Computers for AI agents.
An agent needs somewhere to run code that nobody else can reach and nobody has to clean up. AgentForge hands it a real machine — its own kernel, its own filesystem, its own network — and takes it away when the work is done.
The whole workflow is six calls
Everything below runs through the public API. There is no SSH, no worker access, and nothing for an operator to repair afterwards.
from agentforge import AgentForge
af = AgentForge(api_key="af_live_…")
box = af.sandboxes.create(image="agentforge:latest")
box.exec(["git", "clone", "--depth", "1", REPO, "/workspace/repo"])
box.exec(["sh", "-c", # edit in place…])
box.exec(["python", "-m", "pytest", "-q"])
diff = box.exec(["sh", "-c", "git --no-pager diff"])
box.destroy()Two ways to run it
Cloud, we operate it
Firecracker capacity, PostgreSQL, object storage, TLS, backups and upgrades are ours to run. You use the API. See AgentForge Cloud.
OSS, you operate it
The same platform on your own KVM host, with your own database and object storage. No managed provider required. See the self-host guide.
Why the machine can be thrown away safely
Nothing is shared
Each sandbox has its own guest kernel and root filesystem. A bug in one guest never reaches another, and the host kernel is not exposed at all.
Egress is filtered
A sandbox cannot reach your LAN, cloud metadata, the control plane or another tenant. Restricted mode fails closed rather than quietly allowing traffic.
Ownership is fenced
Sandboxes are leased with a monotonic generation. If a worker dies the sandbox is reassigned at a higher generation, and the old owner is refused.
Real repos work
Git, CA certificates, Python, curl and tar are in the image. Clone over HTTPS with genuine certificate validation, not a disabled check.
Runaway agents are capped
Quotas, rate limits, a maximum lifetime and a global execution budget mean a runaway workload cannot exhaust the platform or your allowance.
One API either side
Moving between Cloud and your own host is a base URL, not a rewrite. The same SDK, the same sandbox identifiers, the same behaviour.
What it is not
AgentForge is not a notebook, not a CI runner, and not durable storage. It is a control plane for short-lived, untrusted, agent-driven computers. If work has to survive a run, take a snapshot.
Invite-only, limited capacity, no SLA. Everything that is not yet finished is listed on the status page, including the parts we cannot yet claim.