Snapshot
Scroll sideways to see all columns. With a keyboard, focus this table and use the arrow keys.
| Attribute | Detail |
|---|---|
Deployment | Local execution on Linux ARM64 and macOS with Apple silicon |
License | Apache License 2.0 |
Policy model | Checked operations are denied by default; a matching permit rule allows them and a matching forbid rule overrides that permission |
Enforcement | Seatbelt on macOS sets which files and programs the agent can reach, and each tool and local MCP server runs in its own sandbox |
Linux package requirements | glibc 2.34 or newer and the GCC runtime library (libgcc_s.so.1) |
Take
Choose Box when an agent needs OS-level containment together with policies that can weigh a request's context or earlier recorded actions. Preview status still applies, so pin your version. If the pilot targets Linux, check first that the release you pin ships a box-<version>-linux-arm64.tar.gz asset with its SHA256SUMS.txt entry, since a release can contain macOS assets only.
Evaluate Strands Box
Strengths
Dogwood rules can depend on the requested operation, its arguments, earlier actions, and elapsed time; a file read through one interpreter can affect whether a later network request is allowed.
The egress gateway authenticates permitted requests with configured API credentials or AWS SigV4 signing, and the agent does not receive the underlying secrets.
Box records policy decisions in OTLP JSON, with records going by default to
<box_dir>/private/telemetry/records.jsonl.strands_box::reloadreplaces a running box's policy from a host thread and waits until the change takes effect. Invalid policy returnsReloadRefusedand leaves the current policy in place, policy files and the OS sandbox stay unchanged, and an empty list denies all policy requests.
Trade-offs
The directory where the downloader stages its version check must be writable and allow execution.
Direct filesystem grants in
box.tomlare enforced by the OS but do not produce individual Dogwood decisions. To apply policy to file operations, use the interpreters and keep those files out of the agent's direct grants.Using Box as a Rust library means one Box workload per host process; later
runcalls fail, even if the first call failed.A rule for an MCP tool can reload only after Box loads that server's tool definitions. Without them, even reloading the unchanged policy is refused, and if policy blocks discovery, waiting will not help.
The Strands CLI walkthrough in the getting-started guide uses macOS 15 or later on Apple silicon, Node.js 22.21 or later from Homebrew, and access to Claude Opus 5 on Amazon Bedrock in
us-west-2.The release downloader tests run on Linux and macOS, but they use local fixture archives and simulated HTTP clients and do not qualify a published binary or its containment behaviour.
Cost and licensing
Box is open source under Apache License 2.0 and runs on your own machine. You install it with the download script, which checks the release checksum and unpacks the binaries into ./box-core without changing your PATH or system directories, or you build the binaries from the Cargo workspace. The spend therefore sits in the host you run the box on and the model access its agent needs, such as the Bedrock access the Strands CLI walkthrough requires.
Public signals
About these signals
Verified factual signals from public sources. They indicate observable activity or interest, not total adoption, product quality, or cost.
157 GitHub commits 90d504 GitHub stars
See all signals from 1 source
Sources
This review is based on the Strands Box repository and the Strands Agents product site, observed on 2026-11-09.