Overview

What you get#

• A Debian Linux machine with Python 3, Node.js 24, git, build tools and Chromium. Commands run as the user agent, who can use sudo and install packages. Work goes in /workspace.
• Three sizes: small, medium and large. See Sizes.
• Automatic pause when idle, and resume on the next use, with memory and processes intact.
• Network rules per sandbox: open, restricted to domains you list, or none.
• Brokered secrets: API keys stay outside the sandbox and are added to requests on the way out.
• An interactive shell, the browser over the Chrome DevTools Protocol, and previews of web servers in the dashboard.
• Snapshots to roll a sandbox back, and forks to start new sandboxes from one. These are new.

Two ways to use it#

Both work the same way and can be mixed.

• From outside. Your program or agent harness runs elsewhere and calls the API, or mat, to run commands and move files.
• From inside. You start an agent CLI inside the sandbox, through mat shell or mat exec, and it works there. While it waits on its model, the sandbox counts as active.

The lifecycle in short#

$ ID=$(mat create)$ mat exec $ID -- python3 -c 'print(6*7)'42$ mat pause $ID$ mat exec $ID -- ls /workspace$ mat rm $ID

mat exec on a paused sandbox resumes it first. You pay for compute while a sandbox runs and for storage while it is paused. See Billing.

Keep your work#

Where to go next#

• Quickstart: sign in and run your first command.
• Concepts: pausing, network rules, secrets and previews.
• CLI reference and API reference.
• Security and privacy: what is isolated, and what we can see.