Sandboxes
Run code, generate files, and execute scripts inside an isolated sandbox environment directly from chat.
The sandbox gives the AI assistant a secure, isolated environment where it can run code and produce files as part of a conversation. When a user asks the assistant to analyze data, generate a report, convert a file, or automate a task, the assistant can execute the work inside the sandbox and attach the results back to the chat.
Each sandbox runs in an isolated container hardened with gVisor, a kernel-level sandbox that intercepts and mediates all system calls, preventing container escapes and limiting the blast radius of any misbehaving code.
The sandbox is an optional feature, switched on by a super admin in two stages: first for your organization — contact ai@mitigate.dev — and then per workspace, where it is off by default. See Workspaces — Sandbox.
What the Assistant Can Do
When the sandbox is enabled, the assistant has access to two tools:
| Tool | Description |
|---|---|
bash | Run shell commands inside the sandbox (install packages, run scripts, process files) |
present_files | Attach generated files back into the conversation so users can download them |
Languages and Runtimes
The sandbox comes pre-loaded with a universal developer image. The assistant can use all of the following without any setup:
| Runtime | Notes |
|---|---|
| Python | 3.x with pip, common data-science libraries |
| Node.js | Latest LTS, npm available |
| Ruby | Latest stable |
| Java | JDK included |
| Go | Latest stable |
| Rust | Latest stable via rustup |
| PHP | Latest stable |
| PowerShell | Cross-platform |
File Conversion Tools
Two powerful document conversion tools are pre-installed:
- LibreOffice (
soffice) — converts between office formats (DOCX ↔ PDF, PPTX ↔ PDF, XLSX ↔ CSV, …) and can generate or edit Word documents, Excel spreadsheets, and PowerPoint presentations programmatically. - Pandoc — universal document converter supporting Markdown, HTML, DOCX, PDF, EPUB, LaTeX, and many more formats.
Example Tasks
- "Analyze this CSV and generate a summary report as a PDF"
- "Convert this Word document to PDF"
- "Write a Python script that processes my data and give me the output file"
- "Create a PowerPoint presentation from this outline"
- "Convert this Markdown file to a Word document"
Persistent Storage
The sandbox mounts the following directories:
| Path | Scope | Description |
|---|---|---|
/mnt/skills | Per workspace | Skills available in this chat (read-only) |
/mnt/uploaded-files | Per chat | Files uploaded in this chat (read-only) |
/mnt/user-data | Per user | Files written here are available in future sandbox sessions for the same user |
/mnt/workspace-data | Per workspace | Files written here are shared between all users of the workspace |
The /mnt/user-data and /mnt/workspace-data directories survive across sessions, so the assistant can save intermediate results, templates, or generated assets and pick them up again in a later conversation — without the user needing to re-upload anything.
Artifacts
Files on the two persistent volumes are called artifacts. Open Artifacts in the workspace sidebar to browse them. It is a regular page with its own URL, so the volume and folder you are looking at can be bookmarked or shared with a colleague.
The page has one tab per volume:
| Tab | Volume | Who can see it |
|---|---|---|
| Workspace artifacts | /mnt/workspace-data | Everyone with access to the workspace |
| My artifacts | /mnt/user-data | Only you |
Click a folder to move into it and use the breadcrumb above the table to come back out. Files offer Download and Publish; both files and folders can be deleted. Deleting revokes any public link pointing at what you removed, including links to files inside a deleted folder.
Artifacts appears in the sidebar only when the sandbox is enabled for the workspace.
Publishing an Artifact
Publishing turns a file into a public page at /public/artifacts/<slug> that anyone with the link can open without signing in. The link serves the file as it is at the moment it is requested, so the assistant can keep editing an artifact and the published page stays current — there is no need to publish again after a change.
Use the share action on a file and confirm. The dialog that follows shows the URL and a Revoke link button; revoking invalidates the URL immediately. A published file is marked with a Published badge, and its share action reopens the same dialog so you can copy or revoke the link later. Any workspace member can publish; a link can be revoked by whoever published it, and by organization owners and admins.
How a published file is presented depends on its type:
| Type | Presentation |
|---|---|
| HTML, XHTML, SVG, XML | Rendered in a sandboxed iframe, under a banner reading "this content was generated by a user of {Organization} and is unverified" |
| PDF, plain text, PNG, JPEG, GIF, WebP, AVIF, BMP | Shown inline in the browser |
| Anything else | Served as a download |
A published link requires no sign-in and may show up in search engine results. Only publish artifacts whose contents are safe to make public — the chat that produced them stays private either way.
Turning Publishing Off
Publishing is controlled per organization by the Artifact publishing toggle under Admin → Organization Settings → Sandbox tab. It is on by default. Turning it off hides the publish action everywhere; links that are already public stay reachable and can still be revoked.
Network Policy
By default the sandbox can reach the internet, which lets the assistant install packages, download files, and call external APIs. You can restrict this outbound (egress) access with a network policy — a JSON document that whitelists or blocks specific destinations.
Configure it under Admin → Organization Settings → Sandbox tab → Network policy. The tab appears only when the sandbox is enabled for your organization. Leave the field empty to apply no restrictions.
A policy has two parts:
| Field | Description |
|---|---|
defaultAction | "allow" or "deny", applied to traffic that matches no rule. Defaults to "deny" when omitted. |
egress | An ordered list of rules, each with an action ("allow" / "deny") and a target. |
A target can be a fully-qualified domain name (pypi.org), a wildcard domain (*.githubusercontent.com), an IP address, or a CIDR range. Rules are evaluated in order and the first match wins; if nothing matches, defaultAction applies.
A wildcard matches subdomains only, not the bare domain: *.example.com covers api.example.com but not example.com itself. To cover both, add a rule for each (example.com and *.example.com).
For example, this policy denies everything except PyPI and GitHub's raw content hosts:
{
"defaultAction": "deny",
"egress": [
{ "action": "allow", "target": "pypi.org" },
{ "action": "allow", "target": "*.githubusercontent.com" }
]
}The network policy is applied when a sandbox is created, so changes take effect for new sandbox sessions rather than ones already running.
IP address and CIDR targets are only enforced when the egress filter runs in its dns+nft mode; domain rules (both exact FQDNs and wildcards) are enforced in every mode. If an IP or CIDR rule doesn't take effect, check the sandbox egress deployment mode with your operator.
Stdio MCP Connectors
When the sandbox is enabled, admins can configure additional MCP connectors that run inside the sandbox as stdio processes. This opens up the full npx/uvx MCP ecosystem to the assistant.
See Stdio MCP Connectors for configuration details.
Skills
Script-backed Skills also run inside the sandbox. When a workspace has the sandbox enabled, skill scripts are mounted read-only at /mnt/skills/<name>/ and the assistant can execute them via the bash tool.
See Skills for details on uploading and assigning skills.