The only sandbox with
security built in
Firecracker microVMs with guardrails, agent action controls, custom policy enforcement, and full agent observability — all in one SDK, not five vendors.
~40ms
sandbox startup
100K+
sandboxes created
Drop-in compatible
Works with any LLM or agent framework
Declaw proxies traffic transparently. Keep your model provider, keep your framework — we secure what runs in between.
LLM providers
Agent frameworks
Get started in seconds
The problem
The AI agent stack is broken
Today you need a sandbox vendor, a guardrails vendor, DIY network controls, and DIY persistence. Five tools, gaps at every seam, nothing shares context.
Today
5 vendors · no shared context · gaps at every seam
With Declaw
One SDK · shared execution context · everything integrated
Sandbox + Security
Everything your agent needs to run safely
Sandboxes, filesystem, networking, guardrails, and audit — all sharing execution context inside the same Firecracker VM.
Firecracker Sandboxes
Every execution runs in an isolated microVM. ~40ms startup, configurable CPU/memory/disk, full Linux environment. Drop-in replacement for your current sandbox.
sbx = Sandbox.create(template="base", timeout=60)
result = sbx.commands.run("python3 agent.py")
print(result.stdout)Persistent Filesystem
Read, write, watch files inside the sandbox. State persists across sessions so agents pick up where they left off.
sbx.files.write("/workspace/data.csv", csv_content)
files = sbx.files.list("/workspace")
content = sbx.files.read("/workspace/results.json")Network-Layer Controls
L3/L4 kernel-level IP filtering + L7 domain/SNI inspection + TLS interception. Control exactly what your agent can reach.
from declaw import SecurityPolicy, NetworkPolicy
policy = SecurityPolicy(
network=NetworkPolicy(
allow_out=["*.openai.com", "pypi.org"],
deny_out=["0.0.0.0/0"],
)
)Guardrails Suite
PII redaction with rehydration, prompt injection defense, code security analysis, toxicity scanning, and invisible text detection — all running at the proxy layer.
policy = SecurityPolicy(
pii=PIIConfig(enabled=True),
injection_defense=InjectionDefenseConfig(enabled=True),
code_security=CodeSecurityConfig(enabled=True),
toxicity=ToxicityConfig(enabled=True),
invisible_text=InvisibleTextConfig(enabled=True),
)Full Audit Trail
Every intercepted request, redaction event, and injection block is logged. Configurable retention, exportable.
policy = SecurityPolicy(
audit=AuditConfig(enabled=True)
)
# Audit logs accessible via console/APIArchitecture
Architecture overview
Every sandbox is a hardware-isolated Firecracker microVM. A transparent security proxy intercepts all outbound traffic — your workload never touches the internet directly.
API Server
Central API for sandbox scheduling, lifecycle management, and security policy enforcement.
Orchestrator
Manages Firecracker VM lifecycle: boots microVMs, configures resource limits, handles snapshots and teardown.
Sandbox daemon
Exposes file, process, and terminal APIs inside the sandbox.
Security Proxy
All outbound traffic is intercepted and inspected at the network layer — transparent to your workload.
User workload
Your agent binary, Python script, or code — hardware-isolated from the host and every other sandbox.
The Security Proxy
A transparent security layer operates per-sandbox. All outbound traffic passes through it automatically — your agent makes ordinary network calls with no awareness of the proxy.
All traffic intercepted. Every outbound request is intercepted and inspected before reaching the internet.
Full TLS visibility. HTTPS traffic is decrypted and inspected per-sandbox, so guardrails can see request and response content.
Transparent by design. Your agent doesn't need code changes. The proxy is invisible at the application layer — it only appears in the audit log.
Key guarantee
Your agent doesn't need code changes — the proxy is transparent. Drop Declaw into any existing agent workflow.
6-stage pipeline
Network Policy
IP and CIDR allow/deny rules evaluated first.
Domain Filter
Domain-level filtering with wildcard support.
TLS Interception
HTTPS traffic decrypted for full request and response inspection.
Guardrails
PII redaction, prompt injection defense, code security, toxicity, invisible text detection.
Transformation Engine
Pattern-based match/replace rules on request or response body.
Audit Logger
Full event logging with configurable retention.
Detection engine
What gets detected and blocked
PII is redacted at the boundary. Injections, toxic content, and invisible text are caught. Unsafe code is blocked before execution.
Social Security
Credit Card
Email Address
Phone Number
API Key
Prompt Injection
Toxic Content
Invisible Text
Code Security
Deployment
Deployment options
Run on Declaw's managed cloud or bring your own infrastructure. All options use identical SDK and security primitives.
Managed Cloud
Self-hosted / BYOC
or email team@declaw.ai
Support