SiteDoctor: a sandboxed AI website doctor

Every web agent has to open untrusted pages, and untrusted pages run untrusted JavaScript. Next to API keys, cloud metadata or a private network, one hostile page is a breach. SiteDoctor is built for Blast Radius Zero: it assumes every site is hostile and still does useful work. Paste a URL. The control layer on a Vultr Cloud Compute VM starts a fresh Docker sandbox (non-root, read-only, all capabilities dropped, 1 GB / 1 CPU / 512 pids, no secrets inside) and audits the site on desktop and phone with Playwright and axe-core. Vultr Serverless Inference writes a prescription, but only from a fixed toolbox of safe fixes. A second, independent sandbox applies it and re-measures, and a fix only ships if it is proven. The owner gets a drop-in fix file, a before/after phone view and a short list of what needs a human. Containment: a browser network guard blocks cloud metadata, private ranges, the Docker API and third-party POSTs, and an iptables rule drops 169.254.169.254 at the kernel. Hidden prompt-injection text is detected and stripped from the model input; scores are computed by code, not by the model. Red Button Attack Lab: launch five hostile pages live (credential theft, data exfiltration, prompt injection, server break-in, CPU/memory bomb) or bring your own. 5 / 5 contained, the host is never touched. Benchmark: 43 real Astana business websites, average health 75 → 82, 41 improved, mobile 81 → 99, 113 trackers contained, 0 businesses falsely flagged. Live demo: http://199.247.16.167:8080 · Code: github.com/Shinigami-tech/sitedoctor