--- title: Install description: Install Sandbox SDK, plus the provider SDK for Vercel, Upstash, Railway, Tenki, boxd, or agentOS if you use one. Requirements, optional packages, and where your keys must stay. --- Sandbox SDK is one npm package. The core has no runtime dependencies. E2B, Daytona, Freestyle, Superserve, Boat, and Sandboxer need nothing else, because their adapters call the provider's HTTP API directly. Vercel, Upstash Box, Railway, Tenki, boxd, and agentOS need that provider's official SDK installed next to it, and you only install the ones you use. ## 1. Install the package :::note[Coming from 0.2?] 1.0 changes the API. [Upgrade from 0.2](/docs/upgrade-from-0-2) walks through each change. ::: **npm** ```bash npm install @opencoredev/sandbox-sdk ``` **pnpm** ```bash pnpm add @opencoredev/sandbox-sdk ``` **yarn** ```bash yarn add @opencoredev/sandbox-sdk ``` **bun** ```bash bun add @opencoredev/sandbox-sdk ``` That is enough for the [Memory](/docs/providers/memory) provider, which runs in your process, and for [Local](/docs/providers/local), which needs Docker running on the same machine. ## 2. Add a provider SDK, if needed E2B, Daytona, Freestyle, Superserve, Boat, and Sandboxer need no extra package. For the providers that wrap an SDK, install it next to Sandbox SDK. The adapter loads it the first time that provider does something, so a provider you never call costs nothing. [Peer packages](/docs/reference/capabilities#peer-packages) lists the package and version range for each one. ### Local No package. Start Docker Engine (Docker Desktop, OrbStack, and Colima all work) and check it with `docker info`. ### E2B No package. `e2b()` calls E2B's API over HTTP. Set `E2B_API_KEY` on your server. ### Vercel Sandbox **npm** ```bash npm install @vercel/sandbox ``` **pnpm** ```bash pnpm add @vercel/sandbox ``` **yarn** ```bash yarn add @vercel/sandbox ``` **bun** ```bash bun add @vercel/sandbox ``` Needs `@vercel/sandbox` 3.8 or later. Inside a Vercel deployment it authenticates with OIDC. Elsewhere, set `VERCEL_TOKEN`, `VERCEL_TEAM_ID`, and `VERCEL_PROJECT_ID`. ### Daytona No package. `daytona()` calls Daytona's API over HTTP. Set `DAYTONA_API_KEY` on your server. ### Memory No package. Install the SDK as a dev dependency if you only use it in tests. ## 3. Add an agent framework (optional) Agent tools live on their own subpaths and need their framework and `zod`. Skip this if you aren't giving a model tools. | Framework | Install | Import from | | -------------------------------------------- | ----------------------------------- | --------------------------------- | | [AI SDK](/docs/integrations/ai-sdk) | `ai` 7 and `zod` 4.6 | `@opencoredev/sandbox-sdk/ai` | | [Mastra](/docs/integrations/mastra) | `@mastra/core` 1.78 and `zod` 4.6 | `@opencoredev/sandbox-sdk/mastra` | | [OpenAI Agents](/docs/integrations/openai-agents) | `@openai/agents` 0.20 and `zod` 4.6 | `@opencoredev/sandbox-sdk/openai` | These are optional peer dependencies. Importing the package root never loads them. ## Requirements - Node 22 or newer, or Bun 1.3 or newer. - ESM only. Use `import`, not `require`. - TypeScript is optional. Types ship with the package. - A server. Provider keys must never reach a browser bundle, so call the SDK from a route handler, a server action, a worker, or a script. ## Bundling You don't need a bundler: Node and Bun run the package from `node_modules`. If your platform bundles server code anyway, as Next.js, Convex, and AWS Lambda builds do, mark the SDK and any provider SDKs you use as external so they load from `node_modules` at runtime: ```bash esbuild server.ts --bundle --platform=node --format=esm --outfile=dist/server.mjs \ --external:@opencoredev/sandbox-sdk --external:@vercel/sandbox ``` In Next.js, use `serverExternalPackages`, as the [Next.js page](/docs/integrations/nextjs#bundling) shows. In Convex, list the packages under `node.externalPackages` in `convex.json`. When the packages have to go inside the bundle, for example because the deployment ships no `node_modules`, build an ESM bundle with a `require` shim. Some provider SDKs are CommonJS and call `require` for Node built-ins, which an ESM bundle doesn't define. Without the shim, the first provider call fails with `Dynamic require of "node:fs" is not supported`. ```bash esbuild server.ts --bundle --platform=node --format=esm --outfile=dist/server.mjs \ --banner:js='import { createRequire } from "node:module"; const require = createRequire(import.meta.url);' ``` A CommonJS bundle (`--format=cjs`) needs no shim. Minifying is fine in either format. ## What the package exports | Import | What it gives you | | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | `@opencoredev/sandbox-sdk` | `createSandbox`, `connectSandbox`, `listSandboxes`, `reapSandboxes`, `SandboxError`, and the types | | `/local`, `/agentos`, `/e2b`, `/vercel`, `/daytona`, `/upstash`, `/railway`, `/boat`, `/sandboxer`, `/tenki`, `/superserve`, `/boxd`, `/freestyle`, `/memory` | One provider factory each | | `/ai`, `/mastra`, `/openai` | `sandboxTools` for each agent framework | | `/tools` | The framework-neutral tool definitions and their Zod schemas | | `/provider` | The adapter contract, for [writing a provider](/docs/providers/custom) | | `/testing` | `runConformance`, the suite every provider passes | Next: the [Quickstart](/docs/getting-started/quickstart).