.
The rented clouds rent you a meter.
Nymra hands you the keys.
Here's the whole difference in plain words. The big sandbox clouds run your AI agent on their computers and bill you by the second, including every minute it spends just thinking. Nymra puts the computer on your side of the fence and charges one flat monthly fee.
The rented clouds are a taxi that keeps the meter running at every red light. Your agent "thinking" is a red light: it happens constantly, and you pay full fare for it. Nymra is your own car in your own garage — the engine is off when you're not driving, and nobody texts you a bill for parking.
A Tuesday on the rented clouds
# 10:04 — your agent starts thinking 41 min of model reasoning… ✗ meter running the whole time — you pay full rate # the password it needs for its job $ echo $GH_TOKEN ghp_R8x4Lm2N… ← the real key, living in the room # 12:37 — you pause it while you're at lunch $ pause --resume-later ✗ "filesystem snapshot is incomplete" # 14:02 — the session timer runs out ✗ terminated: session limit reached unsaved work: gone. their docs say: assume it's lost # what actually happened in there? ✗ logs, if you're lucky — on their disk, in their format
The same Tuesday on Nymra
# 10:04 — your agent starts thinking 41 min of model reasoning… ✔ metered: $0.00 — receipt sandbox.thinkpause on your ledger # the password it needs for its job $ echo $GH_TOKEN {{SECRET:gh}} ← a placeholder. the real key never enters the room # 12:37 — you pause it while you're at lunch $ pause --resume-later ✔ fs-hash verified after resume — byte-identical, receipted # 14:02 — there is no session timer ✔ no cap exists to hit. it's your computer; it waits for you # what actually happened? $ keep receipts verify ✔ 5,204 receipts · chain intact · plain-English story at /m/
Same agent. Same work. One of them keeps the meter and the secrets and the logs. The other one keeps five things nobody else can give you, and hands you the keys. Estimate what your Tuesday costs ↓
Thirteen things your AI's new home does for you.
Plain words first, with the technical name in small type under each heading, for the people who like knowing exactly what's under the hood.
A locked-down computer
bubblewrap → docker → gVisor → KVM microVMFour levels of locked doors: from a sealed room to a full virtual machine with its own kernel. Nymra detects what your machine can do and picks the right door automatically. A fresh locked computer starts in ~26 milliseconds.
Sleep is free
stopped filesystem snapshots · resume on demandPark a mission for a day or a year. Its files stay safe on your disk. Wake it later, exactly where it left off. Cost while parked: zero. This is the single biggest line-item difference from the rented clouds.
Secrets in sealed envelopes
{{SECRET:name}} · in-memory resolve · output scrubbingYour AI writes a placeholder, never the real secret. Nymra swaps the real value in only inside the running command's memory, then scrubs it from every byte of output before anything is stored, logged, or receipted.
The diary that can't lie
HMAC hash-chain · RFC-3161 notary · git anchoringEvery exec, fork, decision, and cent: one receipt, cryptographically glued to the previous one. Tamper with one and every later link breaks visibly. Chain heads are stamped by a public time authority and pinned to git commits.
Try both doors
copy-on-write fork · CRIU freeze & resumeSplit a live, running mission into two identical copies: one reads the docs first, one wings it. Freeze a running mission like a saved game and resume it later, processes alive, exactly where they were.
May the best AI win
duel · winner/loser behaviors · boot-with-priorsRun both branches against your tests. The winner's habit (read the docs before the POST) is remembered and handed to the next agent you create. Losers teach too: their mistakes are inherited as warnings.
The spending seatbelt
prepaid credits · daily caps · circuit breaker → 402Caps, burn-rate forecasts, and a breaker that halts everything before the money runs out, not after. Work resumes when you choose. The bill cannot surprise you. Ever.
A leash on the internet
network=none by default · per-domain allowlist proxyNew sandboxes get no internet at all unless you grant it, domain by domain. Every allow and every deny lands on the receipt chain. Your AI can't wander where you didn't send it.
Every mission tells its story
keep story · plain English · receipt per lineWhat did it do, in order, in words? Each line of the story is a receipt. Hand it to a lawyer, a boss, or your future self. No Nymra knowledge needed to read it.
Proof a stranger can check
keep proof · self-contained pack · no account neededOne command exports a proof pack: the receipt segment plus a standalone verifier. Anyone, on any machine, can confirm your AI's work is real, without signing up and without trusting us.
Speaks your tools' language
MCP · Claude Code · Cursor · OpenCode · E2B wire-parityOne small config block and your coding agent gets the whole fleet (sandboxes, forks, secrets, receipts) as tools. Already wrote code for E2B? It runs here unchanged.
Picks the right brain for the job
model router · cost-governed routing · L1 semantic cacheNymra routes each decision to the model that balances quality, past success, and cost, and caches repeats so the same question never bills twice. Feedback loops make it sharper over time.
A map you can operate
/canvas · infinity canvas · lenses · time travel · saved viewsThe fleet, drawn as one zoomable map: drag it, filter it through lenses, scrub it back through time, save the views you trust. Anything the fleet can do, the map can do. Every action from it lands on the same receipts.
A mission, a fork, a duel. For real.
This is a real session from this production server: one live mission with a running background process, split into two branches that compete. The winner's lesson is inherited by whatever runs next.
# 1. one command, and your first sandbox already ran $ keep signup my-lab && keep doctor ◈ workspace ready · sandbox ready · 9/9 self-tests passed # 2. branch a LIVE mission (it keeps running) $ keep fork sbx_d3c9 --as careful,rushed ✔ checkpointed at t=1.7s — mode criu careful → sbx_b95f… · rushed → sbx_cb05… · lineage on 3 chains ✔ the resident process SURVIVED — ticks 23 → 27 # 3. let the two branches compete $ keep duel careful rushed --mission web-research careful ████████████████████ 100 rushed ██████░░░░░░░░░░░░░░ 50 ✔ winner: careful — learned behavior inherited: "read the docs before the POST" # 4. proof anyone can check, no account, any machine $ keep proof sbx_b95f --share proof pack p_911bb436… · 51 events · VALID
The duel, scored
same tests · same budget · different habits
✔ winner: careful. Its winning habit, read the docs before the POST, was recorded as a learned behavior, and the next agent you create is born knowing it. Rushed's failure was receipted too: losing branches teach, they don't haunt.
Read this mission's full story →. Every line is a receipt.
↑ the actual head of a verification chain from production testing · the receipt format is a published open standard
The same run, as the ledger sees it
THE RECORD · ONE SESSION, IN ORDER↑ the shape of one real run, receipt by receipt · read a live mission's actual receipts →
↑ the real ids from the session above · draggable, filterable, replayable on the map
Every night, Nymra tries to cheat itself. In public.
Nymra attacks itself on a schedule and publishes every result: the wounds, or the lack of them.
Each probe is a real attack on a real deployment: forging receipts, smuggling secrets out, blowing past spending caps, stealing warm sandboxes, faking E2B behavior, corrupting the backups.
Every result lands on the receipt chain: signed, timestamped, public. When a defense ever fails, you'll see it here in plain English, not buried in a disclosure.
TONIGHT'S ATTACKS
Six things the rented clouds structurally can't copy.
Every one of these is impossible while the computer belongs to the vendor and the meter belongs to their revenue. Each card says what you get in plain words, and why the biggest players in the space can't follow.
The ledger that can't lie
Every action your AI takes lands on a numbered, tamper-evident chain you can hand to whoever needs to sign: your boss, your auditor, a judge. Logs are a pile of text; this is a chain of custody in plain English, exportable as proof a stranger can check without an account.
Why they can't copy it: their business model needs them to be the only witness. A receipt standard makes you the witness. It's the product of a two-year head start and it's a published open standard.
The nightly self-test
Nightly, Nymra forges receipts, smuggles secrets, overspends its caps, and fakes its own compatibility layer, publishing every wound on a public page, good days and bad.
Why they can't copy it: it takes months of engineering to make failure safe enough to publish on a schedule — and it's terrifying if you have something to hide. Nobody in this market does it.
The Thinking-Time Guarantee
Your agent spends most of its life thinking, not typing. The rented clouds bill that at full rate (a measured 6.7× your burst cost). Here it's $0.00: a guarantee, receipted per mission, not a discount.
Why they can't copy it: their revenue is the meter running. Ours is a flat fee. We literally cannot bill you for thinking: there's no line item for it to exist on.
The time machine for failures
When an agent breaks, keep replay re-runs its exact steps in a fresh room, and keep bisect names the one command that flipped good to bad — like git-bisect, for agent behavior.
Why they can't copy it: it only works on top of a gapless receipt chain. You can't bolt a time machine onto a black box — and theirs are black boxes.
We publish our failure rate
Everyone advertises their median. We publish median, worst-case tail, and the failure rate, nightly, per isolation mode, on a public page, including the numbers that make us look slow.
Why they can't copy it: the market's burst-failure rates (a measured 37% for one vendor) were found by strangers with test scripts. Ours are on our own page, nightly, by us.
The keys
Your machine. Your disk. Your keys. One flat fee that never scales with usage. The only person who can turn it off, reprice it, or read your files is you. Grandfather promise included: nobody gets repossessed.
Why they can't copy it: they can't sell you the keys — the meter is the margin. The moment you own the box, their pricing model is gone.
Their bill grows with your agents.
Ours doesn't grow at all.
Type what you pay a sandbox cloud today. See the whole Nymra fleet you could run instead, on your own hardware, for one flat fee.
At that spend you belong on —, at about —.
That's roughly — you keep, every year, on hardware you own.
estimates from published list prices (E2B Pro $150/mo + per-second compute; Blaxel and Daytona per-second credits) · your side: one Hetzner-class box from ~$16/mo · check their math ↗ · and theirs ↗
| What matters to you | Nymra (yours) | Rented clouds |
|---|---|---|
| Cost while your AI sleeps | $0 by design | billed while suspended |
| Bills while your AI thinks | $0.00: guaranteed, receipted per mission | billed per second, thinking included (a measured 6.7× your burst rate) |
| The bill as you grow | flat fee, never scales with usage | grows with every sandbox-second |
| Your secrets | sealed envelopes: never enter the sandbox | injected as env vars / held by their proxy |
| Proof of what happened | hash-chained receipts, notary-stamped | logs, if you're lucky |
| Try a different path | fork live missions, duel, inherit the winner | closed or absent |
| Who can switch it off | nobody: your machine, your keys | the vendor |
| Shows its own failure rate | nightly, per isolation mode, public (/benchmark) | medians only; failures found by strangers |
8 sandboxes that sleep for free, full receipts, the whole Gauntlet.
save ~93%
save ~79% · plus evidence the auditor can sign
Your agents took 4,000 actions this month.
Prove it in one signed file.
Compliance platforms watch humans and charge $20,000 a year (the median Vanta contract). None of them can answer for an autonomous agent. Nymra's receipt chain was built for exactly that question, and it runs on every plan from day one. The Evidence Module packages it for the people who sign: auditors, regulators, boards.
Signed monthly bundles. Seven-year retention. A portal an auditor can use without your keys, your accounts, or your help.
Every receipt is hash-glued to the one before it: forge one and every later link visibly breaks. Chain heads are stamped by an independent time authority (RFC-3161) and pinned to git. The nightly Gauntlet attacks this exact machinery, in public, and fails.
When your AI touches production money, production data, or production customers, this is the artifact that says exactly what happened. Provably. No sandbox cloud ships anything like it. It's the difference between an infra cost and a risk budget, and your CFO already owns the risk budget.
- signed monthly evidence bundles · hash-chained, notary-stamped
- 7-year retention with legal hold
- read-only auditor portal
- SIEM export: Datadog · Splunk · OpenTelemetry
- quarterly Gauntlet report, signed by us
the Vanta-class budget buys compliance tooling for humans. this one watches your agents.
Three planes. One flat fee.
Scale is gated. Truth never is.
Receipts, verification, the Gauntlet, stories, and the receipt standard are free on every plan, forever. You pay for size, operations, and compliance packaging. The chips mark exactly what ships today.
THE MATH WE HAND YOU: the measured clouds bill an idle-heavy agent loop $27.60 per 1k execs (E2B-class, 10-min-alive/5%-CPU) vs $4.14 burst-only, and your agent thinks far more than it bursts. On your own Hetzner-class box (~$16/mo) Nymra's customer pays $0.00 idle, $0.00 thinking-time (receipted), and a fee that never moves. Strangers measured self-hosted Firecracker at 35× cheaper than managed sandboxes (source: Hacker News), and we publish our own tail at /benchmark so you can check us too.
Your VPS, flat fee
self-serve · the runtime on your hardware- 1 machine (your VPS)
- 8 sandboxes · sleep $0
- full receipts + Gauntlet + stories
- weekly updates
- 3 machines · 30 sandboxes
- forks · duels · inheritance
- checkpointable (CRIU) missions
- priority updates
- 10 machines · 100 sandboxes
- multi-VPS orchestration
- 1 static IP + warm pools
- concierge E2B migration, free
- add machines as you grow
- +25 sandboxes each
- no other fees, ever
Hosted, zero-ops
our hardware · commit and save- $500 in credits
- 10% off all usage
- cancel anytime
- 25% off credits
- static IP + warm pools
- priority support
- 40% off credits
- dedicated node
- named support
- your own node, our ops
- isolated from other tenants
- the fast path for fleets
Sovereign
enterprise · from $2k/mo platform + per-machine · annualacross unlimited machines: your VPS, our hardware, or BYOC on your cloud.
SSO/SAML, roles, team workspaces, full audit log.
signed bundles, 7-year retention, auditor portal, SIEM export.
offline signed license, zero telemetry, your metal, your rules.
99.9%, 15-min response, quarterly Gauntlet report signed by us.
concierge migration from any cloud, fixed price, one afternoon.
Start the conversation → · five design partners get 50% for a year in exchange for a public case study.
À la carte
every add-on, with its ship stateEvidence Module
signed bundles · 7-year retention · auditor portal · SIEM export
Egress Gateway Pro
dedicated egress IPs · per-domain policies · every verdict receipted
DR & Replication
litestream to YOUR bucket · drill-tested restores · head-proof receipted
Priority Warm Pools
pre-warmed sandboxes · zero-millisecond cold starts, guaranteed
Agency Edition
white-label · per-client workspaces · client-facing receipt bundles
Hibernation
park everything off-season · snapshots and receipts kept · wake in 60s
Platinum Support
15-minute response · direct channel · quarterly drill review
Air-Gapped License
offline signed license · zero telemetry · sovereign metal
One command. Your machine. Sixty seconds.
Start free on our hardware: no card, no clock, the whole rail works on the trial. When you want your own hardware, the one-command install puts Nymra on any box:
$ git clone https://github.com/clawpipe/keep && cd keep $ ./install.sh docker : 29.6.2 bubblewrap : 0.9.0 · /dev/kvm: present self-test : PASSED (9/9) ◈ Nymra serving on http://localhost:8817 # Fleet beta adds: keep deploy --provider hetzner
The managed deployer provisions a fresh box from a golden image, runs the full Gauntlet self-test, and hands you a URL. That's the product: it stays installed, updated, and honest, so you don't think about it.
Or plug it into the AI tools you already use. This one block turns Claude Code, Cursor, or OpenCode into a Nymra-powered agent:
{
"mcpServers": {
"keep": { "command": "python3", "args": ["-m", "keep.mcpserver"] }
}
}
# tools: keep_decide · keep_sandbox_exec · keep_sandbox_fork
# keep_receipts_verify · keep_patterns_top · keep_feedbackWrote code against E2B already? Point it at Nymra and the lifecycle calls work unchanged. On Fleet, we migrate you personally: same week, receipted, no charge.
Read this before you buy anything.
Every claim on this page is exercised by the nightly Gauntlet. What we don't do yet, plainly:
- Source-available, not open-source. You can audit every line; you can't resell it as a service. The things you verify with — receipts, the Gauntlet, the receipt standard — are open and free forever. We gate size and operations, never truth.
- Fleet multi-machine orchestration is in beta (design partners today, self-serve next). Solo and Studio ship today via the one-command install.
- Work inside docker sandboxes bills wall-time while it runs (sleep is still $0: that's the point).
- Freezing a live running mission (CRIU) needs the opt-in
checkpointablemode on Docker 28+: an upstream Docker bug blocks restoring isolated-network containers. We publish the exact matrix in the README. - E2B compatibility covers the lifecycle and code-run calls, not the entire surface. gVisor, CRIU, microVMs: auto-detected, not auto-installed; one-liners in the README.
- Grandfathered: existing hosted workspaces keep working free. Nobody gets repossessed, ever.
Straight answers.
In plain words: what is a "sandbox" and why does my AI need one?
A sandbox is a sealed, disposable computer that your AI works inside. It can browse, code, install things, and make mistakes — and none of it can touch your real files, your real passwords, or your real computer. Think of it as a spare room where your AI can paint the walls without asking. Every serious AI product runs its agent in one. The question this page answers is: whose computer, on whose terms, at whose price?
How is this actually different from E2B, Modal, Daytona, Blaxel, or Vercel?
They're good at what they do, and if you want their exact model — renting their computers by the second — they're reasonable choices. Nymra is built on a different bet: the computer should be yours (your VPS or a dedicated node), the price should be flat (never metered), and the truth should be yours to keep (the receipt chain). Out of that bet come the six things in §06 they can't offer: the ledger, the nightly self-test, the $0 thinking-time guarantee, the failure debugger, published failure rates, and the keys. Speed, isolation, E2B compatibility, MCP support: you get those too.
My agent "thinks" way more than it types. Does that really matter for the bill?
It's the biggest line item you have. Industry cost models put an idle-heavy agent loop — 10 minutes "alive," 5% doing actual work — at 6.7× the burst price on the rented clouds: $27.60 per thousand execs instead of $4.14. Thinking time is the red light the meter keeps running through. On Nymra it's $0.00, guaranteed, with a receipt for every second saved — and the estimate below shows what that means at your scale.
I'm not a coder. Is this for me?
If AI helpers do real work for you (research, scraping, filing, coding), then yes: sign up, get a workspace, and read what your agents did on the dashboard, the map, and the story pages. You never have to open a terminal. When you outgrow the trial, the hosted plans are zero-ops: we run everything, you read receipts.
Where do my files and secrets actually live?
On the machine Nymra runs on: yours on the self-serve plans; a dedicated single-tenant node on hosted. Secrets are sealed with modern encryption at rest and only unsealed in memory, for the instant a command needs them. They never enter a sandbox, a file, or a log.
What happens if I stop paying?
Nothing gets repossessed. Your data and your receipts stay where they are, readable and verifiable forever. Self-serve work pauses, hosted work pauses politely, and hibernation keeps a whole fleet's snapshots and receipts warm for $9/mo until the season turns.
How can I trust that the receipts can't be faked?
Each receipt is cryptographically glued to the previous one: forge one and every later receipt visibly breaks. Chain heads are stamped by an independent time authority (RFC-3161) and pinned to git commits. And Nymra attacks its own ledger nightly, in public, and fails.
Why is this so much cheaper than E2B, Blaxel, or Daytona?
Because they own the machines and rent them to you by the second. You buy the machine once; we sell the software that makes it an agent fleet. Their costs scale with your usage, so their prices have to. Ours don't, so they can't.
Can you migrate me off my current cloud?
Yes. Nymra speaks the E2B wire protocol, so most code runs unchanged, and on the Fleet plan the migration is free and we do it with you — same week, receipted, with a rollback path.
Can I see it working before I sign up?
Yes: the nightly self-test, live mission stories, and a real proof pack are all public, no account needed.