E2B is a security option for building AI agents. Firecracker sandboxes for running code the agent wrote, safely.
Worth knowing. If the agent writes code that then runs, this layer is not optional.
npm install @e2b/code-interpreter
E2B_API_KEY=
| Option | What it does | Licence | Self-host |
|---|---|---|---|
| E2B | Firecracker sandboxes for running code the agent wrote, safely. | Open source | Yes |
| gVisor | Google's user-space kernel. Intercepts syscalls before they reach the host, without paying for a full VM. | Open source | Yes |
| Firecracker | AWS microVMs — a separate Linux kernel per sandbox, booting in about 125ms. | Open source | Yes |
| Kata Containers | MicroVM isolation behind the ordinary container API — drops into Kubernetes as a RuntimeClass. | Open source | Yes |
| No isolation (host process) | The agent runs as an ordinary process on the host. Honest default only when it executes no code and reads nothing untrusted. | Open source | Yes |
| Llama Guard | Open-weight classifier for input and output safety. Runs wherever you run it. | Open source | Yes |
| Guardrails AI | Declarative input/output validators with a hub of prebuilt checks. | Open source | Yes |
| NeMo Guardrails | NVIDIA's programmable rails — constrain topic, dialogue path and tool use. | Open source | Yes |
| Lakera Guard | Prompt-injection and jailbreak detection as a low-latency API call. | Proprietary | No |
| Rebuff | Open-source prompt-injection detector with canary tokens. | Open source | Yes |
| Invariant | Policy engine and analyzer for agent traces and MCP tool calls. | Open source | Yes |
| Descope Agentic Identity | Identity, delegated consent and scoped tokens for agents acting on behalf of users. | Proprietary | No |
| Auth0 for AI Agents | Token vault, async user approval and fine-grained authorization for tool calls. | Proprietary | No |
| Oso | Authorization-as-a-service — decide what this agent may touch, per record. | Open source | Yes |
| Microsoft Presidio | PII detection and redaction before text ever reaches a model provider. | Open source | Yes |
| Cloudflare AI Gateway | Rate limiting, caching, spend caps and logging in front of any provider. | Proprietary | No |
| iron-proxy | Default-deny egress firewall for untrusted workloads. The sandbox holds worthless proxy tokens; real credentials are swapped in at the boundary. | Open source | Yes |
Every page here answers to Accept: text/markdown and returns the same content at roughly a tenth the tokens. No separate site, no toggle — same URL.
curl -s -H "Accept: text/markdown" https://newagent.build/c/e2b