How wardcell Compares

Agent sandboxes have arrived from several directions at once. This page is an honest comparison with the three closest: NVIDIA OpenShell, AWS Strands Box and Microsoft MXC. Each is good at something; wardcell is built for one thing in particular — the developer’s own machine, macOS and Linux, run in place.

The vision

Write your policy once, and wardcell projects it onto whatever enforces it — Seatbelt and Bubblewrap today, Windows and cloud sandbox providers next. The same .sbx policy travels with your project and means the same thing on every backend, so moving from your laptop to a teammate’s machine or a CI runner never means rewriting what the agent may do.

Note

Compiled October 2026. wardcell’s column comes from this repository; the others come from each project’s public documentation and announcements, which are young and moving fast — check the live docs before anything public relies on a specific row.

At a glance

	wardcell	OpenShell (NVIDIA)	Strands Box (AWS)	MXC (Microsoft)
What it is	Native OS sandbox; wraps the agent where it runs	Runtime platform: gateway + per-sandbox supervisor	Native macOS sandbox + interposed shell/Python, MCP broker	OS-level policy sandbox, enforced outside the agent
Isolation	Seatbelt (macOS); bwrap + userns + netns (Linux)	Container or microVM, with Landlock/seccomp/netns	Seatbelt + interposed interpreters	AppContainer (Win); Seatbelt (macOS); bwrap (Linux); exp. microVM/Hyperlight
macOS	✅ Native, transparent capture, 13+	⚠️ Linux sandbox inside Docker or a microVM	✅ Native, 15+ (via HTTPS_PROXY)	✅ Native (Seatbelt)
Linux	✅ Native, unprivileged	✅ Primary platform	❌ “In development”	✅ Native (Bubblewrap)
Windows	⚠️ Planned	⚠️ WSL2, experimental	❌	✅ Native (AppContainer) — primary target
Host needs	No VM or Docker; macOS one-time extension; Linux unprivileged	Docker/Podman, Kubernetes, or a hypervisor	No VM or Docker; Apple silicon	Varies by backend
Network capture	✅ Transparent on both (system extension / netns)	✅ Transparent (netns + veth)	HTTPS_PROXY env var	Deny-by-default by CIDR/protocol/port
Host / HTTP / path rules	✅ Built in: hostname, method, path, GraphQL mutation	✅ REST, MCP, GraphQL, JSON-RPC, WebSocket	✅ Method, path, body size	⚠️ Delegated to a proxy you run
Service discovery (Consul, K8s, custom)	✅ Plugin resolves names and bare addresses from any registry (discovery.resolve_name/resolve_addr)	⚠️ In-cluster DNS only — it runs inside Kubernetes; no registry hook	❌	❌
Credential injection	✅ Headers or mTLS, minted per request; agent never sees them	Placeholder tokens in env	Placeholder swap incl. SigV4; any process in the box can use any credential	❌ Caller’s responsibility
Composable policy	✅ Fragments + requires, three layers, ~30 bundled	Provider rules merge; admin policy replaces	Cedar permit/forbid, hand-written per box	Single versioned policy per sandbox
Policy picked by command	✅ selects_on	❌ by image	❌ per box	❌
Per-repo policy layer	✅ Checked-in .wardcell.sbx, auto-applied per directory, add-only over the base	❌ fixed per sandbox at creation	❌ one policy per box	❌ single policy per sandbox
Blocking human approval	✅ Zones + plugin; standing approvals	⚠️ Async: approve a draft rule, agent retries	❌	❌
Escalate privilege mid-run	✅ Zones	❌	❌	❌
Learn / draft mode	✅ policy draft writes a reviewable fragment from a real run	⚠️ drafts rules from denials	❌ none — read denials by hand (jq)	✅ learning mode
MCP-aware policy	⚠️ Planned	✅	✅ broker checks tools/call	❌ (not documented)
Resource limits / GPU	❌	✅ CPU, memory, GPU	❌	❌
Kubernetes / fleets	❌	✅ pods, gRPC API, Python/Rust SDKs	❌ planned	❌
Backing / maturity	Pre-release (Wardplane)	~Production; NVIDIA; ~15k stars	Developer preview; AWS	GA Oct 2026; Microsoft, with OpenAI, NVIDIA, GitHub Copilot on board
License / language	Rust, Apache-2.0	Rust, Apache-2.0	Rust, Apache-2.0	Rust/.NET/Node, MIT

Which one fits

wardcell — agents on your laptop, macOS or Linux

Choose wardcell when the agent runs on your own machine and you want least privilege without the tools breaking. It is the only option that captures macOS traffic transparently and gates it on hostnames, HTTP paths and GraphQL mutations, injects credentials the agent never sees, and escalates privilege through zones with a human in the loop. Its composable fragment library means you require the tools you use and get exactly their permissions — no VM, no container, your real environment. It is also the only one here whose policy can live in the repo: a checked-in .wardcell.sbx is applied automatically to any run started in that directory and can only add to the org base, never weaken it — so a project’s extra reach travels with it and reviews like code. The others pin one policy per sandbox or box at creation. It has no Kubernetes, GPU or resource-limit story; MCP-aware policy and Windows support are planned, not yet shipped.

OpenShell — fleets of agents, server-side

Choose OpenShell when you are running many agents on Kubernetes or servers, multi-tenant, and need resource limits, GPU passthrough, OCSF audit events and a gRPC API with SDKs. It is the most mature of the four. The trade-off on a developer’s Mac is real: the agent runs inside a Linux container, not your environment — no Xcode or Swift toolchain, no Keychain, no desktop apps. OpenShell for the fleet; wardcell for the laptop.

Strands Box — time- and rate-based rules

Choose Strands Box when you need its headline feature: Cedar policies with time-based operators (“3 posts per 10 minutes”, “push only after tests pass”), alongside an MCP broker that inspects tool-call arguments and SigV4 request signing for AWS APIs. It takes the same native, no-VM approach as wardcell but is macOS 15+ only with no Linux yet, relies on HTTPS_PROXY, and documents that the agents’ own file tools can bypass its policy.

MXC — Windows-first, and the Microsoft ecosystem

Choose MXC if you need Windows (its primary, AppContainer-backed target) or want to ride the ecosystem forming around it (OpenAI, NVIDIA, GitHub Copilot). MXC shares wardcell’s Seatbelt and Bubblewrap primitives on macOS and Linux, but it is a thinner policy layer: network rules are CIDR/protocol/port, HTTP filtering is delegated to a proxy you run yourself, and it brokers no credentials — all three of which wardcell ships built in. For turnkey name-, path- and credential-level control on macOS and Linux, that gap is the reason to pick wardcell.

In short

wardcell’s bet is focus: the best sandbox for running coding agents natively on a developer’s macOS or Linux machine, with network and credential control that works out of the box and policies composed so your tools keep working. For server fleets reach for OpenShell; for Windows or the Microsoft ecosystem, MXC; for macOS-only temporal rules, Strands Box.