Sandbox clouds were built to rent you a computer.
Agents need something you can keep.
Snapshots that expire
Your agent's workspace dies at a vendor-chosen TTL. Keep's stopped sandboxes persist on your disk indefinitely and resume on demand.
You pay while they sleep
Wall-time billing charges idle containers. Keep bills only execution — idle is $0, structurally, not a promo.
Runtimes get revoked
A major open-source sandbox went closed-source mid-2026. Keep is yours: the code, the data, and the keys live on hardware you control.
What the funded clouds don't ship
⌘ Sealed-credential execution
Commands carry {{SECRET:name}} placeholders. Real values resolve in memory at exec time and are scrubbed from every byte of output. Secrets never enter the sandbox, the filesystem, or your logs — the leak is structurally impossible.
⑂ Counterfactual forks
Fork a live sandbox: copy-on-write workspace, fresh identity, full lineage. Run the alternative path. Feed the outcome to the oracle. Train on what would have happened.
⛓ Receipt hash-chain
Every exec, decision, and fork appends to a per-workspace HMAC chain. Tamper with one link and every later hash breaks. Export it — that's your compliance artifact.
GET /v1/receipts/verify → {"ok": true, "count": 6}Same primitives. Your hardware. Your rules.
| Capability | Keep | Blaxel | E2B |
|---|---|---|---|
| Idle cost | $0 — stopped fs-snapshots | bills while suspended | bills wall-time while running |
| Secrets | sealed vault, in-memory resolve, output scrub | proxy injection (cloud-only) | env vars in sandbox |
| Tamper-evident receipts | HMAC chain + verify + export | — | — |
| Counterfactual fork | COW fork + commit, receipted | closed | — |
| Inheritance protocol | winner/loser patterns, boot-with-priors | Agent Drive (closed) | — |
| Cost governor | caps → auto circuit breaker → 402 | manual | manual |
| Self-host | this repo, one command | no | Nomad+Terraform (hard) |
| Isolation ladder | bwrap → docker → gVisor → KVM | microVM | Firecracker |
| Cold start | ~26ms hardened process · warm pool | ~25ms resume | ~150ms |
| Agent distribution | MCP-native (official SDK) | proprietary SDK | SDK |
One command. Your VPS. Sixty seconds.
$ git clone https://github.com/clawpipe/keep && cd keep # or: docker compose up -d # Hetzner / Netcup bare metal recommended (KVM headroom for microVMs)
$ ./install.sh docker : 29.6.2 bubblewrap : 0.9.0 /dev/kvm : present (microVM headroom) self-test : PASSED (9/9) ◈ starting Keep on http://localhost:8817 dashboard : http://localhost:8817/dashboard mcp server : python3 -m keep.mcpserver (stdio)
MCP-native from day one
Drop this into Claude Code, Cursor, or OpenCode. Your sandbox fleet, oracle, sealed secrets and receipts become tools your coding agent can call.
{
"mcpServers": {
"keep": { "command": "python3", "args": ["-m", "keep.mcpserver"] }
}
}
# tools: keep_decide · keep_sandbox_exec · keep_sandbox_fork
# keep_receipts_verify · keep_patterns_top · keep_feedbackPrepaid credits. Circuit breaker, not collections.
No subscriptions. No postpaid surprise bills. You fund credits; the governor hard-stops workloads at your caps; receipts prove every cent.
- 2 sandboxes · 1GB
- oracle: 1K decisions/mo
- $5 starter credits
- community support
- 8 sandboxes · 4GB
- 25K decisions · 5K exec-hrs
- forks + inheritance + receipts API
- MCP + priority builds
- 20 sandboxes · 16GB
- 250K decisions
- egress gateways · static IPs
- SOC2-style receipt exports
- sovereign substrate on your cloud
- air-gapped install
- SLA + support
- custom isolation tiers
We publish our constraints. Read before you buy.
Every claim on this page is measured in the test suite (9/9 green). What we don't do yet:
- ◦ Docker execs bill wall-time (idle still $0 — that's the point)
- ◦ Egress postures: none or open today; per-domain allowlist proxy is next
- ◦ E2B wire-parity is lifecycle-subset (create/list/refresh/delete + run_code)
- ◦ gVisor & CRIU are auto-detected, not auto-installed (one-liners in README)
Why self-host agent infrastructure?
Because runtimes get revoked, snapshots expire, and per-second bills at fleet scale are how VC-funded vendors subsidize growth — until they don't. Keep runs on hardware you pay for directly: at moderate utilization you keep 70–90% margin versus the managed clouds, and your data never leaves your perimeter.
How isolated is a "process sandbox" really?
Keep uses bubblewrap: unshared user/PID/IPC/network namespaces, cleared environment, die-with-parent, read-only system binds. On this kernel that measured 26ms cold with network denial verified. Docker mode adds cgroup/namespace hardening; gVisor is a one-line install; KVM-based microVMs (libkrun/Firecracker) are on the roadmap and your box already has the headroom.
What stops the secrets from leaking?
Structure, not policy. Secrets are Fernet-sealed at rest. A command never contains a real value — only placeholders. The runtime substitutes in memory at exec time and scrubs every byte of stdout/stderr back to placeholders before anything is stored, logged, or receipted. There is no code path that persists a secret value.
Why receipts?
Agents act autonomously; auditors ask what happened. Every action appends HMAC links to a per-workspace chain. Verification walks the chain — any tamper breaks every later link. Export bundles feed your SOC2/ISO evidence process.
What does it cost to run?
One $150/mo bare-metal node carries ~1,500 active sandbox-seconds per second of fleet capacity. At list rates a fully-billed node returns 5–10× its cost; idle sandboxes cost nothing. The unit economics favor you at every utilization you'll actually hit pre-scale.