Strands Box Explained

Strands Box is a free, open-source local sandbox for AI agents, now in developer preview, that combines operating-system isolation with Dogwood policies so an agent can reach only the files, programs, and hosts you allow. The software costs nothing to download, and your only expense is the model token usage the agent consumes while executing tasks.

At Layer3Labs, we build custom AI agents and enterprise integrations for small and mid-sized businesses.

What Strands Box Is and What It Costs

It runs on your local machine and pairs operating-system isolation with Dogwood policy. It establishes a constrained runtime environment on your local machine, pairing low-level operating system (OS) isolation with semantic rule evaluation powered by Dogwood.

No price is published and the project is open source. The only cost is whatever model usage the agent itself incurs, such as invoking Claude Opus 5 on Amazon Bedrock.

The project is currently at version 0.1.x pre-release status. Keys, flags and policy actions can change. For formal licensing terms and source code, inspect the official strands-agents/box GitHub repository.

• Software price: open-source repository with no published price.
• Operational cost: whatever model usage the agent incurs (the tutorial uses Claude Opus 5 on Amazon Bedrock).
• Project status: version 0.1.x developer preview; keys, flags and policy actions can change; pin the release.

Deterministic Enforcement for Agent Boundaries

Agents earn their value by finding their own path, so the boundary has to be exact and enforced deterministically.

Strands Box makes the Dogwood policy layer the only way out for the agent.

Writing Semantic Policies With Dogwood

Strands Box relies on Dogwood, an open-source policy language developed by Amazon Web Services (AWS). The blog (Strands Agents blog)'s examples are rules that depend on what the agent already did and how often it calls a server. The underlying Dogwood Local Engine was released as open source just prior to the launch of Strands Box, as documented on the Strands Agents blog.

The blog gives two policy examples: forbid git push unless a successful npm test ran since the last git add, within 15 minutes, and limit the agent to at most 60 calls an hour to the AWS MCP server.

The blog says Dogwood policies may be hard to write and understand, that making them easy is a major investment area, and that frontier coding agents are already good at reading and writing Dogwood.

Execution Scope Across MCP, Shell, and Python

Strands Box intercepts actions across multiple execution vectors. It monitors tools invoked directly by the model, calls routed through the Model Context Protocol (MCP), and commands executed via shell scripts or Python interpreters. It covers the filesystem and network.

Box is written in Rust and has testing, fuzzing and validation. Strands Box extends the Strands Shell project and incorporates Pydantic Monty to evaluate and enforce policies on Python and shell scripts.

Box works with any model, local or cloud, and any agent framework; it is not tied to the Strands Harness SDK.

Setup Steps and System Requirements

According to the official getting started guide, setting up Strands Box centers around two primary configuration files. The box.toml file defines which programs, local directories, and network endpoints the sandbox can expose. The policy.dw file houses the Dogwood policy declarations that evaluate every requested action.

Running Strands Box locally requires specific workstation hardware. You need an Apple Mac equipped with Apple silicon running macOS 15 or later, alongside Node.js version 22.21 or later. Users can download via the script in the strands-agents/box repository, or build from source with Rust.

The official tutorial demonstrates running an agent using Claude Opus 5 hosted on Amazon Bedrock in the us-west-2 cloud region. The documentation library includes dedicated walkthroughs for running Claude Code, Codex command-line interface (CLI), Pi, and the Strands harness, as well as instructions for telemetry collection and custom tool registration.

• Hardware check: Apple silicon hardware running macOS 15 or newer.
• Runtime dependency: Node.js 22.21 or later.
• Configuration structure: box.toml handles environment resources, while policy.dw specifies security logic.
• Tutorial credentials: an active AWS account with model access to Claude Opus 5 in us-west-2.

Architectural Tradeoffs and Multi-Tenant Isolation

The architecture of Strands Box introduces specific engineering tradeoffs. The extra code to trust is the Rust interpreters and protocol interceptors.

For multi-tenant cloud deployments, the blog recommends pairing Box with a dedicated per-session MicroVM, easiest with AgentCore Runtime (which uses Firecracker), and also possible on EC2, Lambda, or Fargate. AgentCore Policy uses the Cedar language; Box uses Dogwood.

What a Business Can Do With Strands Box

Box can contain a coding or ops agent during a pilot so it reaches only files, programs and hosts you allow.

A policy such as 60 calls an hour to the AWS MCP server caps usage of that server. Whether that caps spend depends on how the server bills.

The getting started guide lists a record-telemetry guide for recording what the agent did.

• Rate limit: a policy can cap calls to an MCP server, such as 60 per hour to the AWS MCP server.
• Telemetry: record what the agent did during pilot runs.

Next Steps for Deploying Strands Box

Treat this as a pilot-only tool until a stable release. The current 0.1.x can change keys, flags and policy actions, so pin the release.

To begin evaluation, download via the script in the strands-agents/box GitHub repository, or build from source with Rust, and verify your local Node.js and macOS versions before launching a test agent. At Layer3Labs, we build custom AI agents and enterprise integrations for small and mid-sized businesses.