Maintainer of this skill?
by sandbaseai
Local-first, self-hosted AI agent runtime and MCP bridge with sandboxed sessions, memory, credentials, audit/replay, and a local Console.
# Add to your Claude Code skills
git clone https://github.com/sandbaseai/sandbase-harnessGuides for using ai agents skills like sandbase-harness.
Last scanned: 8/15/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@ai-sdk/anthropic: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@ai-sdk/openai: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@ai-sdk/provider-utils: @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@ai-sdk/react: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@ai-sdk/ui-utils: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@vitest/mocker: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ai: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "hono: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "jsondiffpatch: jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "nanoid: nanoid: non-secure generators can loop indefinitely with negative size",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vitest: Vulnerability found",
"severity": "critical"
},
{
"file": "README.md",
"line": 276,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-08-15T04:29:46.532Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how sandbase-harness compares with popular alternatives.
sandbase-harness is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by sandbaseai. Local-first, self-hosted AI agent runtime and MCP bridge with sandboxed sessions, memory, credentials, audit/replay, and a local Console. It has 643 GitHub stars.
sandbase-harness failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/sandbaseai/sandbase-harness" and add it to your Claude Code skills directory (see the Installation section above).
sandbase-harness is primarily written in TypeScript. It is open-source under sandbaseai on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh sandbase-harness against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
AI-readable project metadata: llms.txt · installation guide
A local-first runtime for AI agents. Sessions, sandboxed tools, memory, credentials, audit trails, and a built-in Console — all running on your machine or in your own infrastructure.
Agent SDKs handle the model loop. Production agents need more: persistent
sessions, tool governance, sandbox boundaries, credential handling, memory,
auditability, and a UI for humans to inspect what happened. managed-agents
is that runtime layer — not a visual workflow builder and not another model SDK.
| Need | What Harness provides |
|---|---|
| Run generated code safely | Local, Docker, Kubernetes, and self-hosted worker sandboxes |
| Inspect long-running agents | Persistent sessions, resumable event streams, audit, and replay |
| Control tool access | MCP toolsets, credential vaults, permission policies, and approvals |
| Operate any model | OpenAI, Anthropic, MiniMax, and OpenAI-compatible providers, including DeepSeek V4 |
| Keep infrastructure yours | Local-first SQLite and file storage with no required hosted control plane |
/v1 API and local Consolemanaged-agents/sdknpm run release:checkRequirements: Node.js 22+, npm 10+, and a model provider API key (OpenAI, Anthropic, MiniMax, or any OpenAI-compatible endpoint). Docker is optional and only needed for Docker-backed sandboxes.
git clone --branch v0.3.8 --depth 1 https://github.com/sandbaseai/sandbase-harness.git
cd sandbase-harness
npm ci
npm run build
mkdir ../my-agents && cd ../my-agents
node ../sandbase-harness/dist/index.js init
node ../sandbase-harness/dist/index.js start
init writes a workspace into the directory you run it from: an agent, a skills
folder, and config.yaml, whose provider reference is the ${OPENAI_API_KEY}
environment variable. start serves the API and the Console on
http://127.0.0.1:3000.
Two steps finish the setup, both on Settings > Setup at http://127.0.0.1:3000/dashboard:
start command again, or use the
restart button. A saved setting only takes effect at startup. If your provider
is not in the list, choose the OpenAI-compatible vendor and set its base URL.deepseek-chat for DeepSeek, for example. An agent carries
its own model ID, so the gpt-4o that init writes is not valid for every
provider, and a wrong ID fails the turn with model_not_found.Send the first message from the Console: open Sessions, create a session for the agent, and type into the composer. From a terminal it is one command:
node ../sandbase-harness/dist/index.js chat agent_assistant --message "hello" --tool-approval allow
chat sends that one message and exits once the turn settles; without
--message it keeps the session open and streams until you interrupt it.
--tool-approval allow
preauthorizes the tool calls the agent may make, which the init template
otherwise parks for approval and waits for a person to answer; see CLI.
The unscoped managed-agents name on npm is not this project. Until an
official scoped package is announced in this repository, install only from the
tagged GitHub source release shown above. Do not run npx managed-agents or
npm install managed-agents.
The included development container installs dependencies and builds the runtime. When the terminal is ready, start the server on the forwarded port:
node dist/index.js start --host 0.0.0.0
Open the forwarded SandBase Harness Console port, then configure a model in Settings > Setup. Codespaces usage may be billed by GitHub; the local quick start above remains free and keeps all runtime data on your machine.
| Console overview | Settings | API reference |
|---|---|---|
 |
 |
 |
The runtime answers its own /v1 API on that same port, and an official
Anthropic TypeScript SDK client drives it unchanged: point the client's
baseURL at the runtime, give it the runtime API key, and the quickstart in
examples/official-sdk runs a whole turn —
message, tool call, tool result, final reply — against it. That example is
executed on every pull request by
tests/conformance/official-sdk-quickstart.test.ts, so the compatibility it
describes is compatibility that is tested rather than claimed.
The same surface is specified in docs/api.md, and this repository's own TypeScript SDK is documented under SDK below.
Coverage of the published Claude Managed Agents contract is declared entry by
entry in src/core/capabilities/matrix.ts:
of the official SDK's route surface (110 method/path pairs as of SDK
0.132.1), 90 routes are mounted and 20 refuse by name; no route is deferred.
Partial and Unsupported entries always name their reason.
The table below is generated by npm run docs:compat, and a contract-honesty
test fails when it drifts from the matrix.
| Area | Official capability | Status | Notes |
|---|---|---|---|
| headers | compatibility-header-admission |
Partial | Version, beta, and mutual-exclusion rules are enforced for any request that carries a compatibility header. A request with no compatibility header is accepted as a local caller, which the published contract does not define; this header-free path is a deliberate local-first extension for a self-hosted single-tenant runtime, recorded as such in the headers contract §4, and it is why this entry stays partial. |
| headers | extension-namespace-exclusion |
Supported | |
| pagination | opaque-cursors |
Partial | A collection's envelope follows the mount: the operations router serves /v1 with {data, prev_page, next_page} and its /v1/x mirror with the local {data, has_more, first_id, last_id}, chosen through one pager so no handler emits both spellings, and cursors that are readable base64url JSON rather than opaque binary. Every canonical /v1 collection serves the canonical envelope, with no exceptions: the complete-set listings carry {data, prev_page: null, next_page: null} and the windowed ones carry a followable cursor — /v1/sessions pages by number under {order, created_at bounds, page} and rejects a cursor replayed under another ordering or creation window, /v1/sessions/{id}/events carries {order, filter, after_id}, /v1/skills and the credential audit listings use {offset, filter} — so a cut page says so instead of looking complete. The one listing that is neither shape is /v1/environments/{id}/work-items, a windowed extension that adds a counts object and is named in the contract. |
| pagination | cursor-query-binding |
Supported | |
| errors | structured-error-envelope |
Supported | |
| agents | agent-crud |
Supported | |
| agents | model-object-profile |
Partial | String and object model forms parse field by field. effort and speed are stored, returned by the read projection (the agent read, the version read, and the session snapshot), and executed on the Anthropic provider under a model capability table — effort becomes output_config.effort, fast becomes speed: "fast" with the fast-mode beta, and adaptive-thinking models receive thinking: {type: "adaptive", display: "omitted"}; a listed model refused a level or speed it cannot take fails admission, an u |