PyBox

PyBox · research prototype for Apple Silicon Macs

Run Python you don't trust, and get a receipt for what it did.

Each program runs once, in a fresh box on your Mac: no access to your files, no network, a two-second limit. Afterwards you get a record of what happened, and every line says where it came from.

Install How it works
A real run, recorded 19 October 2026. The program tried to read a file that exists on the Mac.
PyBox receiptrun 8f3a · 0.054 s
Exit code0
Mac folders sharednone
Networknone
Box removedconfirmed
Memory peak4.3 of 128 MiB
Processes6 of 32
Printed[2, null]
Final memoryunknown
  1. From the container engineChecked before the program started, and read back after it ended.
  2. From the Linux kernelSampled while it ran, by a watcher outside the box.
  3. From the program itselfUntrusted. Here it means "no such file, no such setting", but a program can print anything.
  4. Not measurableThe box can vanish between two readings, so the last value seen is not called final.

One run, step by step#

Ninety seconds, from handing PyBox a program to reading its receipt, including what happens when PyBox itself is killed mid-run.

Try it#

Python 3.11 or newer and brew install colima docker. PyBox has no other dependencies. pybox setup shows what it will create before it creates anything.

Install guideFiles in and outnumpy and pandasUse with Claude Code

Terminal
$ pipx install pybox-sandbox
$ pybox setup --yes
$ pybox vm start
$ pybox exec report.py --input sales.csv --output results/
$ claude mcp add pybox -- pybox mcp

What the evidence covers. 13 restriction checks, 9 resource checks, a crash test, 13 MCP protocol checks, 8 AI repair sessions, 15 live checks of images, files and longer runs, and a Claude Code session, all recorded on the machine PyBox was built on. It is not a sandbox approved for hostile code, it has not yet been set up on a second Mac, and its timers assume a healthy VM. Read the evidence

esc