An AI agent sandbox promises to keep your agent inside the lines — but the sandbox is only as strong as its policy. Paste your sandbox or agent policy below, or answer 9 questions about your setup, and get scored across 5 gap areas: self-modification protection, egress/network rules, history-aware rules, credential handling, and MCP broker coverage — with concrete fixes for every gap found.
Direct answer: An AI agent sandbox combines OS-level isolation with a policy engine that approves or denies every agent action — shell commands, code runs, network requests, tool calls. AWS's Strands Box (October 2026) adds history-aware Dogwood policies, but a sandbox is only as strong as its policy: gaps like self-editing rules or open egress defeat it.
Option A — paste your policy (Dogwood/Cedar, box.toml, YAML, or plain-English rules). Option B — just answer the 9 questions. You can do both: the text gets a quick keyword scan and the questions drive the score.
Heuristic keyword scan only — this is not a real Dogwood/Cedar parser. Findings are labeled as such.
Strands Box is an open-source AI agent sandbox from AWS's Strands Agents team, released in developer preview on October 7, 2026 under the Apache 2.0 license. It pairs OS-level isolation (macOS Seatbelt) with a policy engine, is deny-by-default, and currently supports Macs with Apple silicon only, with Linux and other platforms planned.
Dogwood is AWS's open-source policy language (building on its Cedar language) with a Local Engine that evaluates each requested action against the agent's recorded history. Example from AWS: an incident agent may post to Slack, but no more than three times every 10 minutes — the box enforces the limit from history, not from the agent's memory.
That is the gap this checker tests. In Strands Box the policy lives in box.toml, enforced at the syscall level by Seatbelt. If the agent can write to that file or its config directory, the sandbox ends up answering to the agent. AWS's own caveat is that policies "may be difficult to understand, and difficult to write" — misconfigurations are easy.
No. Deny-by-default is the floor, not the ceiling. You also need history-aware rules (judge sequences, not single actions), egress allowlists, credential injection at the gateway, an MCP/tool broker that reviews every call, and self-modification protection — the five dimensions this checker scores.
No. This is a heuristic self-assessment: your answers plus a keyword scan of pasted policy text, scored against five known gap areas. It cannot parse real Dogwood/Cedar semantics, cannot see your runtime, and is not legal or security advice. Use it to find blind spots, then verify with a proper review.
Honest scope: this page summarizes publicly reported facts about AWS Strands Box (October 2026) with linked sources; it is not affiliated with AWS. The analyzer is a heuristic self-assessment tool, not a security audit. Sandbox platforms evolve quickly — verify current behavior against official docs before relying on it.
Ingenious AI publishes 21 live security platforms, and 100% of them run on permanent getingeniousai.com domains.