Execute
Run bounded commands with real stdout, stderr, timeouts, output limits, and trace-linked evidence.
Isolated execution · v1.3.0
Break the workflow here, not in production.
PlatPhorm Sandbox is the bounded execution and replay layer for code, commands, files, artifacts, APIs, and MCP calls. Draft locally, run through a configured provider, validate the evidence, then hand it to the right platform service.
Validate
Check JSON, XML, RSS, Markdown, OpenAPI, MCP envelopes, redaction, and trace payloads.
Handoff
Send verified artifacts to the source-owned platform service without claiming downstream completion.
Execution truth
What does Sandbox guarantee?
Public-safe templates, discovery, run summaries, and validation previews are readable without a credential. Creation, command execution, replay, mutation, provider operations, and report generation require PLATPHORM_API_KEY. Provider and database dependencies report their real state; unavailable execution never becomes fake success.
- Bounded
Trusted network targets, fixed timeouts, response limits, rate limits, and redaction. - Traceable
W3C trace context and safe Vercel request metadata follow supported handoffs. - Verifiable
Real logs, artifacts, validations, and explicit degraded states are retained as evidence.
Sandbox stays the execution lab. MCP owns capability discovery, Trace owns observability, and Evals owns release scoring. Integrations preserve those boundaries.
A lifecycle starts from a versioned template, creates an isolated workspace only when the configured provider is ready, records files and command output, validates resulting artifacts, and prepares a trace-linked handoff. Browser-local drafts remain clearly labeled local. Provider runs retain their runtime, timeout, network policy, logs, validation results, and completion state so operators can distinguish planning evidence from executed work.