---
title: ".sandbox()"
description: "Define the execution boundary for executable tools."
---

> Documentation Index
> Fetch the complete documentation index at: https://xsaf.ilha.build/llms.txt
> Use this file to discover all available pages before exploring further.

# .sandbox()

## Signature

```ts
agent.sandbox(driver: XsafSandboxDriver): XsafAgent
```

A sandbox driver owns executable-tool isolation. XSAF has no implicit host-process fallback: starting an agent with executable tools and no sandbox fails.

## Usage

```ts
agent.sandbox(containerSandbox);
```

The driver receives the validated tool definition, validated input, execution context, and abort signal. It must enforce the isolation and capability policy appropriate for your deployment.

## Explicit local execution

For trusted development only, explicitly opt out of isolation:

```ts
import local from "@xsaf/agent/sandbox/local";

agent.sandbox(local({ unsafe: true }));
```

That adapter executes in the host process and is not a security boundary. `{ unsafe: true }` is required so the no-isolation opt-in is deliberate. See [Tools & Security](/recipes/tools) for approval ordering, cancellation, and the explicit unsafe local adapter.

Source: https://xsaf.ilha.build/xsaf/sandbox/index.mdx