How the term is used here ## How the channel uses code execution sandbox In this channel's material, the code execution sandbox appears as the secure runtime that makes the code-execution alternative to MCP tool-sprawl viable. Instead of exposing hundreds of API endpoints as separate tools, the model gets two tools — one to run TypeScript against the API's SDK, one to search docs — and the sandbox is where that code actually runs, server-side, with no round trip to the model per step [^913c216d-5ccb-51d9-8f42-8feb7c017d9d@2142] [^ea9761fa-0184-555e-be30-4928a6682680@2146]. ### Isolation: one provider per sandbox Stainless's approach starts with one API provider per sandbox, then locks network access so nothing can connect out except the target — api.stripe.com and nothing else [^913c216d-5ccb-51d9-8f42-8feb7c017d9d@2611] [^ea9761fa-0184-555e-be30-4928a6682680@2638]. ### Why it matters in production Katelyn Lesse names secure sandboxing as part of the real wall in production infrastructure — and warns that a dying sandbox can take your whole agent with it, making sandbox reliability a first-order concern, not an afterthought [^4872db36-e98a-5f6b-bc5c-b11e48c9411b@1181] [^4872db36-e98a-5f6b-bc5c-b11e48c9411b@813]. Security boundary, not the only one ## Where the sandbox fits in the security story The sandbox is one layer among several. Rattray argues limiting what MCP exposes is the wrong lever — security has to live at the API layer itself, via OAuth with granular permissions and proper scopes. The sandbox complements this by constraining what the executed code can reach at the network level [^913c216d-5ccb-51d9-8f42-8feb7c017d9d@2454]. - A code execution sandbox is the isolated environment where an agent's generated code runs against an API's SDK. - Stainless uses one API provider per sandbox with network access locked to that provider's endpoint. - Sandboxes are part of the production-infrastructure wall: reliability matters, because a dead sandbox kills the agent. - Security lives at the API layer (OAuth scopes) and the network-locked sandbox, not at the MCP layer.