Tripwire Sandbox

Finance teams want agents that write code to reconcile vendor bills against payments, but model-written code is untrusted. Tripwire Sandbox runs every piece of agent-generated code in a fresh Docker container with no network, no secrets or env, a read-only filesystem plus a small tmpfs, and memory, CPU, PID and time caps. The container is destroyed after each task. When the code fails, the agent feeds the error back to the model and retries. The reconciliation output (matches, short payments, duplicates, unknown-vendor payments, unpaid bills) becomes proposed payments, which pass a deterministic policy gate and then wait for a CFO's approval. Denied payments can't be approved, and no payment rail is connected, so approvals record intent only. The containment demo has the agent's code try DNS, TCP and HTTP exfiltration, read env secrets, write to the root filesystem, fork-bomb and spin forever. Every attempt is blocked and logged. LLM calls use an OpenAI-compatible client pointed at Vultr Serverless Inference, and deploy/deploy_vultr.sh targets a Vultr Cloud Compute Ubuntu VM with Docker Compose. HONEST STATUS: submitted in MOCK mode. The Vultr inference integration and the Vultr deploy script are implemented but were NOT run live, because no Vultr credit was available. The app is NOT deployed on Vultr. The demo uses a clearly labelled offline mock model. The public link is a free Vercel host with no Docker, so it replays sandbox results recorded from a real local Docker run (labelled SANDBOX: REPLAY). The video was recorded against a local run with real Docker containers.