Brood Box (invoked via the `bbox` CLI) is an open-source agent harness and execution runtime developed by Stacklok. It provides a secure, sandboxed environment designed to package, orchestrate, and run containerized AI coding agents across Linux and macOS. Operating as a command-line harness, Brood Box allows developers to import and run autonomous agents packaged as standard OCI container images. Agents declare their runtime configurations using embedded manifests in image labels (such as `org.stacklok.broodbox.agent`) or standardized YAML paths, enabling reproducible agent deployment without manually managing host dependencies. Brood Box differentiates itself from traditional CLI agent wrappers through its defense-in-depth security model. It isolates agent execution within sandboxed runners and applies strict egress network policies, input sanitization, and layer inspection to defend against common autonomous agent vulnerabilities like SSRF, DNS rebinding, and host filesystem escapes. Brood Box is fully open source on GitHub and free to use for local development and automated CI/CD pipelines.
OCI Agent Packaging — Import and execute self-describing agents packaged as standard OCI container images with embedded manifests. - Sandboxed Execution — Runs agent workflows inside isolated execution sandboxes to protect host environments and sensitive credentials. - Egress Policy Enforcement — Limits outbound network connections from running agents to prevent data exfiltration. - Security Hardening — Validates container layers and rejects foreign blob URLs to protect against SSRF and DNS rebinding attacks. - Bbox CLI Tooling — Streamlined command-line interface for importing, inspecting, and managing agent workloads across Linux and macOS.
Use cases
Use Case: Running Untrusted Third-Party Coding Agents Developers can test community-built or external autonomous coding agents without giving them unrestricted access to the host operating system or network resources. Brood Box ensures the agent operates in an isolated environment with defined boundaries.
Use Case: Standardized Agent Distribution in Teams Engineering organizations can package proprietary or pre-configured coding agents as OCI images and distribute them across internal registries. Team members can pull and execute verified agent containers using standard bbox commands without manual environment configuration.
Use Case: Automated CI/CD Code Remediation DevOps pipelines can trigger containerized agents via bbox to perform code refactoring, dependency updates, or vulnerability remediation within a sandboxed CI runner step.
Who it is for
Brood Box is built for security engineers, platform teams, and AI tool developers who need a hardened, container-based execution harness for autonomous coding agents. It is less suited for developers seeking a lightweight, zero-dependency interactive chat assistant.
Install guide
Installation Build the bbox CLI from source using Go: bash git clone https://github.com/stacklok/brood-box.git cd brood-box go build -o bbox ./cmd/bbox sudo mv bbox /usr/local/bin/
First Run Verify that the binary is installed and check available runtime commands: bash bbox --help
Example Session Import a containerized agent and execute it within the sandbox: bash # Import an agent from an OCI container image bbox agents import ghcr.io/example/coding-agent:latest # Run the imported agent on the current project repository bbox run coding-agent --task "Audit codebase for unhandled errors"
SWE-agent — SWE-agent is an open-source autonomous software engineering agent harness built and maintained by researchers from Princeton University and Stanford University.…
Weaver — Weaver is an open-source agent harness and orchestration framework maintained by sean35mm on GitHub. Built on top of the Bun…
Hivelore — Hivelore is an open-source agent harness and contextual memory orchestrator created by Doucs91. It provides persistent project memory, decision tracking,…
Context Bridge — Context Bridge is an open-source CLI agent harness and context orchestration utility developed by serdardb. It is built to facilitate…
Vibe Kanban — Vibe Kanban, originally developed by Bloop AI, is an open-source orchestration harness and visual task board designed to manage and…
Parallel Harness Pets — Parallel Harness Pets (parallel-harness-pets) is an open-source companion tool and harness plugin created by TevvvB. It is designed for developers…