What is SandBase Harness?

SandBase Harness (its CLI is called managed-agents) is a local-first runtime layer for production AI agents, aimed at developers who need sessions, tool governance and auditability rather than another model SDK. A single Node.js process serves both a /v1 API built around the Claude Managed Agents contract and a built-in web Console. Agents run tools in local-process, Docker, Kubernetes or self-hosted worker sandboxes, and access is controlled with MCP toolsets, permission policies, approval gates and credential vaults; long-running work stays inspectable through an append-only event log, resumable event streams and replay. Memory stores, skill packages, declarative manifests applied from the CLI, scheduled deployments and signed webhook subscriptions cover the operations side. Model access is pluggable — OpenAI, Anthropic and MiniMax are named, as are any OpenAI-compatible endpoints including DeepSeek — and configured from the Settings screen. Install it by cloning the tagged GitHub release, building with npm, then running init and start; metadata stays in a local SQLite database. No official container image exists for the runtime itself (the published ghcr.io image is only the sandbox helper) and the unscoped managed-agents npm package is explicitly not this project. Releases are pre-1.0 (v0.3.8) under the Apache-2.0 licence.

Should you self-host SandBase Harness?

SandBase Harness scores 39/100 on selfhost.directory (how scoring works) and ranks #170 of 209 in AI Agents. It has 635 GitHub stars.

It shipped 9 stable releases in the past year. The latest, v0.3.8, came out on 30 August 2026.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is Apache-2.0-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is Orca (91/100, 108 642 stars). It scores higher overall, so compare the two before you pick. See SandBase Harness vs Orca side by side.

Features

Credential vaults
Declarative manifests
Egress network policyProject marks environment-network-policy Partial; kubernetes and self-hosted providers install no egress boundary.
Event replay & audit
MCP toolsets
Memory stores
Persistent Sessions
REST API
Sandboxed Execution
Scheduled deployments
Session budgets
Tool approvals
TypeScript SDK
Web Console
WebhooksDelivery behaviour deviates from the published Claude Managed Agents contract (project marks it Partial).

How to configure SandBase Harness

--agents-diragentsDirectory containing agent YAML files.
Directory containing agent YAML files.
--config.managed-agents/config.yamlRuntime configuration file.
Runtime configuration file.
--data-dir.managed-agentsSQLite database, uploaded files, and runtime data.
SQLite database, uploaded files, and runtime data.
--host127.0.0.1Bind address for the API and Console.
Bind address for the API and Console.
--log-file.managed-agents/logs/runtime.logStructured runtime log file.
Structured runtime log file.
MANAGED_AGENTS_API_KEYStatic API key; authentication turns on when at least one API key exists and clients send it as a Bearer token.
Static API key; authentication turns on when at least one API key exists and clients send it as a Bearer token.
MANAGED_AGENTS_CORS_ORIGINSComma-separated origin allowlist for a deployed Console or a trusted separate frontend; CORS is restricted by default to same-origin and local loopback browser origins.
Comma-separated origin allowlist for a deployed Console or a trusted separate frontend; CORS is restricted by default to same-origin and local loopback browser origins.
MANAGED_AGENTS_EXTERNAL_AUTHZ_ENDPOINTExternal control-plane endpoint: every governed tool call admitted by the local policy is presented to it for a veto-only, fail-closed check before execution.
External control-plane endpoint: every governed tool call admitted by the local policy is presented to it for a veto-only, fail-closed check before execution.
MANAGED_AGENTS_EXTERNAL_AUTHZ_TIMEOUT_MS2000Timeout in ms for the external authorization check; unreachable endpoints, HTTP errors and malformed responses all refuse the call.
Timeout in ms for the external authorization check; unreachable endpoints, HTTP errors and malformed responses all refuse the call.
MANAGED_AGENTS_EXTERNAL_AUTHZ_TOKENBearer header token sent to the external authorizer.
Bearer header token sent to the external authorizer.
MANAGED_AGENTS_HOMERoot for the workspace registry file workspaces.json, defaulting to ~/.managed-agents.
Root for the workspace registry file workspaces.json, defaulting to ~/.managed-agents.
MANAGED_AGENTS_LOCAL_ISOLATIONControls the local sandbox isolation wrap: off disables it, require makes a missing isolation tool fail the command.
Controls the local sandbox isolation wrap: off disables it, require makes a missing isolation tool fail the command.
values: off | require
MANAGED_AGENTS_LOCAL_ISOLATION_WRITE_PATHSExtra writable roots for toolchains in the local sandbox.
Extra writable roots for toolchains in the local sandbox.
MANAGED_AGENTS_SECRET_KEYStable credential encryption key across runtime moves.
Stable credential encryption key across runtime moves.
MANAGED_AGENTS_WEBHOOK_ROTATION_WINDOW_SECONDSDuration the previous webhook signing secret stays valid during a rotation window; 24 hours by default.
Duration the previous webhook signing secret stays valid during a rotation window; 24 hours by default.
MANAGED_AGENTS_WEBHOOK_SCREEN_PRIVATE_ADDRESSESWhen set, webhook delivery attempts to internal host names or private addresses are refused before connecting; off by default.
When set, webhook delivery attempts to internal host names or private addresses are refused before connecting; off by default.
MANAGED_AGENTS_WEBHOOK_SUSTAINED_FAILURE_WINDOW_SECONDSWindow after which a webhook endpoint failing without interruption is disabled; defaults to 10 minutes.
Window after which a webhook endpoint failing without interruption is disabled; defaults to 10 minutes.
--port3000HTTP port.
HTTP port.
--skills-dirskillsDirectory containing skill packages.
Directory containing skill packages.
--targetOptional runtime target label surfaced in the Console.
Optional runtime target label surfaced in the Console.
--workspace.Workspace root containing config, data, logs, agents, and skills.
Workspace root containing config, data, logs, agents, and skills.