my-box · agents
$ moatbox run claude "fix the tests"
Every agent, its own sandbox
Claude Code, Codex and opencode run headless in gVisor, one sandbox each, with your own keys.
All your agents in one safe place.
Off your laptop, every tool built in.
What's in the box
Your agents and every tool they use, in one box, behind one gate.
my-box · tools
$ moatbox run -broker github codex "open a PR"
Every tool, built in
GitHub, Postgres, Stripe, Slack and seven more. The real tokens stay outside the sandbox.
my-box · gate
$ moatbox approve 42 → #42 approved
Risky calls wait for you
A DELETE, a refund or a force-push stops at the gate until you approve it. Supported actions can be undone.
Fork it mid-run
Pause a running box and split it into copies. Each copy keeps the agents, the files and the memory, then goes its own way.
my-box · mid-run
$ moatbox fork my-box
Around every run
Undo what went wrong, replay what happened, approve from anywhere, take the wheel, ship the result.
my-box · undo
$ moatbox undo 42 → #42 undone: restored 1284 rows
Undo the bad one
Approve a DELETE and moatbox saves the rows first. One command writes them back. Rewritten git refs and deploys roll back too.
my-box · timeline
$ moatbox timeline
See everything they did
Every query, request, file change and shell session, in order, per agent.
your phone
push · slack · discord
Approve from anywhere
On the hosted plans, held actions reach your phone, Slack or Discord.
my-box · desktop
$ moatbox run -desktop claude "review the PR"
Watch or take over
Agents get a real browser on a virtual desktop. Watch them work, and grab the mouse whenever you want.
my-box · deploy
$ moatbox deploy app -name my-app .
Ship from the box
Apps, functions, static sites and databases deploy straight from the box to their own address.
Pricing
Self-host it for free, or let us run the box. You bring your own model keys, so you only pay for the box.
Free
Self-host, open source
€0forever
your server, your rules
Install- The full product on your own server
- Approvals, undo and timeline for one person
- Every agent and tool built in
- 14-day hosted trial with 25 space-hours
Solo
For one developer
€20/ month
+ VAT
Start Solo- 200 space-hours a month
- Sleeps when idle or waiting on you
- 2 boxes running at once
- Approvals on the web, email and push
- 30-day timeline · 1 hosted app
Pro
For heavy agent work
€49/ month
+ VAT
Start Pro- Everything in Solo
- 1 always-on box
- 300 space-hours a month
- Bigger boxes: 4 vCPU · 8 GB
- 5 running at once · 3 hosted apps
- 90-day timeline · a second approver
- Fork mid-run (soon)
Team
For teams shipping with agents
€199/ month
5 seats · +€35 per seat · excl. VAT
Start Team- 1,500 pooled space-hours, +250 per seat
- 2 always-on 4 vCPU · 8 GB boxes
- Approval routing, multiple approvers, Slack
- SSO with SAML or OIDC included
- 1-year timeline with export · roles
A space-hour is one 2 vCPU · 2 GB box running for an hour; a 4 vCPU · 8 GB box uses two. Extra hours cost €0.08, with a spending cap on by default and an alert at 75%. Need dedicated hosts, SCIM or an SLA? Enterprise plans are custom.
Questions
What is moatbox?
A place to run coding agents safely. moatbox runs Claude Code, Codex and opencode headless in their own sandboxes, with tools like Postgres, GitHub and Stripe built in. Every tool call goes through one gate: risky ones wait for your approval, supported ones can be undone, and all of them land on a timeline.
Which agents does moatbox run?
Claude Code, Codex and opencode. Each one gets its own sandbox inside your box and runs headless with your keys.
Do I need my own model keys?
Yes. Bring your own Anthropic or OpenAI API key or subscription. moatbox never resells tokens, so you only pay us for the box.
How is moatbox different from a sandbox or a cloud VM?
A sandbox gives an agent a computer. moatbox also controls what the agent does with your tools: integrations are built in with the real tokens kept outside the sandbox, risky actions wait for you, Postgres rows, git refs and deploys can be undone, and you can watch the browser or take it over.
What counts as a risky action?
Things like a DELETE or UPDATE on a database, a force-push, a refund, a sent email or a deleted message. moatbox holds them at the gate until you approve or deny them from the CLI or the web, and on the hosted plans from your phone, Slack or Discord.
Can I self-host moatbox?
Yes. moatbox is open source under Apache-2.0. The self-hosted server runs on Ubuntu 24.04 or Debian 12 with Docker, and isolates agents with gVisor.
Where do hosted boxes run?
On our own servers at Hetzner in Germany and Finland. Every hosted box is its own Firecracker microVM.
What is a space-hour?
One 2 vCPU · 2 GB box running for one hour. A 4 vCPU · 8 GB box uses two. Boxes sleep when they are idle or waiting for an approval, and sleeping time is free.
Can I fork a box while it runs?
Fork is coming soon: pause a running box and split it into copies that keep the agents, the files and the memory, then go their own way.