OpenRouter tool calling one code sandbox for every model

One handler works with hundreds of models. On 25 October 2026, OpenRouter's model list held 467 models, and 399 of them accept tools. Switching from GPT to Claude to Gemini changes one string. The code that each model writes runs in the same kind of Runtime sandbox: a Firecracker microVM with its own Linux kernel and the internet off. At 2 vCPU and 4 GiB, it costs $0.03125 an hour while it waits (pricing).

The loop, with the model as a parameter

OpenRouter's TypeScript SDK takes the request inside chatRequest. It returns camelCase fields: toolCalls on the message and toolCallId on the reply. Its Python examples use the openai package, pointed at https://openrouter.ai/api/v1.

TypeScriptimport { OpenRouter } from "@openrouter/sdk";import type { ChatFunctionTool, ChatMessages } from "@openrouter/sdk/models";import { Sandbox } from "withruntime";const openRouter = new OpenRouter({ apiKey: process.env.OPENROUTER_API_KEY ?? "" });async function runPython(code: string): Promise<string> {  await using sbx = await Sandbox.create({    network: { internet: false },    timeoutSeconds: 300,    onLeaseEnd: "stop",    maxTotalCostMicros: 50_000,  });  await sbx.files.write("/workspace/main.py", code);  const run = await sbx.exec(["python3", "main.py"], { timeoutMs: 60_000 });  return JSON.stringify({    exit_code: run.exitCode,    timed_out: run.timedOut,    stdout: run.stdout,    stderr: run.stderr,  });}const tools: ChatFunctionTool[] = [  {    type: "function",    function: {      name: "run_python",      description:        "Run a Python 3.12 script in an offline sandbox; returns exit_code, stdout and stderr.",      parameters: {        type: "object",        properties: { code: { type: "string" } },        required: ["code"],      },    },  },];export async function solve(model: string, task: string): Promise<string> {  const messages: ChatMessages[] = [{ role: "user", content: task }];  for (let turn = 0; turn < 8; turn++) {    const result = await openRouter.chat.send({      chatRequest: { model, messages, tools, stream: false },    });    if (!("choices" in result)) throw new Error("expected a complete response, not a stream");    const message = result.choices[0]!.message;    messages.push(message);    if (!message.toolCalls?.length) return String(message.content ?? "");    for (const call of message.toolCalls) {      const { code } = JSON.parse(call.function.arguments) as { code: string };      messages.push({ role: "tool", toolCallId: call.id, content: await runPython(code) });    }  }  return "stopped after 8 turns";}const task = "How many primes are there below 10 million? Compute it.";for (const model of ["openai/gpt-6-sol", "anthropic/claude-opus-5.5", "google/gemini-3.8-flash"])  console.log(model, await solve(model, task));

Pythonimport jsonimport osfrom openai import OpenAIfrom withruntime import Sandboxclient = OpenAI(base_url="https://openrouter.ai/api/v1", api_key=os.environ["OPENROUTER_API_KEY"])def run_python(code: str) -> str:    with Sandbox.create(        network={"internet": False}, timeout_seconds=300, on_lease_end="stop", max_total_cost_micros=50_000    ) as sbx:        sbx.files.write("/workspace/main.py", code)        run = sbx.exec(["python3", "main.py"], timeout_ms=60_000)        return json.dumps({"exit_code": run.exit_code, "timed_out": run.timed_out, "stdout": run.stdout, "stderr": run.stderr})tools = [    {        "type": "function",        "function": {            "name": "run_python",            "description": "Run a Python 3.12 script in an offline sandbox; returns exit_code, stdout and stderr.",            "parameters": {"type": "object", "properties": {"code": {"type": "string"}}, "required": ["code"]},        },    }]def solve(model: str, task: str) -> str:    messages = [{"role": "user", "content": task}]    for _ in range(8):        message = client.chat.completions.create(model=model, messages=messages, tools=tools).choices[0].message        messages.append(message)        if not message.tool_calls:            return message.content or ""        for call in message.tool_calls:            code = json.loads(call.function.arguments)["code"]            messages.append({"role": "tool", "tool_call_id": call.id, "content": run_python(code)})    return "stopped after 8 turns"task = "How many primes are there below 10 million? Compute it."for model in ["openai/gpt-6-sol", "anthropic/claude-opus-5.5", "google/gemini-3.8-flash"]:    print(model, solve(model, task))

OpenRouter's guide says to send tools on every request. The loop does that, so each call is checked against the same schema. The model ids above were listed with tools support by OpenRouter's models API on 25 October 2026. Its catalogue filter supported_parameters=tools shows the current set.

What changes from model to model, and what does not

Because the sandbox is the same for every model, a benchmark of models on coding tasks measures the models, not their execution environments. For graded runs at scale, see agent evals and SWE-bench.

Compare models in parallel

The three calls to solve above run one after another. Wrap them in Promise.all, or in a thread pool in Python, and every model works at the same time. Each tool call still creates its own sandbox, so no model can see another's files or processes. A paid account runs 100 sandboxes at once, and an account without credit four. That limit sets how many models and tasks you can run side by side.

When code in the sandbox calls OpenRouter

Everything above keeps OPENROUTER_API_KEY on your server, because only the model's script enters the sandbox. The key belongs in Runtime only when the program inside the sandbox calls OpenRouter itself, for instance an agent you run there. Store it as a secret bound to OpenRouter's host:

Terminalprintf %s "$OPENROUTER_API_KEY" | npx withruntime secrets set OPENROUTER_API_KEY --host openrouter.ai

Then allow that host. The program uses the variable as if it held the key:

TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({  network: { internet: true, allow: ["openrouter.ai", "pypi.org", "*.pythonhosted.org"] },  timeoutSeconds: 900,  onLeaseEnd: "stop",});await sbx.exec(["pip", "install", "--quiet", "openai"], { check: true, timeoutMs: 180_000 });await sbx.files.write(  "/workspace/agent.py",  `import osfrom openai import OpenAIclient = OpenAI(base_url="https://openrouter.ai/api/v1", api_key=os.environ["OPENROUTER_API_KEY"])reply = client.chat.completions.create(model="openai/gpt-6-luna", messages=[{"role": "user", "content": "Say hi"}])print(reply.choices[0].message.content)`,);const run = await sbx.exec(["python3", "agent.py"], { timeoutMs: 120_000 });console.log(run.stdout);

Inside the sandbox, OPENROUTER_API_KEY holds a placeholder such as rtsec_3f9c…. The host's proxy replaces it with the real key only in HTTPS requests to openrouter.ai. A prompt injection that prints or sends the variable leaks nothing usable (secrets sandboxes never see).

Cost of the sandbox side

OpenRouter bills tokens. Runtime bills the sandbox for the CPU the code uses, at $0.025 per vCPU-hour with a floor of a twentieth of a vCPU. It adds memory at $0.0075 per GiB-hour. A thousand 60-second runs at 2 vCPU and 4 GiB, each using 20 CPU-seconds, cost $0.64. That holds whichever model wrote the code. New accounts get 100 free hours of a 1 GB machine in the first 30 days, with no card:

Terminalprintf '%s\n' 'print(sum([125, 250, 375]))' > invoice.pynpx withruntime sandboxes run -- python3 - < invoice.py

More: run untrusted LLM code, egress control, coding agent sandbox.

Sources

Checked 25 October 2026.

• OpenRouter: tool calling
• OpenRouter: models API, counted for tools in supported_parameters
• @openrouter/sdk on npm (1.5.7) and openai on PyPI (3.37.0)

Facts on this page were checked on 25 October 2026.