A sandbox is where the riskiest tool, "run this code", should run. On Runtime, each call runs in a Firecracker microVM with its own kernel. You pay only for the CPU it uses. A 2 vCPU, 4 GiB sandbox costs $0.03125 an hour while the model thinks between calls (pricing).
How it works
Anthropic and OpenAI describe the same round trip. You send the model a list
of tools. Each tool has a name, a description and a JSON schema for its input.
The model responds with a structured call instead of text. In Anthropic's API,
that call is a tool_use block with stop_reason: "tool_use". Your code runs
the function and sends the output back as a tool_result, in Anthropic's terms.
The model then either gives a final answer or calls another tool. OpenAI's guide
names the same five steps, ending in "a final response from the model (or more
tool calls)". It says an application can continue the flow for as many tool
calls as the task requires.
| Term | Meaning |
|---|---|
| Tool definition | Name, description and input schema the model reads |
| Tool call | The model's structured request: which tool, which arguments |
| Tool result | What your code returns, fed back to the model |
| Client tool | Runs in your application (Anthropic's term; includes bash and editors) |
| Server tool | Runs on the provider's infrastructure, such as web search |
| MCP | A standard way to publish tools so any compatible client can call them |
Where the code runs matters
A tool that fetches the weather is harmless. A tool that runs Python, a shell command or a test suite runs whatever the model wrote. A prompt injection can decide what that is. If you run it in your web server, it can read your environment and reach your network. If you run it in a sandbox, it reaches only the sandbox.
A code tool backed by a sandbox
Your handler receives the model's arguments and runs them in a sandbox that the conversation owns. The handler returns plain data, which you send back as the tool result.
TypeScriptimport { Sandbox } from "withruntime";// Handler for a tool the model calls as run_python({ code }).export async function runPython(sbx: Sandbox, code: string) { await sbx.files.write("/workspace/cell.py", code); const run = await sbx.exec(["python3", "cell.py"], { timeoutMs: 30_000 }); return { exitCode: run.exitCode, stdout: run.stdout, stderr: run.stderr, timedOut: run.timedOut };}await using sbx = await Sandbox.create({ network: { internet: false } });console.log(await runPython(sbx, "print(sum(range(10)))"));A timeout returns a result with timedOut: true and the output so far. It does
not throw an exception. The model can then read what happened and try again.
Output is capped at 64 KiB per stream, unless the command streams its output
(run commands).
Tools that already exist
Runtime's MCP server publishes tools such as
runtime_sandboxes_create, runtime_sandboxes_exec and
runtime_sandboxes_files_write. An agent that speaks MCP can use sandboxes with
no handler code. Well-known MCP servers, such as GitHub, Postgres and a
Playwright browser, can also run inside a sandbox
(MCP servers in a sandbox).
Related
- What is an agent loop?
- What is the Model Context Protocol?
- What is a code interpreter?
- What is an idempotency key?
Sources
- Anthropic, Tool use with Claude, checked 25 October 2026
- OpenAI, Function calling, checked 25 October 2026
Facts on this page were checked on 25 October 2026.