Brood Box (invoked via the `bbox` CLI) is an open-source agent harness and execution runtime developed by Stacklok. It provides a secure, sandboxed environment designed to package, orchestrate, and run containerized AI coding agents across Linux and macOS. Operating as a command-line harness, Brood Box allows developers to import and run autonomous agents packaged as standard OCI container images. Agents declare their runtime configurations using embedded manifests in image labels (such as `org.stacklok.broodbox.agent`) or standardized YAML paths, enabling reproducible agent deployment without manually managing host dependencies. Brood Box differentiates itself from traditional CLI agent wrappers through its defense-in-depth security model. It isolates agent execution within sandboxed runners and applies strict egress network policies, input sanitization, and layer inspection to defend against common autonomous agent vulnerabilities like SSRF, DNS rebinding, and host filesystem escapes. Brood Box is fully open source on GitHub and free to use for local development and automated CI/CD pipelines.
Tags: agent harness, cli, coding agent, developer tools, OpenSource