# North Bay Ventures: full text > North Bay Ventures (northbayventures.com) is a venture studio in Miami that builds the companies agents depend on™: Sandboxer (sandboxer.com) gives every agent its own computer, Transformer (transformer.gg) lets agents run creator campaigns, and Flagger.gg (flagger.gg) gives agents feature flags. Founded by Jon Oringer, the founder of Shutterstock. Operated by North Bay Opco I, Inc. (a Delaware corporation), 777 Brickell Ave, Suite 500 PMB 1074, Miami, FL 33131. Contact: support@northbayventures.com. --- # About North Bay Ventures URL: https://www.northbayventures.com/about/ Updated: 2026-10-31 North Bay Ventures is a venture studio in Miami that starts new companies and builds them itself, from the first line of code to the first paying customer. It was founded by Jon Oringer, the founder of Shutterstock, and today it builds Sandboxer, Transformer and Flagger.gg. ## What is a venture studio? A venture studio is a company that creates other companies. Instead of investing in founders who arrive with an idea, the studio comes up with the idea, builds the product and runs the business through its earliest stage. That is different from a venture capital fund, which writes checks into companies other people run, and from an accelerator, which coaches outside teams for a few months. A studio does the work. At North Bay Ventures, the same small group writes the code, ships the product, answers support email and sets up billing. ## What does North Bay Ventures build? Three companies are live today: - Sandboxer gives AI agents and people their own cloud computers. Each sandbox is an isolated Ubuntu microVM that starts in a fraction of a second, can be paused with its memory and forked, and is billed per second. Learn more at sandboxer.com. - Transformer is the agentic influencer marketplace. Real creators, paid on verified posts. Run it from the dashboard or from your agent. Brands send offers to creators, pay only once a post is verified and track the clicks and sales each post drives. Learn more at transformer.gg. - Flagger.gg is feature flags for AI agents. Agents create, flip and roll back flags through MCP, the CLI and SDKs, with guardrails, an audit trail and human approval. Sign up at app.flagger.gg. All three follow the same pattern: software that AI agents can use directly, through an API, a CLI or an MCP server, as easily as a person can use it through a website. ## Why build companies this way? Building software has become much cheaper and faster. A small team that uses AI agents well can now do work that used to take a large engineering department. The bottleneck has moved from writing code to picking the right problems, shipping quickly and getting the product in front of people. A studio is built for that. Each new company starts on shared foundations, such as domains, email, payments, hosting and legal templates, so its team can spend its time on the product from day one. Lessons from one company carry over to the next. See how we build for the details. ## Who runs North Bay Ventures? North Bay Ventures was founded by Jon Oringer, who started Shutterstock in 2003 and led it as CEO through its listing on the New York Stock Exchange in 2012. The studio is run as a small team of builders, working alongside AI agents that handle a large share of the day-to-day engineering, support and operations. ## Where is North Bay Ventures based? The studio is based in Miami, Florida. Its companies serve customers worldwide over the internet. The legal entity behind North Bay Ventures and its companies is North Bay Opco I, Inc., a Delaware corporation, at 777 Brickell Ave, Suite 500 PMB 1074, Miami, FL 33131. You can reach us at support@northbayventures.com. ## Frequently asked questions ### Is North Bay Ventures a VC fund? No. North Bay Ventures is a venture studio: it starts and builds its own companies rather than investing in companies run by outside founders. ### Which companies has North Bay Ventures built? Today it builds Sandboxer, cloud sandboxes for AI agents, Transformer, the agentic influencer marketplace, and Flagger.gg, feature flags for AI agents. ### Who founded North Bay Ventures? Jon Oringer, the founder of Shutterstock. ### How do I contact North Bay Ventures? Email support@northbayventures.com. Product questions are best sent to each company's own support address, listed on sandboxer.com and transformer.gg. --- # What makes a company AI-native? URL: https://www.northbayventures.com/ai-native-companies/ Updated: 2026-10-31 An AI-native company is built around AI agents from its first day: agents do a large share of the work, and the product is designed so that other people's agents can use it too. It is a different way of organizing a company, not just a company that added an AI feature. ## How is AI-native different from adding AI features? Many companies add AI to an existing product, such as a chatbot in the help center or a summary button. That can be useful, but the company still works the way it did before. An AI-native company is organized differently. Its team is small, and agents handle routine engineering, testing, routine support replies, research and project tracking. People spend their time on judgment: what to build, what to ship and what to approve. ## Why should products be usable by agents? More and more work is started by an agent acting for a person. A developer asks a coding agent to set up a test environment, or a founder asks an assistant to find creators for a launch. If a product can only be used by clicking through a website, the agent gets stuck. AI-native products expose the same capabilities through an API, a command-line tool and an MCP server, the Model Context Protocol that lets assistants such as Claude call tools directly. Both North Bay Ventures companies work this way. Sandboxer's MCP server lets an agent create and control sandboxes, and Transformer's MCP tools let an agent run a creator campaign. ## Where do people stay in control? Being AI-native doesn't mean letting agents do anything. The useful split is between reversible, routine work, which agents can do freely, and decisions with real consequences, which need a person. At North Bay Ventures that means a person approves anything that spends money, changes a customer's plan, deletes data, changes legal terms or DNS, promises a date, emails customers in bulk or carries risk in production. Routine support replies go out without waiting, with a person copied. Products can give their users the same guardrails, for example by keeping a person in control of spending and approvals even when an agent runs the day-to-day work. ## What new infrastructure do AI-native companies need? Agents need safe places to run code. Code written by an AI, or downloaded from an unknown source, shouldn't run on a laptop or a production server. That's the problem Sandboxer solves: every agent gets its own isolated microVM that can be created, paused, forked and thrown away in seconds. Agents also need ways to reach people. When building is cheap, distribution becomes the hard part. Transformer lets a builder, or the builder's agent, pay creators to reach their audiences, and pay only for verified posts. And agents need a safe way to ship. When agents merge many small changes, each one should reach production switched off and be turned on deliberately. Flagger.gg lets agents create, roll out and kill feature flags through MCP, a CLI and SDKs, with an audit trail, and lets a team require a person's approval for wider rollouts when it wants one. See how the three work together. ## How do you start building an AI-native company? - Start small and give agents real, well-scoped work from day one. - Write things down, such as runbooks, rules and decisions, so agents and people work from the same instructions. - Make every action safe to retry and easy to roll back. - Decide in advance which actions need a person's approval. - Build an API and an MCP server alongside the website, not after it. ## Frequently asked questions ### What is an AI-native company? A company organized around AI agents from day one, where agents do much of the routine work and the product can be used by other people's agents as well as by people. ### What is MCP? The Model Context Protocol is an open standard that lets AI assistants call external tools and services directly, such as creating a sandbox or sending a creator offer. ### What tools does an AI-native company need? At minimum: safe, isolated machines where agents can run code, a way to ship agents' changes switched off and roll them out deliberately, and products and services that agents can use directly through an API, a CLI or an MCP server. ### Do AI-native companies still need people? Yes. People choose what to build and approve decisions involving money, legal terms, commitments to customers and production risk. --- # Our companies URL: https://www.northbayventures.com/companies/ Updated: 2026-10-31 North Bay Ventures builds three companies today. Sandboxer gives AI agents their own cloud computers, Transformer lets brands and their agents pay creators for verified posts, and Flagger.gg gives agents feature flags they can flip safely. ## Sandboxer: cloud sandboxes for AI agents Sandboxer gives every AI agent, or person, its own isolated Linux computer in the cloud. Each sandbox is an Ubuntu microVM with root access, Docker and nested virtualization. It starts in a fraction of a second, can be paused with its memory intact and resumed later, and can be forked into copies. Usage is billed per second. Teams use it to run coding agents, to run many agents in parallel, to execute untrusted or AI-generated code safely, and to run evaluations and tests in clean environments. Agents can drive it directly through SDKs, a CLI, a REST API or a hosted MCP server. - What is Sandboxer? - What is an agent sandbox? - Sandboxer pricing - sandboxer.com ## Transformer: the agentic influencer marketplace Real creators, paid on verified posts. Run it from the dashboard or from your agent. Transformer connects brands with creators. A brand, or the brand's AI agent, finds creators, sends offers and pays only once a post is verified as live. Each post's clicks and sales are tracked, so the brand knows what it bought. Creators keep 80% of every deal. Brands can also generate their own AI influencers. It is built for builders who can ship a product but need distribution. Everything in the dashboard is also available over an API, a CLI and an MCP server, so a founder's own agent can run a creator campaign. - What is Transformer? - How Transformer works - Transformer pricing and fees - transformer.gg ## Flagger.gg: feature flags for AI agents Your agents create, flip and roll back flags through MCP, the CLI and SDKs. Every change has guardrails and an audit trail, and humans approve. Flagger.gg is a hosted service built from the flag system that runs Sandboxer and Transformer in production. Apps check flags with the Go and Node SDKs, agents work through MCP and the CLI, and teams choose auto-live, where agents' changes apply at once, or approvals, where a person signs off on wider rollouts in the Release console. There is no public pricing yet. - What is Flagger.gg? - Feature flags instead of staging - Sign up for Flagger.gg ## What do the companies have in common? Both are built for a world where AI agents do real work. Sandboxer gives agents a safe place to compute. Transformer gives agents a way to buy distribution. Flagger.gg lets agents ship changes safely behind feature flags. Each can be used end to end without a person clicking through a website, and each keeps a person in control of spending and approvals. They also share the studio's foundations: one legal entity, shared infrastructure for email, hosting and payments, and the same release discipline. See how we build. ## How do I follow the companies? Sandboxer posts as @Sandboxer_ and Transformer as @Transformer_gg on X. Flagger.gg doesn't have an X account yet. Founder Jon Oringer posts as @jonoringer. ## Frequently asked questions ### Are Sandboxer and Transformer separate companies? They are separate products with their own websites, support and customers, built and operated by North Bay Ventures under North Bay Opco I, Inc. ### Can AI agents use Sandboxer and Transformer directly? Yes. Both offer an API, a CLI and an MCP server, so an agent can use them without a person in the loop for routine work. ### Where do I get support for Sandboxer or Transformer? Use the support links on sandboxer.com or transformer.gg. General questions about the studio go to support@northbayventures.com. --- # How do you write documentation AI agents can use? URL: https://www.northbayventures.com/documentation-for-ai-agents/ Updated: 2026-11-02 Write it so it reads well as plain text. Publish each page as Markdown, describe your API in an OpenAPI file, put the whole set in one llms-full.txt, and give exact, copyable examples. Agents don't see your layout or your menus; they see words, so every fact has to be in the words. ## How do AI agents read documentation? An agent fetches a page, turns it into text and looks for the answer to the step it's on. Navigation, scripts and tabs are noise, and content that only appears after a click may never be seen. An agent also has limited room to read, so a page that answers first and links to the detail serves it better than a long page with the answer near the end. ## Should every page have a Markdown version? Yes, if you can. A Markdown copy of each page gives an agent the content without the page around it. Sandboxer serves its docs and guides as Markdown, for example its long-running tasks page, and Transformer does the same for its blog posts, such as its CLI guide. ## Why publish an OpenAPI file? An OpenAPI file describes every API operation, its inputs and its responses in a format programs can read. Agents and code generators can use it directly instead of guessing from prose. Sandboxer describes its REST API in one OpenAPI file and publishes the same content as one page per operation. ## What are llms.txt and llms-full.txt for? llms.txt is a short summary with the key facts and links; llms-full.txt puts the full text in one file, so an agent can load everything at once. Sandboxer's llms-full.txt holds its full docs. Transformer's llms-full.txt adds the offer lifecycle, its MCP tool list, API examples, the FAQ and the developer docs. Flagger.gg's llms-full.txt has every page on its site as plain text. Read what llms.txt is. ## What makes an example useful to an agent? It runs as written. Show the full command with real flags and machine-readable output, and say what it returns. Flagger.gg's docs show an agent turning off a flag with a reason attached: flagger kill search_v2 --note "error rate up after 10%" --json. Transformer's show a sale being reported from the command line: transformer conversions report --click --amount 49 --order A-1001. ## Are MCP tool descriptions documentation too? Yes, and often the only documentation an agent reads. Each tool's name and description decide whether the model picks it. Transformer's tool list says which side each tool is for, brand or creator, and what it returns. Flagger.gg lists only the tools an agent's token allows, so the agent never sees actions it can't take. See what MCP is. ## How do you stop agents from promising things that don't exist? Label what isn't available yet, in the same place you describe what is. Flagger.gg's docs list features as "in development", such as guarded rollouts with automatic rollback and SDKs beyond Go and Node, so an assistant reading them won't offer those as live. Then keep the docs current: an agent trusts the page it reads. For the full agent-readiness list, see how to make a product AI agents can use. ## Frequently asked questions ### What format should documentation for AI agents use? Plain Markdown for pages, an OpenAPI file for the API, and an llms.txt plus llms-full.txt at the root of the site. ### Do AI agents read OpenAPI files? Many agents and tools can. An OpenAPI file gives exact operations, inputs and responses, which is more reliable than prose. ### Is llms-full.txt the same as documentation? It is the documentation in one file. Sites generate it from the same source as their pages so the two never drift apart. ### Should I write separate docs for agents and for people? Usually not. Clear, answer-first pages with exact examples serve both. Add Markdown versions and one-file exports for agents. --- # North Bay Ventures FAQ URL: https://www.northbayventures.com/faq/ Updated: 2026-10-31 North Bay Ventures is a Miami venture studio that builds AI-native companies, currently Sandboxer, Transformer and Flagger.gg. Below are answers to the questions we're asked most. ## About the studio What is North Bay Ventures? A venture studio that starts companies and builds them itself, from the first line of code to paying customers. See about us. Who founded it? Jon Oringer, the founder of Shutterstock. Where is it based? Miami, Florida. The legal entity is North Bay Opco I, Inc., a Delaware corporation, at 777 Brickell Ave, Suite 500 PMB 1074, Miami, FL 33131. Does North Bay Ventures invest in outside startups? No. It builds its own companies rather than investing in companies run by outside founders. ## About the companies Which companies does North Bay Ventures build? Sandboxer, cloud sandboxes for AI agents, Transformer, the agentic influencer marketplace, and Flagger.gg, feature flags for AI agents. See our companies. What is Sandboxer? A service that gives every AI agent or person its own isolated Ubuntu microVM in the cloud, which can be paused, resumed and forked and is billed per second. The Sandboxer FAQ has details. What is Transformer? A marketplace where brands and their agents send offers to creators and pay only for verified posts, with clicks and sales tracked. The Transformer FAQ has details. ## Working with us How do I get product support? Use the support contact on sandboxer.com or transformer.gg. Those teams answer product and billing questions fastest. How do I contact the studio? Email support@northbayventures.com. How do I follow along? On X: @jonoringer, @Sandboxer_ and @Transformer_gg. ## Frequently asked questions ### What does AI-native mean at North Bay Ventures? AI agents are part of the team from day one, doing much of the routine engineering and operations work, and every product can be used by agents directly through an API, a CLI and an MCP server. ### How is a venture studio different from a VC fund? A VC fund invests money in companies that other founders run. A venture studio comes up with the ideas and builds and runs the companies itself. ### Why does North Bay Ventures focus on AI agents? Agents have made building software much cheaper, and they create new needs: safe places to run code, which Sandboxer provides, and new ways to reach customers, which Transformer provides. ### Are Sandboxer, Transformer and Flagger.gg live? Yes. All three are live: Sandboxer at sandboxer.com, Transformer at transformer.gg and Flagger.gg at flagger.gg. --- # Feature flags instead of staging URL: https://www.northbayventures.com/feature-flags-instead-of-staging/ Updated: 2026-10-29 Every North Bay Ventures company ships straight to production. Work that isn't ready is merged and deployed switched off behind a feature flag, then turned on for the right people when it is ready. New companies get no staging server at all. ## Why skip the staging server? A staging server is a second copy of production that is never quite the same: different data, different traffic, different settings. Bugs that only show up in production still reach production, and every release waits on a step that adds little. When coding agents write a large share of the code, changes arrive faster and in smaller pieces. Merging each one, deploying it switched off and turning it on deliberately keeps that pace safe. The deploy and the release become two separate decisions. So when the studio launches a new company, it creates no staging environment: no staging secrets, no staging subdomain, no staging database and no staging deploy step. Sign-in and payments are set up for production and local development only. Sandboxer and Transformer, which were built before this rule, ship behind the same flag system. ## How does a flag move from off to on? Each flag is in one of five states, and a feature usually moves through them in order: | State | Who sees the feature | off | No one | admins | Platform admins only | targets | Named users and workspaces, plus admins | percent | A sticky share of users, plus admins | on | Everyone Targets can be user ids, verified email addresses or workspace ids. Percentage rollouts are sticky: a user's bucket comes from a hash of the flag key and their user id, so raising the percentage only ever adds people. Target lists are kept whatever the state, so switching state never loses them. ## Why are flags declared in code? Every flag is declared in the app's code with a key, a description, an owner and a default. When the app starts, any declared flag that doesn't exist yet is added as off, and a state someone already set is never overwritten by a deploy. There is no way to create or delete a flag through the admin API. That keeps the code and the flag list from drifting apart. A flag exists because some code checks it, and it goes away when that code is deleted. ## What happens when something goes wrong? The rule is off by default. A flag that is unknown, not yet loaded or hit an error counts as off, so a bad deploy or a slow database never turns on unfinished work by accident. Signed-out visitors and background jobs with no user only see flags that are fully on. If a feature misbehaves after it's turned on, a kill switch sets the flag off in one call and keeps its targets, so it can be turned back on exactly as it was. Every change records who made it, when, the state before and after, and a note. ## How do flags stay safe and private? - The server decides. The server checks every flag and enforces it. The browser only hides what the server already refuses. - Nothing extra reaches the browser. A signed-in user receives only the flags that are on for them. The full list and the targeting are never sent to anyone who isn't an admin. - No secrets in flags. Flags hold state and targeting, never keys or tokens. - Admins only. Changing a flag takes an admin session or an admin CLI login. Customer API keys never get flag access. Checks are fast because they read an in-memory snapshot that refreshes every 5 seconds and right after any change, so a flag adds no network call to a request. ## How do you test code behind a flag? Both paths stay tested until the flag is removed. Three small helpers make that routine: - withFlag(key, on, fn) runs one test with the flag forced on or off. - setFlagOverride(key, on) forces a flag for a whole test file. - bothFlagStates(key, fn) runs a test with the flag off, then on. The last habit is the one teams most often skip: remove the flag when done. Once a feature is on for everyone and stable, delete the flag and the old code path, so the codebase doesn't fill up with switches nobody remembers. ## Frequently asked questions ### Is it risky to deploy unfinished code to production? Not if it's switched off. Code behind a flag that is off doesn't run for users, and an unknown or failed flag check counts as off, so a deploy can't turn a feature on by accident. ### Do you still test before releasing? Yes. Every change has tests, and flag helpers run them with the flag off and on. The flag lets admins and chosen users try the feature in real production before everyone else sees it. ### Who can turn a flag on? Only admins, through an admin session or the CLI. Customer API keys can never change flags. ### When should a flag be deleted? Once the feature is on for everyone and stable. Delete the flag and the old code path together. --- # Is Flagger.gg the same as Flux Flagger? URL: https://www.northbayventures.com/flagger-gg-vs-flux-flagger/ Updated: 2026-11-03 No. They are unrelated projects that share a name. Flagger.gg is a hosted feature-flag service from North Bay Ventures, built for teams whose code is written by AI agents. Flagger from the Flux project is an open-source Kubernetes operator that shifts traffic to a new version of a service gradually. One switches features inside your code; the other routes traffic between deployments. ## What is Flux Flagger? Flagger is a progressive delivery tool that automates releases for applications running on Kubernetes. Its documentation says it reduces the risk of a new version by gradually shifting traffic to it while measuring metrics and running conformance tests, and that it implements canary releases, A/B testing and blue/green mirroring using a service mesh or an ingress controller. It is a Cloud Native Computing Foundation graduated project and part of Flux, and its code is at github.com/fluxcd/flagger. ## What is Flagger.gg? Flagger.gg is a hosted feature-flag service. Apps check flags with its Go and Node SDKs, which evaluate them in memory, so a check never makes a network call. Agents create, flip, roll out and kill flags through an MCP server, the flagger CLI and the API, using agent tokens scoped to one project, chosen environments and specific actions, which last 90 days at most. Every agent write needs a note, every change lands in an audit log, and agents have no approve tool. It is not open source. Sign up at app.flagger.gg; there is no public pricing. ## How do they differ? | | Flagger.gg | Flux Flagger | What it is | A hosted feature-flag service | A Kubernetes operator for progressive delivery | What it switches | Features inside your code, per user, workspace or percentage | Traffic between versions of a deployment | Where it runs | Hosted; flags evaluated in your app by the Go or Node SDK | Inside your Kubernetes cluster | Who drives it | People in a console and AI agents over MCP, the CLI and the API | Kubernetes resources, with a service mesh or ingress controller | Source | Not open source | Open source, a CNCF graduated project | From | North Bay Ventures | The Flux project ## Which one do you need? Use Flux Flagger when you deploy on Kubernetes and want new versions of a service to take traffic step by step, with automatic analysis of metrics. Use Flagger.gg when you want to turn individual features on for some users and off for others without a deploy, and when AI agents should be able to create and roll back those flags themselves, within limits a person sets. They solve different problems, so a team could use both. Automatic rollback tied to metrics is something Flagger.gg lists as in development, not available yet. For Flagger.gg's own explanation, see what a feature flag is. ## Why the shared name? Both names come from the idea of a flag. The .gg is part of the product's name, which is why North Bay Ventures always writes it as Flagger.gg. Flagger.gg's own site says plainly that it is not the Flux/CNCF Flagger, and not a Discord bot. To see where Flagger.gg fits alongside the studio's other products, read how Sandboxer, Flagger.gg and Transformer work together. ## Frequently asked questions ### Is Flagger.gg related to Flux or the CNCF? No. Flagger.gg is a separate hosted service from North Bay Ventures. The Flux/CNCF Flagger is an unrelated open-source Kubernetes operator. ### Does Flagger.gg need Kubernetes? No. It works with any app that can use its Go or Node SDK, wherever the app runs. ### Is Flagger.gg open source? No. It is a hosted service. ### Is Flagger.gg a Discord bot? No. It is a feature-flag service for teams whose code is written by AI agents. --- # How the studio uses agents day to day URL: https://www.northbayventures.com/how-the-studio-uses-agents/ Updated: 2026-10-30 At North Bay Ventures, a chief-of-staff agent takes every request from the founder, Jon Oringer, and hands long work to worker agents that each own one area. Workers report back with proof. Anything hard to undo waits for Jon's own yes. ## What does the chief-of-staff agent do? It is the front door. Jon asks for things in plain language, and the chief of staff turns each request into a task, decides who should do it, follows up and reports back. It also writes a daily brief across the companies at 8:00 AM Eastern. Its most important rule is that it should never be blocked. Anything that takes more than a few minutes, such as a deploy, a mail migration or a new website, goes to a worker, so the chief of staff's own conversation stays free for the next request. ## What are worker agents? Workers are long-running agents with one area each. One handles infrastructure and mail. One owns the northbayventures.com website. Sandboxer, Transformer and Flagger.gg each have their own chief-of-staff agent for their company, which reports up to the studio's. Giving each worker a clear area keeps parallel work from colliding. The website worker changes the website repository and deploys it; it doesn't change mail or DNS. When it needs something outside its area, it asks the worker that owns it. When a new site's certificate wouldn't issue, for example, it asked the infrastructure worker to read server logs it had no access to, and that worker found and fixed the problem. ## How do workers report back? Every report has the same short shape: - what changed; - the pull request; - the commit that was deployed; - proof that it's live, such as every page returning 200; - anything that needs Jon. Proof matters more than confidence. "Fixed" means the change is deployed and checked in production. If something is only partly done, or a check failed, the report says so plainly. Times shown to Jon are in Eastern, in 12-hour format. ## Who approves what? Only Jon approves. That is a hard rule, and it has a second half: an approval passed along by another agent only counts if it quotes Jon's own words. "Jon approved" isn't enough. "Jon said: go for it" is. His yes is needed for anything that is hard to reverse or visible to customers: - spending money and changing plans; - legal terms; - DNS changes; - deletions; - launching or changing public sites and products; - bulk email and promised dates. Some routine work has a standing yes, so it doesn't wait. Correcting a fact so it matches the product's own site, fixing a broken link, routine support replies with a person copied, and routine content for search and AI assistants all go ahead without a fresh approval each time. ## What happens when an approval is missing? The work gets done and then waits. The worker prepares everything up to the final switch, such as a reviewed pull request ready to merge, and asks for Jon's words. When a new tagline was requested without a quote, for example, the change sat in a ready pull request, and it shipped within minutes of the quote arriving. Nobody is blocked, and nothing customer-visible goes out on a guess. ## What runs on a schedule? Recurring work runs as scheduled tasks rather than as something a person has to remember: - the daily brief at 8:00 AM Eastern; - a daily check that compares every fact about Sandboxer and Transformer on northbayventures.com with each product's own site, and fixes any drift; - a steady flow of new answer-first pages and social posts; - watchers that wait on slow outside events, such as a domain's DNS switching over, and finish the job when it happens. Scheduled tasks report only when something changed or failed, so the chief of staff isn't flooded with "nothing to report". ## Frequently asked questions ### What can the agents not do without the founder? Anything that costs money, changes legal terms, touches DNS, deletes data or goes public. Agents prepare that work, then wait for Jon's own yes. ### Why use one chief-of-staff agent instead of talking to each agent directly? It gives the founder one place to ask and one place to hear back. The chief of staff hands long work to workers, so it is never stuck waiting on a deploy. ### How do you stop an agent from acting on a fake approval? An approval relayed by another agent only counts if it quotes the founder's own words. Without the quote, the work waits in a ready pull request. ### Can other teams work this way? Yes. The pieces are simple: one front-door agent, workers with clear areas, reports with proof, scheduled checks and a short list of decisions only a person can make. --- # How do you write instructions for AI coding agents? URL: https://www.northbayventures.com/how-to-write-instructions-for-ai-coding-agents/ Updated: 2026-11-02 Put them in a short Markdown file at the root of the repository: AGENTS.md for most coding agents, or CLAUDE.md for Claude Code. The agent reads it before it starts, so write down what a capable new teammate would need on day one: how to build and test, the rules that aren't obvious from the code, and which decisions belong to a person. ## What are AGENTS.md and CLAUDE.md? Both are plain Markdown files that a coding agent loads as standing instructions for a project. AGENTS.md is an open format read by many coding agents, including OpenAI's Codex; it is described at agents.md. CLAUDE.md is the file Claude Code reads; it can live in the project, in a subfolder for instructions that only apply there, or in your home folder for rules that apply everywhere. Anthropic documents how Claude Code loads it in its memory guide. The content is the same kind of thing either way, so many teams keep one file and point the other at it. ## What should go in the file? - How to build, test and run. The exact commands, so the agent can check its own work before it says it's done. - How changes ship. For example: branch from main, open a pull request, let the automated checks pass, never push to main. - Rules the code can't show. Naming, where secrets live, which files are generated and must not be edited by hand. - Who decides what. The actions that need a person's yes, such as spending money, deleting data or changing anything customers see. - How to report back. What changed, the pull request, proof it works, and anything that needs a person. ## What should stay out of it? Anything the agent can read from the code itself, long background essays, and anything secret. Keys and passwords belong in a secrets manager, never in a file the agent reads and might repeat. Leave out instructions that only matter for one task, too; put those in the request for that task instead. Keep it short. Every line is read on every run, and a file full of rarely relevant detail buries the few rules that matter. If a rule keeps being broken, make it clearer or move it higher rather than adding more words around it. ## How does North Bay Ventures use instructions like these? The studio's agents work under written rules that read much like a good instructions file. Every change goes through a pull request with automated checks. Only Jon approves money, legal terms, DNS, deletions and launches, and an approval passed along by another agent counts only if it quotes his words. Every report says what changed, links the pull request and shows proof that it's live. Read how the studio uses agents and how we build companies for the details. ## How do you give many agents the same instructions? Commit the file to the repository, so every agent that checks out the code reads the same rules. When agents run on their own machines, put the files in the image they start from. In a Sandboxer sandbox, coding agents read their usual config files, such as CLAUDE.md, AGENTS.md, MCP server configs and settings, so you can bake them into a named snapshot and start every sandbox from it. For running several agents side by side, see running many coding agents in parallel. ## Frequently asked questions ### Where does AGENTS.md go? At the root of the repository. Some agents also read AGENTS.md files in subfolders, with the closest one applying to the files in that folder. ### Should I have both AGENTS.md and CLAUDE.md? Only if you use agents that read different files. Keep one source of truth and have the other point to it, so the two never disagree. ### How long should an instructions file be? As short as it can be while covering how to build, test and ship, and which decisions need a person. A page or two is plenty for most projects. ### Can I put API keys in the instructions file? No. Keep secrets in a secrets manager or environment variables. Anything in the file may be read, repeated or committed. --- # How we build companies URL: https://www.northbayventures.com/how-we-build/ Updated: 2026-11-01 We build each company with a small team of people working alongside AI agents, on shared foundations that every company reuses. The result is that a new company can go from a domain name to a live product with billing, email and support in days instead of months. ## What does AI-native mean in practice? AI-native means agents are part of the team from the first day, not a feature added later. At North Bay Ventures, AI agents write and review code, run tests, prepare deploys, answer routine support email, research markets and keep project trackers up to date. People set direction, make the decisions that matter and approve anything that touches money, legal terms or commitments to customers. It also shapes what we build. Our products are designed to be used by agents as well as people, so each one offers an API, a command-line tool and an MCP server alongside its website. Read more in what makes a company AI-native. ## What do all our companies share? Every company starts from the same foundations, so nobody rebuilds the basics: - Domains and DNS on Cloudflare, set up the same way for each company. - Email for transactional messages, outreach and support, with authentication (SPF, DKIM and DMARC) configured from the start so mail is delivered. - One shared inbox where support, legal and security mail for every company arrives, with agents sending routine support replies themselves and a person copied. Anything involving money, plan changes, deletions, legal matters, promised dates or bulk email waits for a person's approval. - Secrets management, so credentials are never stored in code. - Hosting and deploys with health checks, smoke tests and a rollback reference for every release. - Legal templates for terms of service, privacy policies and acceptable use, all under one legal entity. Launching a new company is largely one command that sets these up from a domain name. The parts that still need a person, such as opening a payments account, are written down step by step. ## How do we decide what to build? We look for problems that AI has just made newly solvable or newly urgent. Sandboxer exists because AI agents need somewhere safe to run code, and lots of them at once. Transformer exists because shipping software has become easy while distribution has not, and because brands increasingly want their own agents to run marketing for them. We favor ideas where a small team can ship a real product quickly, where customers can try it themselves without talking to sales, and where the product is useful to agents as well as people. ## How do we keep quality high while moving fast? Speed only helps if releases are safe. Our rules are simple. Every change has tests. Risky changes get an independent review. Every deploy is checked in production and can be rolled back. Anything involving money, plan changes, deletions or legal terms, any promised date and any bulk email to customers needs a person's explicit approval. We also measure in public where we can. Product claims such as speed or prices are taken from the product's own documentation, and we update them when they change. ## How do changes reach production? Every change, whether a person or an agent wrote it, goes through a pull request. Automated checks must pass before it can merge, and a second agent reviews any change to product code, billing, sign-in or infrastructure; the author fixes what the reviewer finds. Once the checks pass, the change merges itself, so no one waits for an approval that doesn't add anything. After merge, changes go straight to production. New companies have no staging server; read feature flags instead of staging. This website, for example, deploys within minutes of a merge: the merged commit is rebuilt in a locked-down sandbox, shipped, and every page is checked before the deploy counts as done. ## How do we get companies in front of customers? Distribution is planned from day one. Each company publishes clear, accurate documentation and answer-first guides so that search engines and AI assistants can find and cite it. Each also runs its own social accounts, and some reach customers directly through outreach. Transformer is itself a distribution product: it helps other builders reach audiences through creators. ## Frequently asked questions ### Do AI agents run North Bay Ventures companies on their own? No. Agents do a large share of the engineering and operations work, but people set direction and approve anything involving money, legal terms, commitments to customers or production risk. ### How long does it take to launch a new company? The shared foundations (domains, email, hosting and legal templates) can be set up in a day. How long the product takes depends on the product. ### Can I use the same approach for my company? Much of it, yes. Sandboxer is the kind of infrastructure we use to run agents safely, and Transformer helps with distribution. ### Do your agents push code straight to production? No. Every change goes through a pull request with automated checks, and changes to code or infrastructure also get a review from a second agent. Once the checks pass, the change merges and ships to production automatically. --- # Jon Oringer URL: https://www.northbayventures.com/jon-oringer/ Updated: 2026-10-31 Jon Oringer is the founder of North Bay Ventures, a Miami venture studio that builds AI-native companies. He previously founded Shutterstock in 2003 and led it as CEO through its listing on the New York Stock Exchange in 2012. ## Who is Jon Oringer? Jon Oringer is a software engineer and entrepreneur. He is best known as the founder of Shutterstock, the stock photography and media marketplace. He started it in 2003 by uploading his own photos and grew it into one of the largest marketplaces for licensed images, video and music, serving customers around the world. Today he runs North Bay Ventures, where he starts and builds new companies, writing product and working directly with the AI agents that do much of the engineering and operations work. ## What did Jon Oringer build at Shutterstock? Shutterstock was one of the early two-sided marketplaces for creative work: contributors upload photos, videos and music, and businesses license them. Its subscription model let customers download images at scale instead of buying them one at a time. The company went public on the New York Stock Exchange in 2012 under the ticker SSTK. That experience with marketplaces, creators and self-serve software runs through North Bay Ventures. Transformer, for example, is also a marketplace between creators and the businesses that pay them. ## What is Jon Oringer building now? At North Bay Ventures he is building three companies: - Sandboxer, cloud sandboxes where AI agents and people get their own isolated Linux computers, billed per second. - Transformer, an influencer marketplace where brands and their agents pay creators only for verified posts. - Flagger.gg, feature flags for AI agents. All three are designed so that AI agents can use them directly, through an API, a CLI or an MCP server. ## Why AI-native companies? The cost of building software has dropped sharply because AI agents can now do much of the work. That changes what a small team can attempt, and it creates new needs, such as safe places for agents to run code and new ways to reach customers. North Bay Ventures exists to build companies for that world. See what makes a company AI-native. ## How do I follow Jon Oringer? Jon posts on X as @jonoringer. For the studio, email support@northbayventures.com. ## Frequently asked questions ### What company did Jon Oringer found? Jon Oringer founded Shutterstock in 2003. He now runs North Bay Ventures, a venture studio that builds Sandboxer, Transformer and Flagger.gg. ### When did Shutterstock go public? Shutterstock listed on the New York Stock Exchange in 2012, under the ticker SSTK. ### Where is Jon Oringer's company based? North Bay Ventures is based in Miami, Florida. --- # How do you make a product AI agents can use? URL: https://www.northbayventures.com/make-your-product-usable-by-ai-agents/ Updated: 2026-11-01 Give agents the same front doors people have, but built for software: an API, a CLI that prints JSON, and an MCP server. Then add the guardrails that make agent use safe: scoped credentials, safe retries, a note on every change, and a plain-text description of the product an AI can read. Here is the checklist North Bay Ventures applies to every company it builds. ## 1. Can an agent do everything a person can, without the website? Every action in the dashboard should also exist in an API. If even one step only works by clicking, an agent gets stuck there and hands the job back to a person. All three North Bay Ventures products follow this rule. Sandboxer has a REST API described by an OpenAPI file, plus TypeScript and Python SDKs. Transformer has a REST API, and nothing in it is dashboard-only. Flagger.gg has an API alongside its console. Read what makes a company AI-native for why this matters. ## 2. Does the CLI print JSON? Coding agents live in a terminal, so a CLI is often the easiest way in. Make its output machine-readable: JSON, with errors that say what went wrong. - Sandboxer's sbx CLI prints JSON when it's piped, so tools like jq can read every result. Sandboxer has a guide on scripting sbx with JSON output. - Flagger.gg's flagger CLI supports --json on every command. - Transformer has a CLI for brands and creators, installed with one command. ## 3. Is there an MCP server? An MCP server lets AI apps such as Claude, ChatGPT, Claude Code, Codex and Cursor find and call your product's actions as tools. A hosted server is a URL with nothing to install; a local one runs on the user's machine. Sandboxer, Transformer and Flagger.gg each run a hosted MCP server, and Sandboxer and Flagger.gg also offer a local one. Read what MCP is for how it works. ## 4. Are agent credentials narrow and revocable? An agent should get only the access its job needs, and a person should be able to cut it off at once. - Sandboxer: scoped API keys limit which tools work, and each connected MCP app is listed so you can disconnect it. - Transformer: one key or connection acts for exactly one brand or creator workspace, and sign-in access can be revoked in settings. - Flagger.gg: agent tokens cover one project, a list of environments and specific actions. They last 90 days at most, are stored as hashes and can be revoked. ## 5. Can an agent retry safely? Agents retry when a network call times out, so a retry must never do the work twice. The usual answer is an idempotency key: the agent sends the same key with each retry, and the service returns the original result instead of repeating the action. Sandboxer does this when creating and forking sandboxes: for 24 hours, the same key and request return the same sandbox instead of a second one you'd pay for. See its guide on retrying API calls with idempotency keys. ## 6. Does every change leave a trail? When agents change things, people need to see who did what and why. Record every change with who made it, when, the before and after, and a note. Flagger.gg requires agents to give a note on every write and keeps an audit log of every change, whether a person, an agent token or an import made it. Agents there have no approve tool, so the decisions a team reserves for people stay with people. See how the studio uses agents for the same idea applied to running a company. ## 7. Can an AI read what your product does? Publish an llms.txt file: a short, plain-text description of the product with links to the details, written for AI assistants and agents. Sandboxer, Transformer, Flagger.gg and northbayventures.com all publish one. Read what llms.txt is. ## Frequently asked questions ### What is the minimum to make a product usable by AI agents? An API that covers every action in the dashboard, with credentials an agent can use and a person can revoke. A CLI with JSON output and an MCP server make it much easier for agents to adopt. ### Do I need an MCP server if I already have an API? Not strictly, but it helps. An MCP server describes your actions as tools that AI apps can find and call on their own, so people can connect your product without writing integration code. ### How do you keep agents from doing too much? Give them narrow, revocable credentials, require a note on every change, keep an audit log, and reserve the decisions that are hard to undo for people. ### What is an idempotency key? A value an agent sends with a request so that repeating the same request returns the first result instead of doing the work again. It makes retries safe. --- # Privacy policy URL: https://www.northbayventures.com/privacy/ Updated: 2026-10-30 This policy explains what information northbayventures.com collects, why, and the choices you have. Effective October 30, 2026. ## Who we are northbayventures.com is operated by North Bay Opco I, Inc. (a Delaware corporation), 777 Brickell Ave, Suite 500 PMB 1074, Miami, FL 33131 ("North Bay Ventures", "we", "us"). We are responsible for the information described in this policy. You can reach us at support@northbayventures.com. This policy covers this website only. Sandboxer, Transformer and Flagger.gg have their own privacy policies on their own sites. ## What we collect - Usage data through Google Analytics. When you visit, Google Analytics records the pages you view, the page you came from, approximate location (country and city, derived from your IP address), device and browser type, screen size, language and how you interact with pages. Google Analytics 4 does not log or store IP addresses. - Request data. Our hosting and our network provider, Cloudflare, process technical data such as your IP address and the pages you request, to deliver the site and protect it from abuse. - Messages you send us. If you email us, we receive your email address and whatever you write. We don't ask you to create an account on this site, and we don't collect payment information here. ## Cookies and Google Analytics Google Analytics uses first-party cookies, such as _ga and _ga_WRBEX2DWDK, to tell visits apart and to count returning visitors. We use the results to understand which pages are useful and to improve the site. Google processes this data on our behalf and under its own terms. You can read how Google uses information from sites that use its services. Opting out. You can stop Google Analytics from collecting data about your visits by installing the Google Analytics opt-out browser add-on, or by blocking or deleting cookies in your browser settings. The site works the same without them. Visitors in the EU, the EEA, the UK and Switzerland. If you visit from one of these places, we ask first: a small banner lets you accept or decline analytics cookies, and Google Analytics doesn't load at all until you accept. Elsewhere, analytics runs by default. Wherever you are, you can change your choice at any time with the Cookie settings link at the bottom of every page, and advertising features are turned off. ## How we share information We don't sell your personal information. We share it only with service providers who run the site for us, namely Google (analytics), Cloudflare (network and security) and our hosting provider, and when the law requires it or to protect our rights and the safety of others. ## How long we keep it Google Analytics keeps event data for the retention period set in our account, which is no longer than 14 months. Emails you send us are kept as long as needed to answer you and keep a record of the conversation. ## Your choices and rights You can ask to see, correct or delete personal information we hold about you by emailing support@northbayventures.com. Depending on where you live, you may have further rights under local law, including the right to object to processing and to complain to a data protection authority. We won't treat you differently for using these rights. ## Children This site is for a business audience and isn't directed at children under 16. We don't knowingly collect their personal information. ## International visitors We are based in the United States. If you visit from elsewhere, your information is processed in the United States and wherever our service providers operate. ## Governing law and changes This policy is governed by the laws of the State of Florida. If we change it, we'll update the effective date at the top of this page. ## Contact Questions or requests about privacy: support@northbayventures.com, or by mail to North Bay Opco I, Inc., 777 Brickell Ave, Suite 500 PMB 1074, Miami, FL 33131. --- # Running many coding agents in parallel URL: https://www.northbayventures.com/running-agents-in-parallel/ Updated: 2026-10-29 Running several coding agents at once works when each one has its own branch, its own area and a clear brief. Changes are reviewed by an agent that didn't write them and checked in production, and people keep the decisions that are hard to undo. ## How do you keep parallel agents from colliding? Give every task its own branch and pull request, and give every agent its own area. At North Bay Ventures each long-running agent owns one thing, such as the website or infrastructure and mail, and asks the owner when it needs something outside it. Two agents editing the same files or the same server at once is the most common way parallel work goes wrong. Small, separate pull requests also make each change easy to review and easy to roll back. ## Git worktrees or one machine per agent? Use git worktrees when parallel agents only edit and test code. Each worktree has its own files, but all of them share one machine's ports, hooks, home directory, credentials and services. Once agents run dev servers, databases or Docker, give each its own machine so they can all bind the same port without clashing. Sandboxer's guide git worktrees or one VM per agent walks through the trade-off, and agent swarms covers running many at once on Sandboxer. ## How should you brief an agent? Brief it like a capable colleague who has none of your context. A good brief says: - the goal and why it matters; - what has already been tried or ruled out; - which files, docs and sources to read, and which facts are allowed; - what is out of scope; - what to report back, and what would block it. A vague brief produces confident work on the wrong problem. If you can't write a clear brief, the task isn't ready to hand off. ## How do review passes work? Review comes from an agent that didn't write the change. Give the reviewer the code and the goal, not the author's conclusion, so it reads the change fresh instead of agreeing with it. Small findings are fixed by the author straight away. Anything the reviewer and author disagree on goes to a person. Then check the change where it runs. A deploy isn't done until production shows it: every page returns 200, the new text is on the live page, the old text is gone. Reports carry that proof, so nobody has to take "done" on trust. ## What breaks when agents share infrastructure? Shared configuration is where parallel work quietly collides. In one real case on our shared web server, a deploy script added a new site's certificate settings to the first entry in a shared list. That entry belonged to another site, which used a self-signed certificate, so the new site got one too and wouldn't load. Another agent found it in the server logs. The fix was a rule worth copying: address shared things by a name or ID you own, never by position, and check whether something already exists before adding it. The same rule applies to DNS records, server routes and anything else several agents touch. ## Which decisions stay with people? The ones that are hard to reverse or visible to customers: spending money, legal terms, DNS, deletions, public launches and bulk email. Agents do everything up to that point, such as preparing a ready pull request or a staged deploy, and then wait for a person's explicit yes. Sandboxer has a guide on requiring human approval before an agent runs a command. Shipping risky features switched off behind a feature flag moves more decisions into the reversible column: the deploy is routine, and turning the feature on is the deliberate step. ## Frequently asked questions ### How many coding agents can run in parallel? As many as you have separate tasks for and can review. The limit is usually review and coordination, not compute. Each agent needs its own branch and area. ### Should agents review their own work? No. A second agent that didn't write the change, given the code rather than the author's conclusion, catches more. ### Do parallel agents need separate machines? Not for editing and testing code; git worktrees are enough. Once they run servers, databases or Docker, separate machines avoid port and service clashes. ### What should agents never do on their own? Anything hard to reverse or visible to customers, such as spending money, changing DNS, deleting data or launching publicly. --- # How Sandboxer, Flagger.gg and Transformer work together URL: https://www.northbayventures.com/sandboxer-flagger-transformer-together/ Updated: 2026-11-03 The three companies cover the three things an AI agent needs to get a product to people: a computer to build on (Sandboxer), a safe way to ship what it built (Flagger.gg), and a way to reach an audience (Transformer). Each works on its own, and each can be driven by an agent over MCP, a CLI or an API. ## Step 1: How does the agent build? In a Sandboxer sandbox. Each sandbox is a full Ubuntu virtual machine with root, Docker and SSH, and coding agents such as Claude Code and Codex are already installed. An agent can create one through Sandboxer's MCP server at https://sandboxer.com/mcp, the sbx CLI, the SDKs or the API. When the agent has something to show, it can give any port an HTTPS URL, private by default with a token, so a person can open the preview. Stopping the sandbox saves its memory as well as its disk, so the work is still running after a resume, and a stopped sandbox costs nothing. See HTTPS URLs for sandbox ports and pause and resume. ## Step 2: How does the agent ship safely? Behind a Flagger.gg feature flag. The agent uses Flagger.gg's MCP tools or the flagger CLI to create a flag for its change, roll it out and, if something goes wrong, kill it. If the work isn't finished yet, the agent marks the flag not ready, so it stays off. Apps check flags with the Go and Node SDKs, and a flag that is unknown or can't be loaded counts as off. Agents act with scoped tokens, every write needs a note, and every change lands in an audit log. In auto-live mode (the default today) an agent's new flag goes live straight away unless it's marked not ready. Turning approvals on adds a per-environment cap (10% by default in production) above which a human approves in the console. Agents have no approve tool. Read feature flags instead of staging for why the studio ships this way. ## Step 3: How does the agent launch? With creator posts on Transformer. Through Transformer's MCP server at https://transformer.gg/mcp, its CLI or its API, a brand's agent can find creators on X, send them paid offers with the price and ask prefilled from the brand's website, and track what each post drives. Creators write their own posts with X's Paid partnership label on and keep 80% of the payout. Sending offers is free: the brand pays when a creator accepts, and the payment is held and released only when the post is verified live on X with the tracked link. Each accepted offer gets a tracked link, and the brand reports sales back, so clicks and sales are attributed to the creator who drove them. See running a campaign from an AI agent. ## Where do people stay in control? In the limits they set and the steps that are hard to undo. A person chooses how much Flagger.gg lets agents do on their own (auto-live, or approvals with a rollout cap), pays for the Transformer offers creators accept, and chooses what an agent's tokens and keys are allowed to do in all three. The agent does the routine work in between: building, testing, rolling out to a few users, drafting offers and reporting results. Read how the studio uses agents and running many agents in parallel. ## Do you have to use all three? No. They are separate products with their own websites, accounts and support, and each is useful alone. They fit together because they were built by the same studio around the same idea: products that agents can use directly, with a person in control of the decisions that matter. See our companies. ## Frequently asked questions ### Can one AI agent use Sandboxer, Flagger.gg and Transformer together? Yes. Each has an MCP server, a CLI and an API, so the same agent can build in a sandbox, ship behind a flag and send creator offers, within limits a person sets. ### Are Sandboxer, Flagger.gg and Transformer one product? No. They are three separate products from North Bay Ventures, each with its own site and account. ### Do I need Sandboxer to use Flagger.gg? No. Flagger.gg works with any app that can use its Go or Node SDK, wherever the app runs. ### Who makes these products? North Bay Ventures, a venture studio in Miami, operated by North Bay Opco I, Inc. --- # How do you stop an AI agent from overspending? URL: https://www.northbayventures.com/stop-ai-agents-overspending/ Updated: 2026-11-03 Don't rely on the agent's judgment. Put the limits in the product it uses: a prepaid balance that stops at zero, a cap per person or agent, a deadline on every machine it starts, and payment that happens only after the other side agrees. Then an agent that loops or misreads a task runs into a wall instead of a bill. ## Why can't you just tell the agent a budget? An instruction like "spend no more than $50" is a request, not a control. Agents retry, loop and misread tasks, and a long run can forget a number it was given at the start. The limit has to be enforced by the service that charges the money, where the agent can't talk its way past it. Instructions still help; write them down as in how to write instructions for AI coding agents. But treat them as the second line, not the first. ## What does a hard spending stop look like? A prepaid balance that the service refuses to go past. On Sandboxer, machine time comes from a plan's included time and then from $20 time packs. When the balance reaches zero and auto-refill is off, new creates, resumes and forks fail with 402 billing_required. Running sandboxes get a 24-hour grace period and an email to the owner, then they are stopped with memory and disk kept, so nothing is lost. Auto-refill is opt-in, and the dashboard's Alerts page sets your own low-balance thresholds. The details are in Sandboxer's billing docs. ## How do you cap one agent without stopping the others? Give each agent, or each person running agents, its own identity and cap it. In a Sandboxer organization, an owner can cap a member's concurrent sandboxes and a member's machine time per billing period through the API. Once a member reaches the cap, their new sandboxes, resumes and forks are refused with 402 team_member_cap_reached, while their running sandboxes keep running and everyone else carries on. Separate keys per agent also make it clear in the logs which one did the spending; see how to make a product AI agents can use. ## Why give every machine a deadline? The classic runaway cost is a machine an agent started and forgot. Sandboxer stops every sandbox one hour after it starts unless you change that, and a sandbox nobody is using pauses itself after an idle period set by the plan. You can extend a deadline up to 30 days or turn it off, but the default is that forgotten work stops on its own. Pass a short --ttl for one-off tasks, as in running agent evaluations. ## How do you avoid paying for work that never happens? Pay late, and pay into a hold. On Transformer, sending offers to creators costs nothing. The brand pays only when a creator accepts, within 72 hours, from its balance first and then by card or bank; an accepted offer left unpaid is cancelled. The payment is then held and released only when the post is verified on X, and money from declined or expired offers goes back to the brand's balance. An agent can send a hundred offers without committing a dollar until people say yes. See pay on verified posts. ## Does the same idea apply beyond money? Yes. The pattern is a limit enforced by the service, with a person deciding when to go past it. Flagger.gg applies it to releases: with approvals on, an agent can roll a flag out in production only up to a per-environment cap, and anything wider becomes a request a person approves, since agents have no approve tool. At North Bay Ventures, spending money and changing plans always wait for Jon's yes; read how the studio uses agents. ## Frequently asked questions ### What is the simplest way to limit an AI agent's spending? Use a prepaid balance with auto-refill off, so the service refuses new work at zero, and give the agent its own key so you can see and cap what it uses. ### Do Sandboxer sandboxes keep running when the balance runs out? For 24 hours. New starts are refused at once, the owner is emailed, and after the grace period running sandboxes are stopped with memory and disk kept. ### Can an agent on Transformer spend money just by sending offers? No. Sending offers is free. The brand pays only for offers a creator accepts, and the payment is held until the post is verified. ### Should an agent ever be allowed to raise its own limits? No. Raising a limit, buying more credit or turning on auto-refill should be a person's decision. --- # Venture studio vs incubator vs accelerator URL: https://www.northbayventures.com/venture-studio-vs-incubator-vs-accelerator/ Updated: 2026-10-31 The difference is who starts the company and who builds it. An incubator or an accelerator supports founders who arrive with their own idea, while a venture studio comes up with the idea itself and builds the company with its own team. North Bay Ventures is a venture studio. ## What is an incubator? An incubator helps very early founders turn an idea into a company. It usually offers some mix of workspace, advice, introductions and shared services, for as long as the founders need it rather than on a fixed schedule. Incubators are often run by universities, cities, corporations or nonprofits, and some take a small stake in return while others take none. The founders own the idea, make the decisions and do the building. The incubator supports them. ## What is an accelerator? An accelerator runs a fixed-length program for a group, or cohort, of startups that already exist. Founders apply, and the accepted teams typically receive a small investment in exchange for equity, along with mentoring and a network. Programs usually last a few months and end with a demo day where the companies pitch to investors. As with an incubator, the founders bring the company and run it. The accelerator speeds up what they were already doing. ## What is a venture studio? A venture studio creates companies itself. Instead of choosing among founders who arrive with ideas, the studio decides what to build, builds the product, and runs the business through its earliest stage, from the first line of code to the first paying customers. Studios are sometimes also called venture builders or startup studios. Because the same team starts company after company, a studio can share foundations between them: legal templates, payments, email, hosting and release practices. Each new company starts with those already in place. Read how we build companies for what that looks like at North Bay Ventures. ## How do they compare? | | Incubator | Accelerator | Venture studio | Who has the idea | The founders | The founders | The studio | Who builds the company | The founders | The founders | The studio's own team | Format | Open-ended support | Fixed-length cohort program | Ongoing; one company after another | Typical stage | Idea | Early company | Before there is a company | What it shares | Space, advice, services | Investment, mentoring, network | People, code and infrastructure A venture studio is also different from a venture capital fund: a fund invests money in companies that other people run, while a studio builds and runs its own. See about North Bay Ventures. ## Why did North Bay Ventures choose the studio model? Because AI agents have made building much faster, and a studio is the model that gets the most from that. North Bay Ventures runs as a small team of builders working alongside AI agents, and the same people and agents carry each company from an idea to a live product. Today the studio builds Sandboxer, Transformer and Flagger.gg, all for a world where agents do real work. Read how the studio uses agents day to day. ## Frequently asked questions ### Is a venture studio the same as an accelerator? No. An accelerator runs a program for founders who already have a company. A venture studio starts companies itself and builds them with its own team. ### What is another name for a venture studio? Venture builder and startup studio are common names for the same model. ### Does North Bay Ventures run an accelerator or invest in outside startups? No. North Bay Ventures is a venture studio: it starts and builds its own companies rather than investing in companies run by outside founders. ### Where is North Bay Ventures based? Miami, Florida. It is operated by North Bay Opco I, Inc., a Delaware corporation. --- # What is llms.txt? URL: https://www.northbayventures.com/what-is-llms-txt/ Updated: 2026-11-03 llms.txt is a plain-text file at the root of a website, such as /llms.txt, that tells AI assistants and agents what the site is about and where to find the important details. It is written in Markdown, short enough to read in one pass, and meant to be the first thing an AI looks at. Every North Bay Ventures site publishes one. ## Why do sites publish an llms.txt? Web pages are built for people: navigation, scripts, layout and repeated menus. An AI assistant answering a question, or an agent deciding how to use a product, wants the facts and the right links without the clutter. An llms.txt gives it a clean summary and a map of where to read more. It is a proposed convention rather than a formal standard, documented at llmstxt.org. Publishing one doesn't guarantee that any particular AI uses it, but it costs little and gives assistants an accurate source to quote. ## What goes in an llms.txt? The usual shape is: - a heading with the name of the site or product; - a one-paragraph summary, often as a blockquote; - the key facts a reader is most likely to need, such as what it does, who it's for and how it's priced; - sections of links, each with a one-line description, pointing to the pages that hold the details. Many sites also publish /llms-full.txt, with the full text of their pages in one file, for tools that want everything at once. ## How do North Bay Ventures sites use it? - Sandboxer publishes an llms.txt with its key facts (machine sizes and prices, plans, regions and interfaces), when it fits and when something else fits better, and links to its docs and guides. Its llms-full.txt has the full documentation in one file. - Transformer lists its key facts (how offers, payment and payouts work, the 80/20 split, agent access) and links to its docs and blog. - Flagger.gg describes what's live today and what's still in development, and links to its guides and comparisons. - northbayventures.com generates llms.txt and llms-full.txt from the same content as its pages every time the site is built, so they can't drift apart. ## How does the studio keep facts accurate? The product sites' llms.txt files are also the source of truth for this site. Every fact northbayventures.com states about Sandboxer, Transformer or Flagger.gg comes from those files, and a daily check compares this site against them and fixes anything that has drifted. Read how the studio uses agents for how that check runs. ## How do you write a good one? - Answer first. Put what the product is and its most important facts at the top. - Be exact. State prices, limits and rules exactly as your own pages do, and update the file when they change. - Say what's not there yet. Label features that are still in development, so assistants don't promise them. - Link, don't paste. Keep the main file short and link to the pages with the detail; put the long version in llms-full.txt. - Generate it. Build it from the same source as your pages so it never goes stale. ## Frequently asked questions ### Where does llms.txt go? At the root of the site, for example https://www.northbayventures.com/llms.txt, served as plain text. ### Is llms.txt the same as robots.txt? No. robots.txt tells crawlers what they may fetch. llms.txt tells AI assistants what the site is about and where the important details are. ### What is llms-full.txt? An optional companion file with the full text of the site's pages in one place, for tools that want everything at once. ### Do AI assistants have to use llms.txt? No. It's a proposed convention, not a requirement, so support varies. It is still a cheap way to give AI tools an accurate summary. --- # What is MCP (Model Context Protocol)? URL: https://www.northbayventures.com/what-is-mcp/ Updated: 2026-11-02 MCP, the Model Context Protocol, is an open standard that lets an AI assistant or agent use tools that live outside it, such as a cloud computer or a marketplace. A service publishes an MCP server once, and any app that speaks MCP can then call its tools without custom integration work. ## What problem does MCP solve? MCP gives AI apps one common way to reach outside services. Before a shared protocol, every pairing of an AI app and a service needed its own glue code. With MCP, a service describes its actions once as a list of tools, and any client that understands the protocol can find and call them. For the person using the assistant, this means you can connect a service in a few clicks and then ask for things in plain language. For the company offering the service, it means one integration works across many AI apps. The specification is published at modelcontextprotocol.io. ## How does MCP work? There are two sides. The client is the AI app, for example Claude, ChatGPT, Claude Code, Codex or Cursor. The server belongs to the service and lists the tools it offers. Each tool has a name, a short description and the inputs it takes, so the model can decide when to use it. - You add the server's address to your AI app. - The app asks the server which tools it has. - When a request needs one, the model calls the tool and reads the result. - The model keeps going, calling more tools or answering you. A server can run in two ways. A hosted server is a URL that clients reach over the Streamable HTTP transport, with nothing to install. A local server runs on your own machine and talks to the client over standard input and output (stdio). ## How does an AI app sign in to an MCP server? Most hosted servers support two methods, and the companies we build show both: - Sign-in with OAuth. Apps that can open a browser send you to the service's sign-in page, and you approve access. Transformer's server uses OAuth 2.1 with sign-in on X, and access can be revoked in its settings. Sandboxer's server uses OAuth 2.1 too, and lists each connected app so you can disconnect it at once. - An API key. Headless agents that run without a browser send a key as a bearer token on every request. Good practice is to keep the key in an environment variable rather than in a config file you commit. The key or sign-in decides what the agent may do. On Sandboxer, a scoped key limits which tools work. On Transformer, one key or connection acts for exactly one brand or creator workspace. On Flagger.gg, an agent token covers one project, a list of environments and specific actions, and lasts 90 days at most. ## What can an agent do with MCP in practice? It depends entirely on the tools a server offers. Three examples from our companies: - Sandboxer runs a hosted server at https://sandboxer.com/mcp and a local one with sbx mcp. Its tools let an agent create Linux sandboxes, run commands, read and write files, put a port on an HTTPS URL, save snapshots and stop or delete sandboxes. - Transformer runs a hosted server at https://transformer.gg/mcp. Brand-side tools get suggested creators for the brand, write a short ask for each, send offers and report sales. Creator-side tools accept offers, submit posts for verification and request payouts. - Flagger.gg runs a hosted server at mcp.flagger.gg and a local one with flagger mcp. Its eleven tools let an agent list, create, roll out, target, kill and revert feature flags. Every write needs a note, and there is no approve tool. In each case the agent does the same work a person would do in the web dashboard, so nothing is locked behind a screen only humans can use. ## Is MCP safe to use? MCP is a way to connect; how safe it is depends on what you connect and what access you grant. A few habits help: - Grant the narrowest access that does the job, such as a scoped key or a single workspace. - Keep keys out of chats and out of files in version control. - Check the list of connected apps from time to time and remove ones you no longer use. - Prefer tools whose actions have clear limits. Sandboxer sandboxes stop on their own an hour after they start unless you change that, Transformer only releases a payment once a post is verified, and Flagger.gg shows an agent only the tools its token allows. ## How do you write good MCP tools? Treat each tool's name and description as documentation, because that's what the model reads to decide whether to call it. Name tools after the action, such as create_offer or flag_kill, say in one line what each does and what it returns, and keep inputs few and explicit. Offer only the tools the connection is allowed to use, and make writes leave a trail. Read how to write documentation AI agents can use and see how one agent uses all three servers in how Sandboxer, Flagger.gg and Transformer work together. ## Why does MCP matter for companies? More work is starting inside AI assistants, so a product that agents can use directly is easier to adopt. That is one reason every company we build ships an MCP server alongside its API and CLI. We cover the wider idea in what makes a company AI-native, and the practical checklist in how to make a product AI agents can use. ## Frequently asked questions ### What does MCP stand for? Model Context Protocol. It is an open standard for connecting AI apps to outside tools and data. ### Is MCP only for Claude? No. Any client that implements the protocol can use an MCP server. Sandboxer documents setup for Claude, ChatGPT, Claude Code, Codex and Cursor. ### What is the difference between an MCP server and an API? An API is built for programs written by developers. An MCP server wraps actions as described tools that a model can find and call on its own. Many services offer both. ### Do I need to install anything to use a hosted MCP server? No. You add its URL to your AI app and sign in, or send an API key from a headless agent. ### Can an MCP server limit what an agent is allowed to do? Yes. The server decides which tools to offer and checks every call against the key or sign-in. Flagger.gg, for example, lists only the tools a token allows and has no approve tool. --- # Agent evaluations and benchmarks URL: https://www.northbayventures.com/sandboxer/agent-evaluations/ Updated: 2026-11-03 To run agent evaluations on Sandboxer, build each task environment once, save it as a named snapshot, and start one fresh microVM per task in parallel. Each task runs its tests in isolation, you copy its diff and results out, and you delete the VM, paying only for the seconds it ran. ## Why run each eval task in its own VM? A separate VM per task means nothing one task writes can affect the next, which keeps results clean. Each sandbox is a full Ubuntu microVM with its own kernel and its own Docker daemon, so harnesses that need Docker run unchanged, and nothing a candidate patch does reaches your machine or other tasks. Sandboxer's guide on whether its sandboxes fit eval and research teams maps the common jobs to features: | Job | How on Sandboxer | A reproducible task image | Install once, save under a versioned name, start every run from it | A fresh environment per task | One VM per task from the snapshot, deleted after | Fan-out under caps | A client-side limit sized to your plan, paced under the start limit | Capturing artifacts | Write diff, test report and an environment fingerprint, copy out, then delete | Cost per task | Seconds the VM is up times the size's rate ## How does a typical eval run work? A typical run has three steps: build an image once, freeze it as a named snapshot, then fan out. A trimmed version of the guide's flow: # 1. build and freeze the task image sbx snapshot eval-task-v1 sbx delete --yes # 2. one sandbox per task, from the snapshot id=$(sbx --json new --from eval-task-v1 --type small --ttl 900 | jq -r 'select(.event=="ready") | .id') sbx exec "$id" "./run_task.sh median" # 3. copy results out, then delete sbx scp "$id":out/median.tgz . sbx delete "$id" --yes Put a version in the snapshot name, such as task-v1. Reusing a name replaces the snapshot, and a cited result should point to an environment that still exists. ## Can you run SWE-bench on Sandboxer? Yes. Sandboxer's SWE-bench guide runs the official SWE-bench harness inside a sandbox. Because each sandbox has its own Docker daemon, the harness pulls the per-task image, applies the candidate patch, runs the tests and grades FAIL_TO_PASS and PASS_TO_PASS as designed. The guide uses a large sandbox (8 vCPU, 16 GB, 125 GB disk), because task images are a few gigabytes each and the harness runs several containers. To scale out, save one prepared sandbox as a snapshot and start one VM per task. The guide is clear that its timings are single runs, not a benchmark. ## How do you run best-of-N or RL episodes? Use forks to branch from one state. For best-of-N attempts, prepare the repo once, fork it once per attempt, run the tests in each fork, save each diff and score, and keep the best. For RL and eval environments, each episode runs your policy and grader in a fresh sandbox, writes a reward file you read back, and is deleted. | | sbx new --from | sbx fork | Use it for | A fixed environment the whole benchmark shares | Branching from a state an agent just reached | Needs the source | No | Yes | Memory copied | No; boots fresh | No; boots fresh A fork copies the disk, not the memory: it boots fresh, as Sandboxer's guide on forking a running sandbox explains. ## How fast can you fan out? Your plan limits how many sandboxes run at once and how many you can start per minute, hour and day. On the $500 plan, for example, 1,000 can run at once with 65 starts a minute. Check what is left before a burst: sbx limits --json | jq '.starts' Over a limit, the API returns 429 with a Retry-After header. Sandboxer's guide on rate limits and concurrency caps suggests sizing a client-side semaphore from GET /limits. Full plan figures are on pricing. ## How do you keep an eval sweep from running up a bill? Give every task sandbox a short deadline, such as --ttl 900 for 15 minutes, so a hung task stops on its own, and delete each sandbox once its results are copied out. Check sbx limits before a big sweep: when the balance reaches zero with auto-refill off, new creates, resumes and forks are refused with 402 billing_required, and running sandboxes are stopped after a 24-hour grace period with memory and disk kept. In an organization, an owner can also cap each member's machine time. See how to stop an AI agent from overspending and Sandboxer's billing docs. ## What should you record for reproducible results? - The snapshot name and version the task ran on - CPU model, kernel and dependency hashes, since CPU types can differ between machines - Whether a sandbox was cold-booted, using memoryRestored and resumeReason; the guide advises not stopping a VM mid-task There are no GPUs on Sandboxer, so evaluations that need local GPU inference belong elsewhere. Billing is per second, CPU only. ## Frequently asked questions ### Does a fork copy the running state of an eval? No. A fork copies the disk only and boots fresh. Use stop and resume on the same sandbox to keep memory. ### What does an eval task cost? The seconds its sandbox runs times the size's rate; small is $0.018 per hour. ### Can a candidate patch damage other tasks? No. Each task runs in its own microVM, and traffic between sandboxes is blocked. ### What happens to an eval sweep if the balance runs out? New sandboxes are refused at once. Running ones keep going for a 24-hour grace period, then stop with memory and disk kept, and resume when you add time. --- # Agent swarms: running many agents in parallel URL: https://www.northbayventures.com/sandboxer/agent-swarms/ Updated: 2026-11-03 To run a swarm of agents on Sandboxer, you give each agent its own sandbox, start them all from one prepared template, and send each one a task over the CLI, API or SDK. Because every agent has its own VM, disk, Docker daemon and ports, they never collide, and you keep only the results that worked. ## Why give each agent its own VM? Separate machines remove the conflicts that appear when agents share one computer. Sandboxer's parallel agents guide compares the common setups: | Setup | What goes wrong | Several agents in one checkout | They edit the same files and break each other's builds | Git worktrees on one machine | Files are separate, but ports, Docker, databases and CPU are shared, and the machine must stay awake | One VM per agent | Nothing is shared, and work continues while your laptop sleeps Worktrees are still a fine choice when agents only edit and test code. Once they run dev servers, databases or Docker, separate VMs let every agent bind the same port and get its own URL. The site covers this trade-off in git worktrees or one VM per agent. ## How do you start a swarm from one template? Set up one sandbox the way every agent needs it, save it as a named snapshot, then create one sandbox per task from that snapshot. Each new sandbox starts with the repo and dependencies already in place. # once: prepare the repo, then save it as a template sbx snapshot my-repo-ready sbx stop # then: one sandbox per task for task in fix-auth add-export flaky-e2e; do id=$(sbx new --from my-repo-ready --json | jq -r 'select(.event=="ready") | .id') sbx prompt "$id" --provider claude-code "Work on: $task. Commit on a branch named $task." done You can mix agents in one swarm. The --provider flag accepts Claude Code, Codex, OpenCode, Pi, Kimi and Mistral Vibe, using your own provider keys. To watch or redirect an agent, use sbx events --follow and sbx steer. ## Should you fork or start from a snapshot? Use a named snapshot for many copies of a fixed starting point, and a fork to copy a sandbox you are working in right now. Both copy the disk with a copy-on-write reflink, so neither waits on a full disk copy. Neither copies memory: each copy boots fresh. A common fork pattern is best-of-N. You prepare a repo once, fork it once per attempt, run the tests in each fork, and keep the diff with the most passing tests. See forking sandboxes for details. ## How many agents can run at once? Your plan sets how many sandboxes can be active together and how fast you can start them. Stopped sandboxes do not count. These figures come from Sandboxer's pricing page: | Plan | Run at once | Starts per minute / hour / day | $20 / month | 100 | 12 / 60 / 200 | $100 / month | 300 | 30 / 210 / 840 | $500 / month | 1,000 | 65 / 420 / 1,680 | $2,000 / month | 2,000 | 90 / 600 / 2,400 Creates, resumes and forks each count as a start. Going over returns a 429 error with a Retry-After header, so a well-behaved orchestrator paces its starts and queues extra tasks. ## Can several agents share one sandbox? Yes. One sandbox can run several agent conversations at the same time, each with its own process and history. This suits related tasks that share one environment, such as a refactor and its tests. sbx prompt --new "Start the billing refactor" sbx prompt --new "Investigate the flaky e2e test" sbx conversations The number of parallel conversations per sandbox grows with its memory. Beyond that limit, prompts wait in a queue. ## What does a swarm cost? You pay per second for each sandbox while it runs, at its size's hourly rate. A default sandbox (4 vCPU, 8 GB) is $0.036 an hour and small is $0.018. Sandboxer's guide works out that three agents on default for two hours cost about $0.22, plus your model provider's charges on your own key. Stopped sandboxes cost nothing, so stop or delete agents as they finish. More in pricing. ## Frequently asked questions ### Does Sandboxer use the word swarm? Not as a product term. The site describes this as running coding agents in parallel, one VM each. ### Do parallel agents share files? No. Each sandbox has its own disk. Agents only share what they push somewhere else, such as git branches. ### Can different agents use different models? Yes. Choose the harness per prompt with --provider and the model with --model. ### What happens to agents I don't need any more? Stop them to keep their state for free, or delete them for good. --- # CI and testing URL: https://www.northbayventures.com/sandboxer/ci-and-testing/ Updated: 2026-10-28 Sandboxer gives each CI job or test run a fresh Ubuntu microVM with root, Docker and /dev/kvm, created by the sbx CLI and deleted when the job ends. You can call it from an existing GitHub Actions workflow, split a slow suite across several sandboxes, or host a live preview for every pull request. ## Why run tests in a sandbox? A sandbox gives tests a clean, full machine that can do things hosted runners often cannot, and it disappears afterwards. Each one has Docker with Compose, root access, systemd and nested KVM, plus Chrome, Node, Python, Go and Rust preinstalled. Pull-request code runs in a VM with none of your secrets if you create it with --no-env. Sandboxer's guide for QA and test automation teams adds a few habits: copy JUnit files, screenshots and traces out before deleting; rerun suspect tests in a clean VM to measure flakiness; and keep a failing VM by stopping it instead of deleting it, so you can inspect it later for free. ## How do you use Sandboxer from GitHub Actions? Sandboxer's GitHub Actions guide describes two patterns: | | A: hosted runner drives sbx | B: ephemeral runner in a sandbox | Where steps run | On GitHub's runner; only commands passed to sbx exec run in the microVM | Every step runs in the microVM | Secrets to add | SANDBOXER_API_KEY | That key plus a GitHub token with repo admin access | Good for | Tests that need Docker, KVM, root or a bigger machine | Whole workflows you want off GitHub's machines Start with a key that uses the ci preset, which can create sandboxes and delete only the ones it created: sbx api-key create github-actions --preset ci --ttl 90d ## What does the hosted-runner pattern look like? The job installs sbx, creates a sandbox, copies the checkout in, runs the tests and deletes the sandbox even on failure. The core steps: id="$(sbx new --type default --ttl 1800 --no-env --json | jq -r 'select(.event=="ready") | .id')" tar -czf - . | sbx ssh "$id" -- "mkdir -p repo && tar -xzf - -C repo" sbx exec "$id" --cwd repo --timeout 600 "npm ci && npm test" sbx delete "$id" --yes Because sbx exec exits with the remote command's code, a failing test fails the step. The --ttl 1800 backstop stops the sandbox after 30 minutes if the job dies before cleanup. The guide also recommends setting the step shell to bash so a failed install download fails the step. ## How do you shard a slow test suite? Install the project once, save it as a named snapshot, start one sandbox per shard, and merge the reports. Sandboxer's sharding guide uses pytest-split: sbx snapshot tests-ready id=$(sbx new --from tests-ready --type small --json | jq -r 'select(.event=="ready") | .id') sbx exec "$id" "pytest --splits 2 --group 1 --junitxml=junit-1.xml" In that guide's run, two small shards cut the networkx 3.5 suite from 96.9 seconds to 59.3 seconds. Each start counts against your plan's per-minute start limit, so pace large fan-outs. ## Can every pull request get a preview URL? Yes. CI creates one small sandbox per pull request, labeled with the PR number, builds and serves the app, then runs sbx host to get an HTTPS URL to post on the PR. Idle previews pause and wake on the next visit. When the PR closes, CI finds the sandbox by label and deletes it. See preview environments. sbx host 3000 The URL takes the form https://-.box.sandboxer.com. It is private by default and needs its token, or you can add --public. ## What do CI runs cost? Per second of runtime at the size's hourly rate: $0.018 for small, $0.036 for default, $0.072 for large. A large sandbox running a 3-hour build and then stopped for a month uses 6 hours of default time, which Sandboxer's billing docs price at $0.22. See pricing. ## Frequently asked questions ### Do I need a self-hosted runner? No. The simpler pattern keeps GitHub's hosted runner and only sends test commands to the sandbox with sbx exec. ### Can tests use Docker inside the sandbox? Yes. Each sandbox has its own Docker daemon with Compose and BuildKit, with no privileged mode needed. ### How long can one exec wait? Up to 600 seconds. For longer suites, start the command with --detach and follow it with --attach. ### Does the CLI need an interactive login in CI? No. Set SANDBOXER_API_KEY in the job's environment and the CLI uses it. --- # Coding agents in the cloud URL: https://www.northbayventures.com/sandboxer/coding-agents/ Updated: 2026-10-28 Every Sandboxer sandbox comes with six coding agents installed, including Claude Code and Codex, so you can hand one a task in a full Ubuntu VM with a single command. The agent keeps working while your laptop sleeps, and stopping the sandbox saves its session in memory so it resumes where it left off. ## Which coding agents are installed? Six agent harnesses ship in every sandbox. Sandboxer's integrated agents docs list them by the provider name you pass: | provider | Harness | Steering | claude-code (alias claude) | Claude Code | Native | codex | OpenAI Codex CLI | Native | opencode | OpenCode | Interrupt and continue | pi | Pi | Native | kimi | Kimi Code CLI | Not specified | mistral | Mistral Vibe | Not specified The agents use your own provider keys, which you add on the dashboard's Agents page. Model usage is billed by that provider, separately from Sandboxer's machine time. ## How do you give an agent a task? Send a prompt with sbx prompt, the API or an SDK. Sandboxer starts the harness in the right directory with your keys, records its output as structured events, and keeps the session so the next prompt continues the thread. sbx prompt "Fix the failing tests and commit" sbx prompt --provider codex "Refactor the auth module" sbx events --follow The API call returns at once with a prompt id and a conversation id. You can poll for the result or stream events, including over server-sent events. The agent runs as user in /home/user. ## Can you steer an agent while it works? Yes. You can queue another task, add an instruction mid-turn, or stop the turn: | You want to | Use | The running turn | Queue another task | sbx prompt | Finishes first | Add an instruction mid-turn | sbx steer | Takes it into account and continues | Stop | sbx interrupt | Is discarded One sandbox can also run several conversations at once, each with its own harness process. Conversations survive stop, resume and fork. ## Why run a coding agent in a VM instead of on your laptop? A cloud VM keeps running unattended, can be thrown away, and gives the agent real tools. Sandboxer's guide on Claude Code sandbox mode, Docker or a cloud VM suggests a cloud VM for unattended runs, untrusted repos, work that needs Docker or KVM, and tasks that must continue while your laptop sleeps. For everyday work on your own machine, it notes Claude Code's built-in sandbox can be enough. Running an agent without permission prompts is a related case. Sandboxer's guide on skipping permissions says to do it only in a disposable machine with no access to your laptop or production credentials, as a non-root user, and to keep the output on a branch you review. ## How do you make every agent behave the same way? Harnesses read their normal config files from the home directory, such as CLAUDE.md, AGENTS.md, MCP server configs, skills and settings. Commit those to your repo, or bake them into a named snapshot, and every sandbox started from it behaves alike. sbx snapshot agent-ready sbx new --from agent-ready You can also bring your own agent: install it, run it as a systemd service or a detached command, and talk to it through a hosted port or files. To run many agents at once, see agent swarms. ## How do you get the agent's work back? Most teams have the agent push a branch and open a pull request. Sandboxer's guides show two ways: - Issue to pull request: a no-env sandbox with one short-lived GitHub token clones, branches, runs the agent and tests, and opens the PR with gh. - Background coding agent: workers pull the commit back as a git bundle and push it with the service's own credentials, so the sandbox never holds them. ## Frequently asked questions ### Is Claude Code preinstalled in Sandboxer? Yes. Claude Code, Codex, OpenCode, Pi, Kimi Code and Mistral Vibe are installed in every sandbox. ### Do I need my own model API keys? Yes. The integrated agents use your own provider keys, added on the dashboard's Agents page or passed with -e. ### Can I SSH in and run the agent by hand? Yes. sbx ssh opens a shell, and you can run claude or codex there like on any Linux machine. ### Can an agent use the desktop? Yes. Every harness gets computer tools that drive the sandbox's streamed desktop with screenshots, mouse and keyboard. --- # Root, Docker and nested virtualization URL: https://www.northbayventures.com/sandboxer/docker-and-nested-virtualization/ Updated: 2026-10-28 Every Sandboxer sandbox gives you root through passwordless sudo, a preinstalled Docker daemon with Compose and BuildKit, and /dev/kvm for nested virtualization. Because each sandbox is a full VM rather than a container, Docker, Kubernetes, QEMU and the Android emulator run inside it without privileged-mode workarounds. ## Do you get root in a Sandboxer sandbox? Yes. You work as an ordinary user named user, with home /home/user and passwordless sudo. That means you can install anything with apt, edit system files, open firewall ports and enable systemd services. Per the machines docs, services you enable come back after a resume or fork. sudo apt-get install -y postgresql sudo systemctl enable --now postgresql ## How does Docker work inside a sandbox? Docker is preinstalled with BuildKit, Compose and buildx, and each sandbox runs its own Docker daemon. You do not need to mount a host socket or run privileged containers, because the whole VM is yours. docker compose up -d sbx host 8080 Sandboxer's Docker Compose guide gives each published port its own HTTPS URL with sbx host. A stop and resume with memory keeps containers running; add restart: unless-stopped so they also return after a cold boot. One practical note from the security docs: outbound traffic shares the node's IP addresses with other sandboxes, so services that rate-limit by IP, such as Docker Hub pulls, see one shared limit. Run docker login to use your own account's limit. ## Can you run Kubernetes in a sandbox? Yes. kind and k3s both work. In Sandboxer's Kubernetes guide, kind create cluster reached a Ready node in about 28 seconds in one run on a default sandbox, and the k3s install script took about 13 seconds. You deploy with kubectl, expose the app with a port-forward or NodePort, then host the port for an HTTPS URL. kind create cluster kubectl get nodes ## What is nested virtualization and why does it matter? Nested virtualization means running a virtual machine inside your sandbox's VM with hardware acceleration. Sandboxer exposes /dev/kvm to every guest, so hypervisors work without slow software emulation. That opens up workloads containers usually cannot host: - QEMU/KVM virtual machines - Firecracker microVMs - The Android emulator, accelerated ls -l /dev/kvm sudo apt-get install -y qemu-system-x86 qemu-system-x86_64 -enable-kvm -m 2048 -nographic -cdrom alpine.iso Use large or xlarge for nested VMs, because the inner guest's RAM comes out of yours. ## Can you run the Android emulator in the cloud? Yes. Sandboxer's Android emulator guide creates a large sandbox, installs the Android command-line tools and an x86_64 system image, and starts the emulator with acceleration on. It reports that Android 15 cold-boots in about 30 seconds. You can run it headless and drive it with adb, or put its window on the sandbox's streamed desktop and watch it in a browser. Stop the sandbox with memory saved and resume it with the emulator still booted, or save a named snapshot so every new sandbox starts with the SDK installed. See the Android and nested VM use case. ## Which size should you pick? | Size | vCPU / RAM / disk | Suits | small | 2 / 4 GB / 12 GB | Single containers, light services | default | 4 / 8 GB / 50 GB | Compose stacks, kind or k3s | large | 8 / 16 GB / 125 GB | Nested VMs, the Android emulator, large images | xlarge | 16 / 32 GB / 251 GB | Heavy nested workloads ($100 plan or higher) The disk figure is space for your files on top of the OS image. You can grow a sandbox on resume or fork, but not shrink it. Prices are on pricing. ## Frequently asked questions ### Is Docker preinstalled? Yes. docker, docker compose and docker buildx are installed in every sandbox. ### Do I need --privileged for Docker-in-Docker? No. Each sandbox is a full VM with its own Docker daemon, so there is no outer container to escape. ### Does /dev/kvm work on every size? Sandboxer exposes /dev/kvm to every sandbox, but recommends large or xlarge for nested VMs because the inner guest uses your RAM. ### Are there GPUs for nested VMs? No. Sandboxer has no GPUs. --- # Sandboxer FAQ URL: https://www.northbayventures.com/sandboxer/faq/ Updated: 2026-11-03 Sandboxer runs cloud sandboxes for AI agents and people: full Ubuntu 24.04 microVMs with root, Docker, nested KVM and SSH, billed per second while they run. This page answers the questions people ask most, with links to the detailed explainer for each topic. ## What is Sandboxer, in one paragraph? Sandboxer is a service that creates isolated Linux virtual machines on demand. Each sandbox runs on its own kernel under Cloud Hypervisor, has a public HTTPS URL for any port, comes with coding agents installed, and can be stopped with its memory saved, forked, or saved as a template. You drive it from the sbx CLI, a REST API, TypeScript and Python SDKs, or an MCP server. The Sandboxer hub lists every explainer on this site. ## What are the key numbers? These figures come from Sandboxer's pricing and limits pages: | Item | Value | Sizes | small, default, large, xlarge | Hourly prices | $0.018, $0.036, $0.072, $0.20 | Plans | $20, $100, $500 and $2,000 a month | Run at once | 100, 300, 1,000 and 2,000 by plan | Default auto-stop | 1 hour, up to 30 days, or off | Regions | us-east (Ashburn, Virginia), eu-central (Helsinki, Finland) | API rate limit | 600 requests a minute per API key ## Where can I go deeper on each topic? - Pricing and plans: Sandboxer pricing - Stop with memory: pause and resume - Copies: forking sandboxes - Isolation: security and isolation - Agents: coding agents and the MCP server - First steps: getting started ## Where is the official FAQ? Sandboxer keeps its own FAQ in the docs, and its full documentation is available as plain text for AI tools at https://sandboxer.com/llms.txt. For help, email support@sandboxer.com with your request id or sandbox id. Live service status is at the status page. ## Frequently asked questions ### Is a Sandboxer sandbox a container? No. Each sandbox is a full virtual machine with its own kernel, a Cloud Hypervisor microVM. That is why systemd, Docker, /dev/kvm and root work normally. ### What happens when I stop a sandbox? The filesystem is frozen, the VM's memory and device state are written to disk, and it shuts down. Resume restores that memory, so processes keep running. A resize, or an unusable memory image, makes it boot from disk instead. ### Does a stopped sandbox cost anything? No. Billing is per second while a sandbox runs. Stopped sandboxes and their snapshots count toward your plan's included storage, which is not billed. ### How much does Sandboxer cost? From $0.018 an hour for small to $0.20 an hour for xlarge, billed per second. Plans start at $20 a month, and every plan dollar comes back as machine time. ### Is there a free trial? No. Plans start at $20/month, charged when you subscribe, and every plan dollar comes back as machine time. Signing up, the docs and the dashboard need no card. ### How long can a sandbox run? As long as you want. Auto-stop defaults to one hour as a safety net; extend it up to 30 days at a time or turn it off. ### Does a sandbox pause itself when idle? Yes. After a plan-dependent number of idle minutes, from 15 to 120 by default, it stops with memory and wakes on the next API call or request to its URL. ### Which coding agents are included? Claude Code, Codex, OpenCode, Pi, Kimi Code and Mistral Vibe are installed in every sandbox. They use your own provider keys. ### Can I run Docker, Kubernetes or an Android emulator? Yes. Docker is preinstalled, kind and k3s work, and /dev/kvm is available for the Android emulator, QEMU and Firecracker. Use large or xlarge for nested VMs. ### Can I get a public URL for my app? Yes. sbx host gives a port an HTTPS URL on box.sandboxer.com. It is private with a token by default, or public with --public. ### Can sandboxes talk to each other? Not directly. Traffic between sandboxes is blocked. Connect them through hosted URLs with your own authentication. ### Can I use Sandboxer from Claude or ChatGPT? Yes. Add the hosted MCP server at https://sandboxer.com/mcp as a custom connector, sign in to Sandboxer, and the chat can create and use sandboxes. ### Which languages can I use? Any. It is a REST API described by OpenAPI, with official TypeScript and Python SDKs (both named sandboxer-sdk) and the sbx CLI. ### Where do sandboxes run? On dedicated servers Sandboxer operates in two regions: US East in Ashburn, Virginia, and EU Central in Helsinki, Finland. ### Does Sandboxer have GPUs? No. Sandboxer has no GPUs, so GPU work needs another provider. ### Is there an SLA? Not during early access. Sandboxer asks customers who need one to contact it. ### Who operates Sandboxer? North Bay Opco I, Inc., a Delaware corporation at 777 Brickell Ave, Suite 500 PMB 1074, Miami, FL 33131. It is built by the North Bay Ventures studio. --- # Forking sandboxes URL: https://www.northbayventures.com/sandboxer/forking-sandboxes/ Updated: 2026-10-28 A Sandboxer fork is a new, independent sandbox made from a copy-on-write copy of another sandbox's disk at that moment. The copy keeps every file but boots fresh, so it has a new identity and no running processes or memory from the source. ## What does a fork copy? A fork copies the disk and nothing else. If the source is running, its filesystem is frozen for the instant of the copy, so files written just before the fork are included, and the source keeps running. Sandboxer's snapshots docs list what the fork gets: - The full disk, as a reflink copy, so forking a 100 GB sandbox is as quick as forking a 1 GB one - The source's size, environment version and per-sandbox variables, unless you pass your own - A new id, new subdomain, new machine-id and new SSH host keys It does not inherit the source's auto-stop setting. The default one hour applies unless you pass a TTL, so forking a never-stopping sandbox does not create another one by accident. ## Can you fork a running sandbox with its memory? No. Sandboxer's guide on forking a running sandbox is direct about this: the copy boots fresh, so no RAM and no running processes come across. Files written up to the fork are there. To keep memory, stop and resume the same sandbox instead, as described in pause and resume. If services must come back in every copy, run them as enabled systemd services, which start on boot. | | Stop and resume | Fork | What is saved | Memory, device state and disk | Disk only | Running processes after | Still running, same PIDs | None; the copy boots fresh | Identity | Same sandbox, id and URL | New id, subdomain, machine-id and SSH keys | Cost while waiting | Nothing | The copy is billed while it runs ## How do you fork a sandbox? Use sbx fork with the source id. You can pick a bigger size, add variables and set a TTL in the same call. sbx fork sbx fork --type large -e TENANT=acme --ttl 600 From the TypeScript SDK, fork() returns a new sandbox once it is ready, which makes parallel attempts short to write: const attempts = await Promise.all( ["approach A", "approach B", "approach C"].map(async (hint) => { const fork = await base.fork({ ttlSeconds: 3600 }); return fork.prompt(`Fix issue #42 using ${hint}`, { provider: "codex" }); }), ); Forks can only be made larger than the source, not smaller. A fork also counts as one start against your plan's start limits. ## When should you use a named snapshot instead? Use a named snapshot when many sandboxes should start from one fixed state, and a fork when you want to branch from a sandbox you are using now. A named snapshot is independent of its source, so it still works after you delete the original. sbx snapshot web-stack # save a template sbx new --from web-stack # start from it, as often as you like For results you want to reproduce later, Sandboxer's eval guidance suggests a named snapshot with a version in its name, because a fork points at a sandbox that may be gone. ## What are forks good for? Forks suit any job where you want several tries from the same starting point. The docs name parallel attempts, per-user copies of a prepared environment, and safe experiments on a copy of real data. Sandboxer's guides add two patterns: - Best-of-N agent attempts: fork once per attempt, run the tests in each, keep the best diff. - Baseline comparisons: score unchanged code and an agent's change on the same forked disk. ## Frequently asked questions ### How long does a fork take? The disk copy is a reflink, so its time does not grow with disk size. The quickstart says a fork is created in about a second, and the fork guide says a few seconds; the copy then boots fresh. ### Does a fork cost extra storage? Not at first. Copy-on-write copies share blocks until they diverge. ### Do hosted URLs carry over to a fork? No. A fork gets a new subdomain, and hosted-port tokens are not copied, so run sbx host again in the fork. ### Can I fork a sandbox created with snapshots off? No. A sandbox created with --no-snapshots cannot be resumed, forked or saved as a template. --- # Getting started with Sandboxer URL: https://www.northbayventures.com/sandboxer/getting-started/ Updated: 2026-11-03 To get started, install the sbx CLI with one command, sign in through your browser, and run sbx new to create a sandbox. From there you can open a shell, run commands, publish a port, and stop the machine with its memory saved. ## How do you install the CLI? Run the installer for your system. It puts a single binary called sbx on your PATH, then starts sbx onboard. # macOS / Linux curl -fsSL https://sandboxer.com/install | sh # Windows PowerShell irm https://sandboxer.com/install.ps1 | iex Onboarding opens your browser to sign in with GitHub, Google, an email code, or an email and password, and shows a short code to approve. The CLI never sees your password. For a new account, it then offers to open checkout for the $20/month plan. There's no free trial: the first month is charged when you subscribe, and the plan renews monthly until you cancel. Signing up, the docs and the dashboard need no card. On another computer, run sbx login instead. ## How do you create your first sandbox? Run sbx new. It prints the sandbox id, a three-word subdomain, its URL and IPv6 address, and returns when the machine is ready. sbx new Per Sandboxer's quickstart, what you get is: | What | Details | Machine | A full Ubuntu 24.04 VM with root and systemd | Size | default: 4 vCPU, 8 GB RAM, 50 GB disk | Installed | Docker, Node, Python, Go, Rust, Chrome, gh and coding agents | Billing | Per second while it runs, nothing while it is stopped | Auto-stop | After one hour unless you extend it Any command that takes a sandbox id also accepts current, meaning the last sandbox you created in this shell. ## What can you do with it? Open a shell, run single commands over the API, publish a port, or hand a task to an agent inside: sbx ssh # interactive shell, sudo works without a password sbx exec current "uname -a" # one command, no SSH needed sbx host current 3000 # HTTPS URL for port 3000 sbx prompt "add a /health route and a test for it" To start a dev server and leave it running: sbx ssh -- 'cd ~ && npx create-vite@latest app -t react-ts && cd app && npm i && nohup npm run dev -- --host 0.0.0.0 &' sbx host current 5173 Hosted URLs are private by default and need their token; add --public for an open link. ## How do you stop it and bring it back? Stopping saves memory and disk and stops billing. Resuming restores memory, so the dev server is still running. sbx stop sbx resume If you resume with a bigger size, such as --type large, the sandbox cold-boots from its disk instead. Learn more in pause and resume. ## How do you make copies and templates? sbx fork current # an independent copy sbx snapshot current web-stack # save a named template sbx new --from web-stack # start new sandboxes from it A fork copies the disk and boots fresh, without the source's memory. See forking sandboxes. ## How do you use it from code? Create an API key on the dashboard, or with the CLI, and export it as SANDBOXER_API_KEY. Then call the API directly or use an SDK. sbx api-key create my-app --preset ci export SANDBOXER_API_KEY= curl -sS -X POST https://sandboxer.com/api/v1/sandboxes \ -H "Authorization: Bearer $SANDBOXER_API_KEY" \ -H "Content-Type: application/json" \ -d '{"type":"default","ttlSeconds":3600}' The create call returns 202 while the machine boots. The TypeScript and Python SDKs, both published as sandboxer-sdk, wait until ready for you. See SDKs, CLI and API, or connect an agent through the MCP server. ## Frequently asked questions ### Do I need a card to start? Not to sign up or read the docs. Running sandboxes needs a plan, from $20/month, charged when you subscribe. There is no free trial. ### Which sizes can I use? All four, small, default, large and xlarge, on every plan. Every size is the same machine with the same features. ### How fast is a new sandbox ready? Sandboxer's docs report a median of 0.18 seconds in us-east and 0.32 seconds in eu-central, measured from Virginia on 2026-10-28, and about 1.3 to 2 seconds when no pre-booted sandbox of that size is ready. ### How do I keep a sandbox running past one hour? Run sbx extend with --hours, or create it with --ttl or --no-auto-stop. Auto-stop can be set up to 30 days. --- # How do you give a sandbox port an HTTPS URL? URL: https://www.northbayventures.com/sandboxer/https-urls-for-ports/ Updated: 2026-10-28 Start a server inside a Sandboxer sandbox, then run sbx host . You get an address like https://-.box.sandboxer.com with TLS and WebSockets, and it is private by default: only someone holding its token can open it. ## How do you publish a port? Run the server on a known port, listening on 0.0.0.0, and host that port. The hostname is the sandbox's subdomain followed by the port number. sbx exec --detach "python3 -m http.server 8000" sbx host 8000 --title "Demo" Hosting the same port again returns the same URL and token. Inside the sandbox itself, the shorter host 8000 does the same job. Sandboxer's HTTPS URL guide walks through each step with real output. ## What is the difference between a private and a public URL? A private URL carries a _token; a public URL does not need one. New ports are private. | Request | Private URL | Public URL | No token | 401, and your server never sees it | Served normally | With the token | Redirect that sets a 30-day cookie, then served | Served normally After the first visit the cookie is enough, so links and assets load normally in a browser. Treat the full private URL and the cookie like a password. Add --public to open a port to anyone, or --private to lock it again. Switching between the two mints a new token, so old links stop working. ## What if the app only listens on localhost? Use --localhost. Many dev servers, Vite among them, bind to 127.0.0.1, which the proxy cannot reach, so a plain host returns 502 with "Nothing is answering". With --localhost the sandbox relays the connection to the loopback address. Some dev servers also reject unknown host names; for Vite, add .box.sandboxer.com to server.allowedHosts. ## Do WebSockets and hot reload work? Yes. On a public port they work as they are. On a private port the WebSocket handshake needs the auth cookie rather than the token in the address. A browser already has that cookie after opening the token link, so hot module reload just works. A script has to exchange the token for the cookie first, as shown in the guide. ## What happens to the URL after stop, resume or fork? - Stopped: the URL returns 404 while the sandbox is off. - Resumed: routes, tokens and the subdomain all come back. If memory was restored, the same server processes answer at once. If the resume booted from disk, start your servers again or run them as enabled systemd services. See pause and resume. - Forked: the fork gets a new subdomain with no hosted ports, so host the port again there. An idle sandbox can pause itself and wake on the next request to one of its hosted URLs. ## How do you list or remove hosted ports? sbx host list # ports, access and URLs (tokens hidden) sbx host hide 8000 # take the URL down After hide the URL returns 404, but the server keeps running inside the sandbox. Only hosted ports are reachable through the proxy. ## When should you use a tunnel instead? Use sbx host when the server already runs in a Sandboxer sandbox: there is no extra process to run and the hostname stays the same across stop and resume. A tunnel such as ngrok or Cloudflare Tunnel fits when the server runs somewhere else, like your laptop. Sandboxer does not offer first-class custom domains yet; its hosting docs describe pointing a CNAME at the hosted name and handling TLS yourself. For preview links on pull requests, see CI and testing. ## Frequently asked questions ### Is a hosted port public by default? No. A new hosted port is private, and requests without its token or cookie get a 401 before they reach your server. ### Do I need to open the firewall? No. Hosted traffic comes through Sandboxer's HTTPS proxy. You only open a port with ufw to serve directly on the sandbox's IPv6 address. ### Does the URL change when the sandbox stops and resumes? No. The subdomain, routes and tokens are kept. Only a fork gets a new subdomain. ### Can an AI agent publish a port itself? Yes. Sandboxer's MCP server has a tool that puts a port on an HTTPS URL, so an agent can share a preview of what it built. --- # What is Sandboxer? URL: https://www.northbayventures.com/sandboxer/ Updated: 2026-11-03 Sandboxer is a cloud service that gives AI agents and people their own Linux computers, called sandboxes. Each sandbox is a full Ubuntu 24.04 microVM with root, Docker and SSH that you can stop with its memory intact, copy, and pay for by the second. ## What does Sandboxer do? Sandboxer creates isolated virtual machines on demand. You ask for one from the sbx command line, the REST API, an SDK or an MCP client, and a few moments later you have a machine that an agent can treat as its own. It can install packages, run Docker, start servers and keep working for hours or days. Everything goes through one REST API at https://sandboxer.com/api/v1, described by an OpenAPI document. The sbx CLI, the TypeScript and Python SDKs and the MCP server all sit on top of it, so the same sandbox can be driven from a terminal, a backend or a chat with Claude. The product is built by North Bay Ventures, a venture studio. This hub collects plain-English explainers about how Sandboxer works. For the official reference, read the Sandboxer docs. ## What is inside each sandbox? Every sandbox is the same kind of machine, whatever its size. According to the machines page, each one has: - Ubuntu 24.04 running on its own kernel under Cloud Hypervisor, not a container - A normal user with passwordless sudo, plus systemd for services - Docker with BuildKit and Compose, and /dev/kvm for nested virtualization - SSH and SCP, a public IPv6 address, and an HTTPS URL for any port you choose to publish - A streamed desktop with Google Chrome - Coding agents already installed: Claude Code, Codex, OpenCode, Pi, Kimi Code and Mistral Vibe ## What makes it different from a short-lived code runner? Sandboxer is designed for long, stateful work rather than one quick function call. Three features carry most of that: | Feature | What it means | Stop with memory | A stop saves memory as well as disk, so processes are still running after a resume. See pause and resume. | Copy-on-write forks | A fork copies a sandbox's disk into a new, independent sandbox. See forking. | Per-second billing | You pay while a sandbox runs and nothing while it is stopped. See pricing. Idle sandboxes can also pause themselves and wake on the next request, so a forgotten machine does not keep billing. ## Who is Sandboxer for? Sandboxer fits teams whose agents need a whole Linux machine. Typical uses on the site include running coding agents in parallel, executing model-written code, per-pull-request preview environments, computer-use agents on a desktop, and the Android emulator through nested KVM. The site is also clear about where it does not fit. There are no GPUs, there are two regions, and there is no SLA during early access. If you need any of those today, another service may suit you better. ## How do I try it? Install the CLI, sign in, and create a sandbox. There's no free trial: plans start at $20/month, charged when you subscribe, and signing up and the docs need no card. curl -fsSL https://sandboxer.com/install | sh sbx new sbx ssh The getting started guide walks through each step. ## Which Sandboxer explainers are on this site? Each page below answers one question in plain English and links to the matching page on sandboxer.com. - What is an AI agent sandbox? - Running many agents in parallel - Why each sandbox is a microVM, not a container - Pause and resume with memory - Forking sandboxes - The hosted MCP server - SDKs, CLI and API - Regions - Pricing and plans - Security and isolation - Running untrusted code - Coding agents in the cloud - Agent evaluations and benchmarks - CI and testing - Root, Docker and nested KVM - Getting started - Sandboxer FAQ ## Frequently asked questions ### Is Sandboxer a container platform? No. Each sandbox is a full virtual machine with its own kernel, running under Cloud Hypervisor. ### Who makes Sandboxer? Sandboxer is operated by North Bay Opco I, Inc., a Delaware corporation, and built by the North Bay Ventures studio. ### Does Sandboxer offer GPUs? No. Sandboxer's own site states it has no GPUs, so GPU work belongs elsewhere. ### Where does Sandboxer run? On dedicated servers in two regions: US East in Ashburn, Virginia, and EU Central in Helsinki, Finland. --- # The Sandboxer MCP server URL: https://www.northbayventures.com/sandboxer/mcp-server/ Updated: 2026-10-28 Sandboxer's MCP server lets an AI agent create and use its own cloud computers through the Model Context Protocol. It is hosted at https://sandboxer.com/mcp, so Claude, ChatGPT, Claude Code, Codex, Cursor or any MCP client can connect with a sign-in or an API key and nothing to install. ## What can an agent do through the MCP server? Through the MCP server, an agent can run the whole life of a sandbox. Per Sandboxer's MCP docs, it can create Linux sandboxes, run commands in the foreground or background, read and write files, put a port on an HTTPS URL, save and reuse snapshots, and stop or delete sandboxes when it is done. Everything runs in Sandboxer microVMs, not on your own computer. The hosted server exposes 18 tools. Some of the main ones: | Tool | What it does | create_sandbox | Create an Ubuntu microVM and wait until it is ready | exec | Run a shell command, waiting up to 600 seconds, or start it detached | command_status | Read new output and the exit code of a detached command | read_file / write_file | Move files of up to 5 MiB | host_port | Serve a port on a stable HTTPS URL | stop_sandbox / resume_sandbox | Stop with memory saved, and bring it back | save_snapshot | Save a named snapshot to start new sandboxes from | delete_sandbox | Delete a sandbox; always needs an explicit id ## How do you connect Claude to Sandboxer? In claude.ai or Claude Desktop, add Sandboxer as a custom connector. The steps, from the docs and the Claude connector guide: - Open Customize > Connectors and choose Add custom connector. - Enter https://sandboxer.com/mcp and add it. - Connect, sign in to Sandboxer and click Allow. - In a chat, turn the connector on from + > Connectors. For Claude Code, one command adds the hosted server, and you sign in from the /mcp menu: claude mcp add --transport http --scope user sandboxer https://sandboxer.com/mcp ## How do other clients connect? Any client that speaks the Streamable HTTP transport can connect to the same URL. ChatGPT adds it as a custom MCP server with OAuth; the ChatGPT guide covers the steps. Codex reads an API key from an environment variable: # ~/.codex/config.toml [mcp_servers.sandboxer] url = "https://sandboxer.com/mcp" bearer_token_env_var = "SANDBOXER_API_KEY" Cursor uses an mcp.json entry with the same URL. Other clients can use OAuth 2.1 or send an API key as a bearer token. The server is also listed in the official MCP Registry as com.sandboxer/mcp. ## Should you use the hosted or the local server? Use the hosted server when you want nothing to install, browser sign-in, or web clients like claude.ai and ChatGPT. Use the local stdio server, sbx mcp or npx -y sandboxer-mcp, when you want default sizes and auto-stop for every sandbox the agent creates, or the extra handoff_session tool. Both create the same cloud microVMs. Sandboxer explains the choice in local or hosted MCP. claude mcp add sandboxer -- sbx mcp sbx mcp --type small --ttl 1800 # defaults for sandboxes the agent creates handoff_session moves a local Claude Code or Codex session and its repo into a new sandbox and resumes the agent there, so you can close your laptop. ## How do keys and access work? Any API key works with the MCP server, and its scopes apply tool by tool. A key with the ci preset, for example, can create sandboxes but delete only the ones it created. Signing in with OAuth instead grants the app full access to your account, and each connected app appears on the API keys page, where you can disconnect it at once. - Sandboxes created through MCP stop after an hour unless the agent sets ttlSeconds - MCP calls share the API rate limit of 600 requests a minute per key - A non-zero exit code is returned as a normal result, so the agent can see and fix the problem For a headless agent, keep the key in the SANDBOXER_API_KEY environment variable rather than in a committed file. ## Frequently asked questions ### What is the Sandboxer MCP server URL? https://sandboxer.com/mcp, using the Streamable HTTP transport. ### Does the MCP server run code on my computer? No. Every command runs inside a Sandboxer microVM in the cloud. ### Can I use it with agent frameworks? Yes. Sandboxer documents MCP use with the Claude Agent SDK, the OpenAI Agents SDK, and LangChain and LangGraph. ### Who pays for sandboxes an agent creates? They bill to your active wallet, at the same per-second rates as sandboxes you create yourself. --- # MicroVMs vs containers: why each sandbox is a microVM URL: https://www.northbayventures.com/sandboxer/microvms-vs-containers/ Updated: 2026-10-28 Every Sandboxer sandbox is a microVM because a virtual machine with its own kernel is a much smaller target for escaping code than a container that shares the host's kernel. The VM boundary also makes root, systemd, Docker and nested KVM work normally inside the sandbox. ## What is the difference between a container and a microVM? A container isolates code with Linux namespaces and cgroups on the host's own kernel, while a microVM gives code its own kernel behind hardware virtualization. gVisor sits between the two. Sandboxer's guide on container vs microVM for untrusted code summarizes the three boundaries: | | Container | gVisor | MicroVM | What isolates code | Namespaces and cgroups | A user-space kernel that intercepts system calls | Hardware virtualization (KVM) and a VMM | Kernel | Shared with the host | gVisor's own, on top of the host kernel | The guest's own kernel | Compatibility | Full Linux | Most of the Linux API; some tools behave differently | Full Linux, including Docker and systemd inside | Overhead | Lowest | Low to moderate | A VM per sandbox ## Why does a shared kernel matter for agents? A shared kernel matters because one exploitable kernel bug becomes a way out for every container on that host. The same guide lists the usual ways a container sandbox leaks: - Mounting the host's Docker socket, which hands over control of the host - Running with --privileged so Docker-in-Docker works - Kernel bugs reachable from any container - Host paths, host networking or credential files mounted in for convenience Inside a microVM, the first two stop being risky: the code gets its own Docker daemon and its own root, inside its own VM. A kernel bug then stays inside the guest unless it can also break the hypervisor. ## What does a Sandboxer microVM look like? Each sandbox runs Ubuntu 24.04 on Sandboxer's own kernel build under Cloud Hypervisor, with its own root filesystem, network stack and process tree. You work as an ordinary user with sudo. Because it is a real machine, the things that need workarounds in containers simply work: - systemd, so services you enable come back after a resume - Docker with BuildKit and Compose, without privileged mode - /dev/kvm, so QEMU, Firecracker and the Android emulator run accelerated The four sizes, from small to xlarge, are the same machine with the same features. See Docker and nested virtualization. ## Are microVMs slower than containers? A microVM boots a kernel and uses more memory than a container, so there is some extra cost per sandbox. For agent work that runs for minutes or hours, Sandboxer's guide notes that the startup difference rarely matters. Sandboxer also keeps booted, paused sandboxes ready in each region, so a new sandbox from the standard image usually does not boot at all. Its docs report a median of 0.18 seconds from create to ready in us-east, measured on 2026-10-28, and about 1.3 to 2 seconds when no ready sandbox of that size is available. ## Does a microVM make everything safe? No. A microVM narrows the escape routes, but some risks remain your responsibility: | Still your job | Why | Secrets you put inside | Code in the VM can read and send them | Outbound network | A misled agent can call out to the internet | What you do with the output | Review code before you merge or deploy it Sandboxer helps with no-secret sandboxes and scoped keys, covered in security and isolation. ## How do other sandbox services compare? Sandboxer publishes comparison pages that it says are based on each provider's own public docs. In those pages, E2B and Vercel Sandbox are described as using Firecracker microVMs, Modal as using gVisor by default, and Daytona as offering many sandbox classes, from containers to VMs, plus Windows and GPUs. Each makes different trade-offs, and Sandboxer's own guides point readers to other services for needs it does not cover, such as GPUs or Windows. ## Frequently asked questions ### Is a Sandboxer sandbox a container? No. It is a full virtual machine with its own kernel, running under Cloud Hypervisor. ### What is the difference between gVisor and a microVM? gVisor runs a user-space kernel that intercepts system calls, while a microVM gives code a real guest kernel behind hardware virtualization. gVisor is lighter; a microVM is fully Linux-compatible. ### Can I still use containers inside a Sandboxer sandbox? Yes. Docker and Docker Compose are preinstalled, and each sandbox has its own Docker daemon. ### Can code escape a microVM? Mainly through a bug in the hypervisor or the host's KVM, hardware side channels, or a badly configured host. That is a much smaller target than the system-call interface a container shares. --- # Pause and resume with memory URL: https://www.northbayventures.com/sandboxer/pause-and-resume/ Updated: 2026-11-03 When you stop a Sandboxer sandbox, it saves the VM's memory and device state along with its disk, then shuts down and stops billing. When you resume it, that memory is restored, so your dev server, tmux session and half-finished agent turn carry on where they were. ## What happens when you stop a sandbox? A stop takes a full snapshot of the running machine and then turns it off. Sandboxer's snapshots docs describe three steps: - The filesystem is frozen so the disk image is consistent. - The VM is paused and its memory and device state are written to disk. - The VM shuts down and the billing meter stops. The sandbox moves from archiving to archived. A stopped sandbox keeps everything and costs nothing, though its disk and memory image count toward your plan's included storage. sbx stop sbx resume ## What survives a resume? Running processes survive, with the same process IDs. That covers shell history, tmux panes, npm run dev, a Postgres server, an SSH tunnel, the desktop session and an agent partway through a turn. The guest clock is corrected and the network is re-attached on resume. Sandboxer's pause and resume guide shows a test: a counter loop writing to a file every second kept counting from where it was after a stop and resume, instead of starting again from one. ## When does a resume boot from disk instead? A resume falls back to a cold boot from disk in a few cases. Your files are intact, enabled systemd services start, but hand-started processes do not. The sandbox reports this with memoryRestored: false and a resumeReason: | resumeReason | Why it booted from disk | cpu_mismatch | No machine with the sandbox's CPU type was free in time | resized | You changed the size, which always boots from disk | no_memory_snapshot | The stop kept no memory | restore_failed | The memory image could not be restored on the host Memory is restored on a machine with the same CPU type. If one is online but busy, the resume waits up to 2 minutes. Pass --require-memory to wait up to 30 minutes instead, and fail rather than cold-boot. ## Does a sandbox pause itself when idle? Yes. A sandbox pauses itself after a set number of idle minutes, and that pause is the same stop with memory. The next API call or request to one of its hosted URLs wakes it. Defaults depend on the plan, per the long-running tasks docs: | Plan | Default idle pause | $20 / month | 30 minutes | $100 and $500 / month | 60 minutes | $2,000 / month | 120 minutes sbx new --idle 60 # pause after an hour without activity sbx idle 0 # never pause this one Commands, SSH sessions, agent turns and open terminals keep a sandbox awake. A sandbox stopped by you, by auto-stop or by billing does not wake by itself. ## How is this different from auto-stop? Auto-stop is a hard deadline, while idle pause reacts to inactivity. Every sandbox has a time-to-live, one hour by default, after which Sandboxer stops it with memory and disk kept. You can extend it up to 30 days at a time or turn it off. sbx extend --hours 12 sbx extend --no-auto-stop ## When should you pause instead of fork? Pause when you want the same sandbox back later. Fork when you want copies. A fork copies only the disk into a new sandbox that boots fresh, with a new identity and no running processes. See forking sandboxes. - Pause overnight, between agent turns, or while waiting on review - Fork to try several approaches from one state ## Frequently asked questions ### Does a stopped sandbox cost anything? No compute is billed while it is stopped. Its disk and snapshots count toward your plan's included storage, which is not billed. ### How long can a sandbox stay stopped? Until you delete it, unless your account has zero data retention turned on. ### Can I change size when I resume? Yes, you can make it bigger with --type. A resize always cold-boots from disk, so files stay but running processes do not. ### Can a sandbox be stopped without saving anything? A sandbox created with --no-snapshots never snapshots, so stopping it erases it. It cannot be resumed or forked. --- # Sandboxer pricing URL: https://www.northbayventures.com/sandboxer/pricing/ Updated: 2026-11-03 Sandboxer bills each sandbox per second while it runs, at an hourly price set by its size, from $0.018 an hour for small to $0.20 for xlarge. Plans start at $20 a month, every plan dollar comes back as machine time, and a stopped sandbox costs nothing. ## How much does each sandbox size cost? Each of the four sizes has one hourly price, metered per second. These are the figures on Sandboxer's pricing page, in US dollars: | Size | vCPU | RAM | Disk | Per hour | Always on (730 h) | small | 2 | 4 GB | 12 GB | $0.018 | $13.14 | default | 4 | 8 GB | 50 GB | $0.036 | $26.28 | large | 8 | 16 GB | 125 GB | $0.072 | $52.56 | xlarge ($100+ plan) | 16 | 32 GB | 251 GB | $0.20 | $146 Every size is the same machine with the same features; only the resources change. Your balance is counted in seconds of default time, and one dollar buys 100,000 of them. Larger sizes use that time faster: large at 2x and xlarge at about 5.56x. ## What do the plans include? A plan sets how many sandboxes can run at once and how fast you can start them, and it includes a month of machine time equal to its price. The plan fee is not on top of usage. Included time renews monthly and does not roll over. | Plan | Run at once | Starts per minute / hour / day | Storage included | $20 / month | 100 | 12 / 60 / 200 | 50 GB | $100 / month | 300 | 30 / 210 / 840 | 250 GB | $500 / month | 1,000 | 65 / 420 / 1,680 | 1 TB | $2,000 / month | 2,000 | 90 / 600 / 2,400 | 5 TB The xlarge size needs the $100 plan or higher. Upgrades are prorated and take effect at once; downgrades apply at renewal. ## What happens when you need more time? You buy time packs. Each pack costs $20, uses the same rates, and never expires. Plan time is spent first, then packs. Auto-refill can buy packs for you when your balance falls below a threshold. sbx billing # plan, renewal date, balance, auto-refill sbx billing credits 3 # buy three packs now sbx billing autorefill on # refill automatically If a balance reaches zero with auto-refill off, new creates, resumes and forks fail, and running sandboxes keep going for a 24-hour grace period. After that they are stopped with memory and disk kept, so nothing is lost. ## Is storage billed? No. Each plan includes storage for stopped sandboxes and named snapshots, and storage itself is not billed. Running sandboxes do not count. An account with no plan includes 10 GB. When you reach the limit, new sandboxes, forks and named snapshots wait until you free space or upgrade. Going over never deletes anything, and it never blocks stopping, resuming or deleting. ## Is there a free trial? No. New accounts don't get a trial; plans start at $20/month. The first month is charged when you subscribe, and plans renew monthly until you cancel. Signing up, the docs and the dashboard need no card. A trial that had already started keeps the terms it started with until it ends, as Sandboxer's billing docs explain. ## What do typical workloads cost? The billing docs give worked examples at the default rate of $0.036 per hour: | You run | Machine time | Cost | One default sandbox, 8 h/day, 22 days | 176 h | $6.34, inside the $20 plan | One default sandbox around the clock | 730 h | $26.28, the $20 plan plus one pack | 200 small sandboxes for 1 hour each | 100 h of default time | $3.60 | A large sandbox for a 3-hour build, then stopped for a month | 6 h | $0.22 Model usage for agents is separate: integrated agents use your own provider keys, billed by that provider. To bill your own customers, read per-sandbox usage with sbx usage. Sandboxer also has a guide on how to cap what agent sandboxes can cost. ## Frequently asked questions ### Does a stopped sandbox cost anything? No. Billing is per second while a sandbox runs. Stopped sandboxes and their snapshots are free within your plan's included storage. ### Is billing per second or per hour? Per second, from the moment a sandbox is up until it is stopped. Prices are quoted per hour. ### Do unused plan hours roll over? No. Included time renews each billing month. Time packs, bought separately, never expire. ### Is there a free tier? No. There is no free tier or trial. Plans start at $20/month, and every plan dollar comes back as machine time. ### Does Sandboxer charge for GPUs? Sandboxer has no GPUs. Billing is for CPU machine time only. --- # Sandboxer regions URL: https://www.northbayventures.com/sandboxer/regions/ Updated: 2026-10-28 Sandboxer runs in two regions: us-east in Ashburn, Virginia, and eu-central in Helsinki, Finland. A new sandbox goes to the region nearest you unless you name one, and forks, snapshots and resumes stay in the region where they started. ## Which regions does Sandboxer have? Sandboxer has two regions, both on dedicated servers that Sandboxer operates. The regions docs list them: | Region id | Name | Location | us-east | US East | Ashburn, Virginia | eu-central | EU Central | Helsinki, Finland Sandboxer's own site notes that if you need more than two regions today, another service may fit better. ## How is a region chosen if you don't pick one? Without a region, a new sandbox goes to the region nearest you, judged from the country of your IP address. The lookup runs on Sandboxer's servers against a local database, and your address is not sent anywhere else. - Europe (including the UK), the Middle East, Africa, and South and Southeast Asia go to eu-central - The Americas, East Asia and Oceania go to us-east - Anything that can't be placed goes to us-east Each sandbox reports its region and a regionSource of requested, nearest, default or source, so you can always tell why it landed where it did. ## How do you pick a region? Pass region when you create a sandbox. The same option works in the CLI, the API, both SDKs and the MCP server's create_sandbox tool. sbx regions # list regions and mark your nearest sbx new --region us-east curl -sS -X POST https://sandboxer.com/api/v1/sandboxes \ -H "Authorization: Bearer $SANDBOXER_API_KEY" -H "Content-Type: application/json" \ -d '{"region":"eu-central"}' The SDKs take region as a create option too. The Daytona-compatible API reads target, which accepts us, eu or a region id. ## Which region should you choose? Choose the region closest to the people or services that talk to the sandbox most. Every command, file transfer, SSH session and hosted URL travels between you and the sandbox, so distance shows up as delay on each call. If your backend runs in Europe, eu-central keeps those round trips short; if it runs in North America, us-east does. Sandboxer's machines page shows the effect. Measured from Virginia on 2026-10-28, a new default sandbox was ready in a median of 0.18 seconds in us-east and 0.32 seconds in eu-central, and the docs note that the EU figure includes the round trip from Virginia to Finland. Each region keeps a pool of booted, paused sandboxes ready, which is why most creates are this quick. If you need data to stay in one region, name it explicitly rather than relying on IP lookup, which can change when you travel or route through a VPN. ## Do forks and snapshots move between regions? No. Copies stay in the region of the thing they were made from: - A fork runs in its source sandbox's region - A sandbox made from a named snapshot or share code starts in that snapshot's region - A resume stays in the sandbox's region Asking for a different region in any of these cases returns 400 region_mismatch. Plan your templates with this in mind: if you serve users in both regions, build a named snapshot in each one. ## What errors can region requests return? | Response | Meaning | 400 invalid_region | The region id is unknown; the response lists valid ones | 503 region_unavailable | No machine is free in that region right now | 400 region_mismatch | A fork, resume or snapshot-based create named a different region You can check regions without a key. GET /api/v1/regions returns each region's id, name, location and availability, plus the default and your nearest region. curl -sS https://sandboxer.com/api/v1/regions ## Frequently asked questions ### How many regions does Sandboxer have? Two: US East (us-east) in Ashburn, Virginia, and EU Central (eu-central) in Helsinki, Finland. ### Can I keep a sandbox in the EU? Yes. Create it with region set to eu-central. Its forks, resumes and snapshot copies stay there. ### Where are older sandboxes? Sandboxes created before regions were introduced are in eu-central. ### Does region affect price? Sandboxer's pricing page lists one hourly price per size and does not list separate prices by region. --- # Running untrusted code URL: https://www.northbayventures.com/sandboxer/run-untrusted-code/ Updated: 2026-10-28 To run untrusted or AI-generated code safely on Sandboxer, start a fresh microVM with none of your secrets, run the code there with a timeout, read back the output, and delete the VM. The code gets a full Linux machine with its own kernel, but no route to your network, your other sandboxes or your keys. ## Why run model-written code in a microVM? Code an LLM wrote or a user uploaded can do anything code can do, so it belongs behind a strong boundary. Each Sandboxer sandbox is a Cloud Hypervisor microVM with its own kernel, and sandboxes cannot reach each other, the host or private networks. The host's agent listens on vsock rather than on the sandbox's network. Sandboxer's untrusted code use case frames the pattern simply: run it in a VM that cannot reach your network, then throw it away. The reasons a VM is safer than a container are covered in microVMs vs containers. ## What does the basic pattern look like? Create a small sandbox with a short auto-stop, run the code with a timeout, and delete it. This is the example from Sandboxer's use-case page: id=$(sbx new --type small --ttl 600 --json | jq -r 'select(.event=="ready") | .id') sbx exec "$id" --timeout 60 -- python3 -c "$GENERATED_CODE" sbx delete "$id" --yes The --ttl 600 backstop stops the sandbox after ten minutes even if your script crashes before the delete. For files, use sbx scp, or the SDK's file calls, which read and write single files of up to 5 MiB. ## How do you keep secrets out? Start the sandbox with --no-env so it holds none of your account's secrets, then pass only what the task needs. Sandboxer's guide on passing secrets safely adds two cautions: - Never put a secret on a command line: sbx history stores every exec command for 90 days, and ps shows process arguments - Prefer -e, stdin, or a file you delete after use For your own API calls, use a scoped key limited to one sandbox and a few actions, with an expiry. In a product that gives each user a sandbox, create each one with noEnv through the API. ## Should every tool call get a fresh sandbox? Use a fresh sandbox per call when the input is untrusted or calls must not see each other, and reuse one sandbox per session when calls build on each other. Sandboxer's guide on a fresh sandbox per tool call measured both on its production service: | Approach | Measured time per call | Fresh sandbox from a pre-warmed named snapshot | 3.2 seconds | Fresh sandbox, installing dependencies each time | 12.9 seconds | Reusing one sandbox per session | 0.55 seconds The lesson is to bake dependencies into a named snapshot, so fresh sandboxes start ready. ## How do you cap CPU and memory for one run? Wrap the run in a systemd scope inside the sandbox. Sandboxer's resource limits guide suggests limits along these lines: sudo systemd-run --scope -p MemoryMax=1G -p CPUQuota=100% -p TasksMax=256 -p RuntimeMaxSec=60 python3 untrusted.py In its test, a memory hog died with exit code 137, a fork bomb stalled at 200 tasks, and the agent's own processes kept running. ## What is still your responsibility? A microVM narrows escape routes, but it cannot judge the code's intent. Outbound internet is open by default, so code can call out; restrict it with ufw inside the VM if needed. Anything you put inside can be read. And output, such as a patch, still needs review before you merge or run it elsewhere. See security and isolation. ## Frequently asked questions ### Is Docker enough for untrusted code? Containers share the host kernel. For code you do not trust, Sandboxer's guides recommend a VM boundary such as a microVM. ### Can untrusted code in a sandbox reach my other sandboxes? No. Traffic between sandboxes, and to the host and internal networks, is blocked. ### How long can a command run through exec? A synchronous exec waits 1 to 600 seconds, 30 by default. Longer jobs can be started detached and checked later. ### Can I check out an unknown GitHub repo safely? Sandboxer has a guide for this: run it in a fresh no-env sandbox inside a capped systemd scope, copy the report out, and delete the VM. --- # SDKs, CLI and API URL: https://www.northbayventures.com/sandboxer/sdks-and-cli/ Updated: 2026-10-28 You can drive Sandboxer from the sbx command line, from the sandboxer-sdk packages for TypeScript and Python, or from any language over its REST API. All of them sit on one HTTP API at https://sandboxer.com/api/v1, described by an OpenAPI document. ## Which interfaces does Sandboxer offer? Sandboxer offers five ways in, all backed by the same API, so a sandbox created one way can be used from any other. | Interface | Name | Good for | CLI | sbx (macOS, Linux, Windows) | Terminals, scripts and CI | TypeScript SDK | sandboxer-sdk on npm | Node, Bun, Deno and browsers | Python SDK | sandboxer-sdk on PyPI, imported as sandboxer | Python 3.10+ backends and agents | REST API | https://sandboxer.com/api/v1 | Any language with an HTTP client | MCP server | Hosted, or sbx mcp locally | Agents such as Claude, Codex and Cursor Inside a sandbox, SANDBOXER_TOKEN and SANDBOXER_API_URL are already set, so the SDKs work there with no arguments, scoped to that one sandbox. The MCP server has its own page: Sandboxer MCP server. ## How does the sbx CLI work? sbx is a single static binary, and most of its commands map to one API call. The CLI reference lists every command and flag. curl -fsSL https://sandboxer.com/install | sh # macOS / Linux irm https://sandboxer.com/install.ps1 | iex # Windows PowerShell sbx self-update For scripts, --json gives machine-readable output, and it turns on by itself when output is not a terminal. Exit codes are documented: for example, 3 means not signed in and 4 means not found. sbx exec and sbx ssh return the remote command's own exit code, so a failing test fails your script. id="$(sbx new --type small --json | jq -r 'select(.event=="ready") | .id')" sbx exec "$id" "npm ci && npm test" sbx stop "$id" --json ## How do the TypeScript and Python SDKs look? Both SDKs wrap the API in a Sandboxer client that reads SANDBOXER_API_KEY from the environment. Creating a sandbox waits until it is ready. npm install sandboxer-sdk import { Sandboxer } from "sandboxer-sdk"; const sandboxer = new Sandboxer(); const sandbox = await sandboxer.create({ type: "default", ttlSeconds: 1800 }); const run = await sandbox.exec("node -v"); console.log(run.exitCode, run.stdout); await sandbox.stop(); In Python, install sandboxer-sdk, not sandboxer. The Python SDK docs warn that the PyPI package named sandboxer is an unrelated project. pip install sandboxer-sdk from sandboxer import Sandboxer with Sandboxer() as client: sandbox = client.create(type="default", ttl_seconds=1800) print(sandbox.exec("python3 --version").stdout) sandbox.stop() Both SDKs cover lifecycle calls, streamed and detached commands, files, hosting, agent prompts and usage. See the TypeScript SDK docs for the full list. ## Can you call the REST API directly? Yes. Send a bearer API key with each request. A create call returns 202 while the machine boots; poll the sandbox until its state is ready, or subscribe to the sandbox.ready webhook. curl -sS -X POST https://sandboxer.com/api/v1/sandboxes \ -H "Authorization: Bearer $SANDBOXER_API_KEY" \ -H "Content-Type: application/json" \ -d '{"type":"default","ttlSeconds":3600}' The API reference documents every endpoint, and creates can be made safe to retry with an Idempotency-Key header. ## Does Sandboxer work with the Daytona SDK? Yes, for the calls it covers. Sandboxer runs a Daytona-compatible API that the Daytona TypeScript and Python SDKs can use after you change the API URL and key. Its migration guide says lifecycle, files, processes, sessions and previews work, while images, volumes, GPUs, git and PTY return not_supported. DAYTONA_API_URL=https://sandboxer.com/daytona/api DAYTONA_API_KEY= ## What else can you hook into? - Webhooks: signed lifecycle events, using HMAC-SHA256 with a timestamp - OpenTelemetry: export metrics and lifecycle events over OTLP - Scoped API keys: limit a key to certain actions, sandboxes and an expiry ## Frequently asked questions ### What is the Sandboxer Python package called? Install sandboxer-sdk from PyPI and import it as sandboxer. The PyPI package named sandboxer is unrelated. ### Does the CLI run on Windows? Yes. Install it in PowerShell with irm https://sandboxer.com/install.ps1 | iex. ### Is there an OpenAPI spec? Yes. The REST API is described by an OpenAPI document at https://sandboxer.com/openapi.yaml. ### Can I use Sandboxer from Go or another language? Yes. It is a standard REST API, so any HTTP client works, even without an official SDK. --- # Security and isolation URL: https://www.northbayventures.com/sandboxer/security-and-isolation/ Updated: 2026-10-28 Sandboxer isolates each sandbox in its own Cloud Hypervisor microVM with its own kernel, and assumes the code inside may be hostile. Sandboxes cannot reach each other, the host or internal networks, and you decide which secrets, if any, go inside. ## How is each sandbox isolated? Each sandbox is a separate virtual machine with no shared kernel. Sandboxer's security docs describe four layers: - One VM per sandbox. Every sandbox is its own Cloud Hypervisor microVM with its own kernel. - No control channel on the network. The agent inside the VM talks to the host over vsock, not TCP, so nothing on the sandbox's network, even code running as root, can reach the host's control API. - Separate disks. Each root disk is its own copy-on-write image. Forks and snapshots are reflinks, never shared writable state. - Fresh identity on fork. Forks get a new machine-id, SSH host keys and hostname, so copies cannot impersonate each other. Why a VM rather than a container is explained in microVMs vs containers. ## What network traffic is allowed? Outbound internet access is open, and nearly every other path is blocked or gated. The network policy from the docs: | Traffic | Policy | Sandbox to internet | Allowed (IPv4 through NAT, IPv6 direct) | Sandbox to another sandbox | Blocked; VMs have no shared bridge | Sandbox to host and internal networks | Blocked, except the node's DNS relay | Sandbox to SMTP port 25 | Blocked | Internet to sandbox IPv6 | Reaches the VM, whose firewall is closed except SSH by default | Internet to hosted ports | Only through the HTTPS proxy, and token-gated unless made public Bandwidth is shaped per VM so one sandbox cannot starve its neighbors. Sandboxer has no egress allowlist of its own; its network guide suggests restricting outbound traffic yourself with ufw inside the VM. ## How are secrets handled? Secrets only go into a sandbox when you choose to send them. Environment variables and secret files are written in only when the sandbox's environment passes them. - noEnv sandboxes, and environments marked safe for third parties, get none of your secrets or credentials - Removing a secret from an environment and upgrading deletes it from the sandboxes' disks, rather than hiding it - Share codes for named snapshots strip your logins, keys, secret files, repository credentials and SSH keys from the copy sbx new --no-env -e ONLY_THIS_KEY=value ## How do API keys and tokens limit damage? Keys can be scoped so that a leaked one does little harm. API keys are stored as SHA-256 hashes and shown once. You can limit a key to certain actions, sandboxes and environments, and give it an expiry. sbx api-key create one-sandbox --sandbox --actions sandbox.read,exec,file.read --ttl 7d Inside every sandbox, SANDBOXER_TOKEN can only act on that sandbox. Hosted-port tokens and desktop URLs are redacted from Sandboxer's logs, and webhook deliveries are signed with HMAC-SHA256 and timestamped. ## What data does Sandboxer keep? Stopped sandboxes keep their disks until you delete them. You can reduce what is kept: - Zero data retention, an account setting, deletes the data of every archived sandbox and named snapshot instead of keeping it - Snapshots off and monitoring off stop disk snapshots, command output, process lists and metrics from being kept - Closing an account archives sandboxes and revokes every API key, with a 30-day window to reopen, or an immediate permanent erase The docs note that copies in backups and long-term storage may remain for a time after deletion. ## How do you report a vulnerability? Email security@sandboxer.com with a description, steps to reproduce and the impact. Sandboxer commits to acknowledge reports within 3 business days, treats sandbox escape and cross-tenant access as top priority, and offers a good-faith safe harbor for research that stays in scope. ## Frequently asked questions ### Can one Sandboxer sandbox reach another? Not directly. Traffic between sandboxes is blocked. To connect them, use hosted HTTPS URLs with your own authentication. ### Can a sandbox reach the internet? Yes. Outbound internet is allowed, except SMTP port 25. Restrict it further with ufw inside the VM if you need to. ### Can I give a sandbox to my own users? Yes. Create it with noEnv or on an environment marked safe for third parties, so it holds none of your secrets. ### Is there an SLA? Not during early access, according to Sandboxer's FAQ. --- # What is an AI agent sandbox? URL: https://www.northbayventures.com/sandboxer/what-is-an-agent-sandbox/ Updated: 2026-10-28 An AI agent sandbox is a separate, isolated computer where an agent can run commands, install software and use tools without touching your own machine, accounts or other users. A good one has its own kernel, holds only the secrets a task needs, limits what it can reach, and can be paused, copied or thrown away. ## Why do AI agents need a sandbox? Agents need a sandbox because they act like developers, and developers make changes that can break things. A coding or computer-use agent runs shell commands, adds dependencies, starts servers and reads web pages. On a laptop or a production server, every one of those actions has full reach. Sandboxer's guide to agent sandboxes names two main risks: - Mistakes. A wrong delete command, a bad migration or a runaway process damages whatever the agent can touch. - Untrusted input. Text hidden in a web page, an issue or a file can steer the agent through prompt injection, and the agent then acts with all of its permissions. A sandbox keeps that damage inside a machine that holds nothing else of value. ## What should a good agent sandbox have? A good agent sandbox combines a strong boundary with a complete working environment. The table below lists the properties Sandboxer's guide highlights and how a Sandboxer sandbox meets each one. | Property | Why it matters | In Sandboxer | Isolation | A shared kernel is a larger attack surface | One Cloud Hypervisor microVM per sandbox, with its own kernel | Secrets | An agent can only leak what it holds | --no-env starts with none of your secrets | Network reach | Limits what a misled agent can contact | No direct route to other sandboxes or internal networks; outbound internet is open | A full OS | Real tasks need packages and services | Ubuntu 24.04, sudo, systemd, Docker, /dev/kvm | Lifetime | Long tasks should not die halfway | Stop saves memory, and a stopped sandbox costs nothing | Disposable | Start clean and discard after | Delete when done, or fork to try again ## Is a container enough, or do you need a VM? For untrusted or agent-written code, a virtual machine with its own kernel is the stronger choice. Containers share the host's kernel, so a kernel bug or a mounted Docker socket can let code escape. gVisor adds a user-space kernel in between. A microVM uses hardware virtualization, so each sandbox runs its own kernel. Containers are lighter and still better than running an agent on your laptop. The trade-offs are covered in microVMs vs containers. ## What should never go inside an agent sandbox? Keep out anything you would not hand to the agent's worst possible input. That includes your SSH keys, long-lived cloud credentials, production database access and personal browser sessions. Pass only short-lived, narrowly scoped keys for the task at hand. Sandboxer supports this with no-secret sandboxes and scoped API keys. Details are in security and isolation. ## How do you give an agent a Sandboxer sandbox? You can hand a task to an agent that runs inside the sandbox, or let your own agent create sandboxes as tools. The first approach takes three commands: curl -fsSL https://sandboxer.com/install | sh sbx new --no-env -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" sbx prompt --provider claude-code "Clone the repo, run the tests, fix what fails" For the second approach, connect an MCP client such as Claude, Claude Code, Codex or Cursor to Sandboxer's MCP server. The agent then gets tools to create sandboxes, run commands, move files, publish a port and stop the machine when it is done. ## Frequently asked questions ### What is an AI sandbox? An isolated environment where AI-generated code or an AI agent can run without access to your own computer, data or credentials. It can be a container, a gVisor sandbox or a virtual machine. ### Is a Docker container a safe sandbox for an agent? It is safer than your laptop, but containers share the host kernel. For untrusted code, a microVM with its own kernel is a stronger boundary, and the host's Docker socket should never be mounted into an agent's container. ### How long should an agent sandbox live? As long as the task needs. Short code runs can use throwaway sandboxes, while coding agents often need hours or days, which is where stop and resume with memory helps. ### Can my own agent create sandboxes? Yes. Use the REST API at https://sandboxer.com/api/v1 from any language, or connect any MCP client to Sandboxer's MCP server. --- # How do you run an influencer campaign from an AI agent? URL: https://www.northbayventures.com/transformer/agents-and-mcp/ Updated: 2026-11-03 Connect your agent to Transformer's MCP server at https://transformer.gg/mcp, choose the brand or creator workspace it acts for, and ask it to do the work: get suggested creators, send offers, pay for the ones creators accept, track verification and report sales. The agent handles the coordination, while creators still write and publish their own posts. Nothing is charged when an offer goes out: the brand pays only after a creator accepts. ## What is Transformer's MCP server? MCP (Model Context Protocol) is a standard way for AI assistants to use outside tools. Transformer runs an MCP server over streamable HTTP that exposes the same actions as its dashboard and REST API. Transformer describes both sides as equal API users: nothing is dashboard-only, and using the MCP server costs nothing extra. Tool inputs mirror the REST request bodies, and results come back as the same JSON the API returns. ## How do I connect an agent? There are two ways to authenticate: | Method | Best for | How it works | Sign-in (OAuth 2.1) | MCP clients that support sign-in, such as Claude, Claude Code, ChatGPT and Cursor | Add the server URL, sign in with X and pick the workspace the agent acts for. Revoke it later in Settings → Agents. | Workspace API key | Headless agents, scripts and CI | Create a key starting with tf_live_ on the workspace page and send it as a bearer token. In Claude Code, one command adds the server: claude mcp add --transport http transformer https://transformer.gg/mcp For a headless setup, add --header "Authorization: Bearer $TRANSFORMER_API_KEY". Any client that reads an mcp.json file can point at the same URL with the same header. Asking the agent to call whoami confirms which workspace it's acting for. ## What can a brand's agent do? With a brand workspace, the tools include: - suggestions and write_asks for X creators matched to the brand's website, with a short ask written for each; - search_creators and add_creators to find creators by keyword or handle, or add ones that aren't indexed yet; - send_offers and create_offer to send offers to one or many creators; - pay_offers to pay for accepted offers within 72 hours, from the balance first, then a checkout link; - cancel_offer for an offer that hasn't been accepted, or an accepted one that isn't paid yet; - list_offers, get_offer and offer_stats to follow progress; - report_conversion to record a sale. Sending an offer costs nothing. The brand pays only for offers a creator accepts, and the creator posts only after that payment. ## What can a creator's agent do? A creator workspace lets an agent list incoming offers, accept or decline them, list accepted deals with their next step, submit the URL of a post the creator published, and check earnings, balance and payout requests. It can also save payout methods and request payouts. It cannot post on X, because Transformer never posts for creators. ## What guardrails keep an agent safe? - One key or connection, one workspace. An agent acts for exactly one brand or creator and sees nothing else. - Nothing is charged until a creator accepts. Offers go out unpaid, and paying for an accepted offer is a separate step within 72 hours. - The agent never moves money. Payment is held once the brand pays and released only by verification. - You're responsible for your agent. Transformer's terms treat what an agent does with your key as if you did it. - Revocable access. Keys can be revoked from the workspace page and sign-ins from Settings → Agents. ## Are there any limits today? Yes. Paid offers run on X only. Webhooks aren't available yet, so agents poll offers and stats for changes. If you'd rather not use MCP, the same actions are in the CLI and REST API. ## Frequently asked questions ### Can Claude run an influencer campaign? Yes. Connected to Transformer's MCP server with a brand workspace, Claude can get suggested creators, send offers, pay for the ones creators accept, follow verification and read clicks and sales. Creators still write and publish their own posts. ### Does using MCP cost extra? No. The MCP server, CLI, REST API and API keys are free. Agents and people pay the same 20% platform fee on payouts and commission. ### Can one agent run several brands? Each key or sign-in acts for one workspace. To run several, give the agent a separate key or connection for each. ### Where are the MCP tools documented? In the MCP section of Transformer's developer docs at transformer.gg/docs. ### Does the agent pay creators directly? No. Payment is held once the brand pays for an accepted offer and released automatically when the creator's post passes verification. The agent never moves money itself. --- # What are AI influencers on Transformer? URL: https://www.northbayventures.com/transformer/ai-influencers/ Updated: 2026-11-01 Transformer lets you create AI personas, synthetic creators clearly labeled as AI, that post and take deals from brands that have opened their offers to AI. It's an optional add-on at $29 a month per persona, with 200 generation credits included, and creating a persona to try it is free. ## How are AI personas different from human creators? | | Human creator | AI persona | Who writes the post | The creator, in their own voice | Generated for the persona, which is labeled as AI | Which brands | Any brand that sends an offer | Brands that open their deals to AI | Cost to join | No subscription or fees | $29 a month per persona; creating one to try is free | Labeling | Paid posts carry X's Paid partnership label | Clearly labeled as AI, plus paid-post disclosure ## What does the add-on cost? Each persona is a separate monthly subscription. Transformer is clear that this is an extra charge on top of a marketplace that otherwise has no subscription. - $29 a month per persona, which includes posts, deals and brand search for that persona. - 200 generation credits a month, reset monthly with no rollover. - Extra generation is billed from a prepaid wallet at cost plus 20%. - Trying it is free: creating a persona costs nothing. ## How far do 200 credits go? Transformer gives two reference points for what generation uses: | Content | Approximate credits | Per 200 credits | Image post | About 3 | About 66 posts | 20-second talking-head video | About 60 | About 3 videos These are approximate, and actual use depends on what you generate. ## Why does labeling matter? Transformer requires that AI personas are clearly labeled as AI. Audiences trust recommendations partly because they come from a real person, so being honest that a persona is synthetic keeps that trust from being misused. It's also why brands decide for themselves whether to open their deals to AI personas. Paid posts from personas still need the usual paid-post disclosure; see sponsored-post disclosure. ## Do I need personas to use Transformer? No. The persona add-on is optional. Brands and human creators use the marketplace with no subscription at all, paying or earning per offer. See pricing and fees and Transformer for creators. Think of personas as a separate product that sits alongside the marketplace. The marketplace itself charges only its 20% platform fee on each payout and commission, whether the work is done by a person or an agent. Personas add a monthly charge per persona, plus wallet charges only if you generate beyond the included credits. ## Who is the add-on for? Transformer describes it as being for people who run AI-generated personas. Instead of posting as yourself, you create a synthetic creator, generate its content with the included credits, and use it to post and to find and take deals from brands that accept AI. Each persona gets its own posts, deals and brand search, and its own monthly charge. If you post as yourself, you don't need it. ## What could a month of credits look like? Using Transformer's approximate figures, here is how the 200 included credits can be split. This is arithmetic on published estimates, not a guarantee: | Mix | Approximate credits used | 66 image posts | About 198 | 1 video and 46 image posts | About 198 | 3 videos | About 180 Two personas cost $58 a month, each with its own 200 credits. Anything beyond the included credits draws on the prepaid wallet. ## Frequently asked questions ### How much does an AI influencer cost on Transformer? $29 a month per persona, including 200 generation credits a month. Extra generation is billed from a prepaid wallet at cost plus 20%. ### Do unused credits roll over? No. The 200 monthly credits reset each month. ### Can AI personas take any brand deal? They take deals from brands that have opened their offers to AI. Brands choose whether to do that. ### Is creating a persona free? Yes. Creating one to try it is free; the monthly charge applies when you run it. ### What happens when the credits run out? Extra generation is billed from a prepaid wallet at cost plus 20%. ### Do brands need the persona add-on? No. Brands use the marketplace with no subscription. Deciding whether to open deals to AI personas is their choice. --- # How does Transformer track clicks and sales? URL: https://www.northbayventures.com/transformer/attribution/ Updated: 2026-10-28 Every accepted offer gets its own tracked link that counts clicks and sends visitors to the brand's page with a tf_click id attached. The brand's server then reports each sale or signup with that id, so the conversion and any commission are credited to the creator who drove it. ## How does a click become an attributed sale? - Tracked link. When a creator accepts, the offer gets a link like https://transformer.gg/r/. - Click. A follower taps the link in the post; the click is counted and redirected. - Click id. The visitor lands on the brand's URL with ?tf_click=… appended. - Store it. The brand's site keeps the id with the visitor's session or order, much like a coupon code. - Report it. When the order is paid, the brand's backend calls POST /api/v1/conversions with the id, the amount and its own order id. - Credit. The sale is tied to the offer, and any commission is calculated and credited to the creator. ## Why report conversions from the server? Transformer's approach doesn't need a third-party cookie. The id travels in the URL, and the sale is reported by a server-side call with a brand key. That keeps the API key out of the browser, and because order ids are unique per offer, retrying the same report never double-counts. A signup can be reported with an amount of zero. A typical setup has three small parts: a line of browser code that saves the id when a visitor lands, a field on your order record to keep it, and one API call when the order is paid. Agents can report the same way with the report_conversion MCP tool or the CLI. ## What if a sale can't be tied to a click? The brand can report it with the creator's X handle (which uses the brand's latest live offer to that creator) or with the offer id instead of a click id. ## What about my own landing pages? Some brands give each creator a page such as yourbrand.com/x/. Set a landing URL template and that page becomes the link the creator posts. Visitors then skip the tracked redirect, so the brand records the visit itself in one of two ways: | Option | What it needs | What it does | POST /api/v1/visits | A server-side call on the landing page | Counts the visit as a click, returns a click id to keep for the sale, and removes duplicates | Pixel | A 1×1 image tag on the page | Counts each load as a visit; bots and link previews aren't counted The pixel only counts visits. Sales and signups are still reported with POST /conversions. ## What results does a brand see? | Metric | Where it comes from | Verified posts | Transformer's check on X | Clicks | The tracked link; repeat clicks from the same visitor within 30 minutes count once | Conversions and revenue | Sales the brand reports | Commission | Calculated per reported sale from the offer's commission rate Views, likes and replies stay on X; Transformer doesn't pull them into offer stats today. Dividing a payout by its conversions gives a cost per acquisition you can compare with other channels. ## How is visitor data handled? Transformer's privacy policy says the IP addresses of people who click tracked links are stored only as one-way hashes. Its terms ask brands not to use tracked links or the data they get to identify individuals without a lawful basis, and note that counts may differ from a brand's own analytics. ## Frequently asked questions ### What is a tf_click id? The click id Transformer appends to the brand's URL when someone uses a creator's tracked link. The brand sends it back with each sale so the sale is credited to the right creator and offer. ### Do I need a pixel to track sales? No. Passing the click id in the URL and reporting the sale from your server is enough. The pixel is only for counting visits to your own landing pages. ### Can an agent report conversions? Yes, with the report_conversion MCP tool or the CLI. Transformer recommends reporting sales from your backend. ### Can I track signups as well as sales? Yes. Report a signup as a conversion with an amount of zero and your own id for it. ### Will Transformer's numbers match my analytics? Not always. Transformer's terms note that click and sale counts may differ from a brand's own analytics, for example because repeat clicks and bots are filtered. --- # What are the Transformer CLI and REST API? URL: https://www.northbayventures.com/transformer/cli-and-api/ Updated: 2026-11-03 The REST API at https://transformer.gg/api/v1 exposes everything the dashboard does as JSON over HTTPS, and the transformer command-line tool maps each command to one of those API calls. Both use a workspace API key, so scripts, CI jobs and agents can run either side of the marketplace. ## How do I install the CLI? Transformer publishes an install script: curl -fsSL https://transformer.gg/install | sh transformer login transformer login asks for a workspace API key and stores it locally. In CI or an agent sandbox, set the TRANSFORMER_API_KEY environment variable instead. ## What can the CLI do? | Command | Side | What it does | transformer me | Either | Shows the workspace the key acts for | transformer creators search | Brand | Searches creators | transformer offers create … | Brand | Sends an offer with creator, deliverable, payout, link and ask | transformer offers list --status sent | Either | Lists offers by status | transformer offers accept | Creator | Accepts an offer | transformer submit | Creator | Submits a published X post for verification | transformer conversions report … | Brand | Reports a sale with a click id, amount and order id | transformer stats | Either | Shows clicks, conversions, revenue and commission ## How does REST authentication work? Every request carries a workspace key as a bearer token: Authorization: Bearer tf_live_…. Keys are created on the workspace page and shown once. A key acts for exactly one workspace, and the workspace's kind decides what it can do: brand keys search creators, send, pay for and cancel offers and report conversions; creator keys accept or decline offers and submit posts. Keep keys on the server and never ship one to a browser or mobile app. ## Which endpoints matter most? - GET /me: the workspace behind the key, and totals. - GET /creators?q=: creators with a connected X account, up to 50 results. - POST /offers and GET /offers: create and list offers. - POST /offers/{id}/accept, /decline, /cancel: change an offer's state. - POST /offers/{id}/submissions: submit a post URL for verification. - POST /visits and POST /conversions: record landing-page visits and sales. - GET /offers/{id}/stats: results for one offer. - GET /balance, /payout-methods, /payout-requests: creator payouts. All amounts are in US dollars. The full reference is in the developer docs. ## How are errors reported? Errors come back as JSON with an error message and a matching HTTP status: 400 for invalid input, 401 for a missing or revoked key, 403 when the key is on the wrong side, 404 when something isn't found or isn't yours, 409 when the offer's state doesn't allow the action, 422 when a post fails verification and 429 when you're rate limited. ## Are webhooks available? Not yet. Transformer lists push events for offer changes, verifications and conversions as coming later. Until then, poll the offers list and each offer's stats. If your tool speaks MCP, see agents and MCP instead. ## What does a typical brand script do? A simple brand integration follows the offer lifecycle: - Create an offer with POST /offers, giving the creator's handle, title, ask (the brief field), URL, deliverable, quantity, payout and optional commission. - Share the returned invite link if the creator isn't on Transformer yet. - Poll GET /offers?status=… to see when offers are accepted, submitted and verified. - Report sales from your checkout code with POST /conversions. - Read GET /offers/{id}/stats to compare creators. ## Frequently asked questions ### Is the API free to use? Yes. API keys, the REST API, the MCP server and the CLI carry no charge. The only fee is the 20% platform fee on payouts and commission. ### Is reporting the same sale twice a problem? No. Order ids are unique per offer, so reporting the same order again is ignored and retries are safe. ### Can I use the API for both brand and creator work? Yes, with separate keys. Each key belongs to one workspace, and a workspace is either a brand or a creator. ### Can the CLI run in CI? Yes. Set the TRANSFORMER_API_KEY environment variable instead of running transformer login, and every command calls the matching REST endpoint. ### What does a 409 error mean? The offer isn't in a state that allows the action, for example accepting an offer that is no longer sent. It's also returned with the code tax_form_required for a payout above the yearly tax-form threshold. --- # How do creator payouts work on Transformer? URL: https://www.northbayventures.com/transformer/creator-payouts/ Updated: 2026-11-03 Creators keep 80% of every payout and of any sales commission, credited to their balance as soon as the post is verified on X. Creators request a payout from $10 and are paid by PayPal or USDC, usually within 3 business days; until they request, earnings wait in their balance. ## How much of the payout does a creator keep? 80%. Transformer keeps 20%. There are no sign-up fees, subscriptions or payout fees for creators. | Brand pays | Creator earns | $50 | $40 | $125 | $100 | $250 | $200 | $625 | $500 If the offer includes a commission, the creator also earns 80% of it, credited per sale the brand reports through the creator's link. A 10% commission on a $100 sale is $10: $8 to the creator and $2 to Transformer. ## When is money credited? The brand pays once the creator accepts, and the payout is held from then on. When every deliverable passes verification, the creator's 80% moves to their available balance. Earnings from offers that aren't verified yet show as pending. For an offer that covers several deliverables, the payout is released once all of them have passed. Commission is added separately, for each sale the brand reports. ## How are payouts sent? By PayPal or USDC, on Solana or Base. Add a PayPal email or a USDC address in your payout settings, then request a payout of $10 or more. You're usually paid within 3 business days, and the platform pays the transfer fees. Until you request, earnings simply wait in your balance. Check your details carefully: Transformer's terms say a payout sent to the details you gave is final. ## What are the payout rules? - Minimum: $10. You can request some or all of your available balance. - Fees: Transformer pays the payout fees, so there are no payout fees for creators. - Security hold: a request made within 24 hours of changing your payout details is held for a check. - Cancelling: you can cancel an unpaid request, and the amount returns to your balance. ## Do I need a tax form? Only once your payouts in a calendar year reach the tax-form threshold. Then you need a form on file before the next payout: a W-9 if you're a US person, or a W-8BEN if you're not. You fill it in on Transformer and sign with your typed name. Creators are responsible for their own taxes, and this page isn't tax advice. ## Can an agent request payouts for me? Yes. With a creator workspace key, an agent can check your balance, list earnings, add a payout method and request or cancel payouts over MCP, the CLI or the REST API. See agents and MCP. ## What does my balance show? Your balance separates money by stage, so you always know what you can withdraw: | Figure | Meaning | Pending | Earnings from offers that aren't verified yet | Available | Credited earnings minus what's been paid or requested | Requested | Payout requests that haven't been sent | Paid | What you've received, this year and in total It also shows the minimum payout and whether a tax form is needed. ## Frequently asked questions ### What is the minimum payout on Transformer? $10. ### How do I add a payout method? Add a PayPal email or a USDC address (Solana or Base) in your payout settings, then request a payout of $10 or more. ### Does Transformer charge creators to withdraw? No. Transformer pays the payout fees, and there are no payout fees for creators. ### Is a payout reversible? Transformer's terms say a payout sent to the details you gave is final, so check them carefully. ### How do I know the brand will pay? The brand pays after you accept and before you post; you can't submit a post until it has. Once paid, the money is held, and it's released by the verification check, not by the brand's say-so. --- # Transformer FAQ URL: https://www.northbayventures.com/transformer/faq/ Updated: 2026-11-03 Transformer is an influencer marketplace where brands pay creators for posts on X, with payment held until each post is verified and tracked links that tie clicks and sales to creators. Below are short answers to the questions people ask most, each linked to a fuller explanation. ## What are the key facts about Transformer? | Question | Short answer | What is it? | A marketplace for paid, verified creator posts, usable by people and AI agents | Networks | X today; more later | Fee | 20% of each payout and commission; creators keep 80% | Subscription | None, except the optional AI persona add-on | Payment | Paid when a creator accepts, held, released on verification | Minimum payout | $10, by PayPal or USDC | Agent access | MCP server, CLI and REST API | Operator | North Bay Opco I, Inc., Miami, Florida ## How does a Transformer deal work, in brief? A brand sends an offer to a creator's X handle with an ask, a link, a deliverable and a payout. The creator accepts and gets a personal link, the brand pays so the money is held, and the creator posts on X in their own words with X's Paid partnership label on, and submits the post URL. Transformer checks the post and releases the payout, and the creator's 80% is credited to their balance. See how Transformer works. ## What are Transformer's current limits? - Paid offers and verification are on X only for now. - Webhooks aren't available yet. - Creator payouts are by PayPal or USDC. ## Where can I read more about each topic? - The full flow: how Transformer works - Costs: pricing and fees - Getting paid: creator payouts - Verification: pay on verified posts - Agents: agents and MCP - Disclosure: sponsored-post disclosure Transformer also publishes a summary for AI tools at transformer.gg/llms.txt and articles on its blog. ## Frequently asked questions ### What is Transformer? An influencer marketplace where brands pay creators to post on X. The brand's payment is held until the post is verified, and each offer has a tracked link for clicks and sales. AI agents can run either side. ### How much does Transformer cost? Nothing up front. There's no subscription, seat fee or minimum. The brand sets each payout; creators keep 80% and Transformer keeps 20%, and the same split applies to sales commission. ### Which social networks does Transformer support? X (Twitter) today. Transformer says other networks are planned. ### How do creators get paid? When a post is verified, the creator's 80% is credited to their balance. They request a payout from $10 and are paid by PayPal or USDC, usually within 3 business days. ### What does Transformer check before paying? That the post is live on X, from the creator's own account, contains the offer's link and carries X's Paid partnership label (#ad in the text counts only where X doesn't show the label). Video offers must contain a video. ### What happens if a creator never posts? Nothing is released to the creator. If the creator declines, the offer expires or the brand cancels before acceptance, the money goes back to the brand's balance. After acceptance, either side can open a dispute and an admin releases or refunds the payment. ### Does Transformer post for creators or read their DMs? No. Sign in with X is read-only. Transformer doesn't post, doesn't read direct messages and doesn't store long-lived X tokens. ### Can an AI agent run a campaign? Yes. With a workspace key or an MCP sign-in, an agent can get suggested creators, send offers, pay for accepted ones, track verification and report sales. Creators can use agents to triage and accept offers and submit posts. ### Do brands write the posts? No. Brands send an ask, not a script. Creators write their own posts in their own voice. ### How are sales attributed to a creator? The tracked link adds a tf_click id to the brand's URL. The brand reports each sale from its server with that id, and any commission is credited to the creator. ### What are AI influencers on Transformer? An optional add-on for running AI personas that are clearly labeled as AI. It costs $29 a month per persona with 200 generation credits; creating one to try is free. ### Are there webhooks? Not yet. Agents and integrations poll offers and stats for now. ### Do creators need a tax form? Only once their payouts in a calendar year reach the tax-form threshold: a W-9 for US persons or a W-8BEN for everyone else, filled in on Transformer. ### Who operates Transformer? North Bay Opco I, Inc., a Delaware corporation in Miami, Florida, part of the North Bay Ventures studio. Support is at support@transformer.gg. --- # How do brands use Transformer? URL: https://www.northbayventures.com/transformer/for-brands/ Updated: 2026-11-03 Brands use Transformer to pay creators on X for honest posts about their product, with the money held until each post is verified. Each creator gets a tracked link, so the brand can compare clicks, signups and sales across creators and re-book the ones that work. ## What does a brand get from Transformer? - Offers to any X handle, with an ask, a link, a deliverable and a payout. Brands paste their website, get suggested X creators matched to it, and send each an offer with the price and ask prefilled, so there's no brief to write. - Pay on accept: sending offers is free; you pay only when a creator accepts, the money is held, and it's released only after the post is verified. - Automatic verification that the post is live, from the right account, with your link and a disclosure. - Tracked links and conversions, so clicks and sales are attributed to the creator who drove them. - Agent access over MCP, a CLI and a REST API, at no extra cost. ## How do brands find and price creators? Brands can address an offer to any X handle, or search creators who have connected X to Transformer by topic or handle. Creators can publish a profile with niches and a rate card. Suggested prices start from default follower tiers: | Followers on X | Suggested price starts at | Creator receives (80%) | Under 5,000 | $50 | $40 | 5,000–24,999 | $125 | $100 | 25,000–99,999 | $250 | $200 | 100,000–499,999 | $625 | $500 | 500,000+ | Set per creator | 80% of the agreed price These are starting points, not flat prices. Each creator's suggested price sits within their tier's band, moving up for creators with stronger views per follower and engagement, and it's shown as a range. Brands can save their own tiers, and the brand sets the final price on each offer. Source: Transformer's sponsored post rates by follower count. ## What does a campaign cost a brand? The cost of a campaign is the sum of its offers. There's no subscription, seat fee or minimum, and Transformer's 20% comes out of each payout rather than being added on top. At the starting price of the 5,000–24,999 tier, ten posts cost $1,250; creators with stronger views and engagement are suggested at more. If you add a sales commission, it's split the same way. See pricing and fees. ## How does a brand avoid paying for posts that never happen? You pay only for offers a creator accepts. The payout is held from the moment you pay and released only when Transformer verifies the post on X. If the creator declines, the offer expires, or the post never passes verification, the money goes back to your Transformer balance for your next offer. Details are in pay on verified posts. ## How does a brand measure results? Each accepted offer gets a tracked link. Clicks are counted, and the visitor arrives on your site with a tf_click id. Your backend reports each sale or signup with that id, and Transformer shows clicks, conversions, revenue and commission per offer. Brands with their own per-creator landing pages can record visits server-side or with a pixel. See attribution. ## Can a brand hand the work to an AI agent? Yes. A brand workspace key lets an agent get suggested creators, send offers, pay for accepted ones, track verification and report conversions. Sending costs nothing, so budget is committed only at the payment step after a creator accepts. See agents and MCP. ## What makes a good ask? Short. There's no brief to write: an ask is one or two sentences on what to post about, plus your link. Transformer prefills it from your website when you set up an offer, so most brands only adjust the wording. The ask is guidance, not a script. Creators write their own posts in their own words, with X's Paid partnership label on, and the tracked link shows what each one drove. ## Frequently asked questions ### Can brands sign up on their own? Yes. A brand can sign in, create a brand workspace and send offers straight away. Nothing is charged until a creator accepts; the brand can then pay for several accepted offers at once. ### Can a brand write the post for the creator? No. Transformer works on an ask, not a script. The brand gives talking points and must-haves, and the creator writes the post in their own words. ### Does Transformer guarantee results? No. Its terms say it doesn't guarantee any number of clicks, sales or offers. It guarantees the process: payment is released only for verified posts. ### Can a brand reuse a creator's post in paid ads? Not by default. Transformer's terms let the brand link to, embed and share the post as published; wider use such as paid ads needs a separate agreement with the creator. ### Can a brand send an offer to a creator who isn't on Transformer yet? Yes. Offers can be addressed to an X handle or an email, and each offer has an invite link the brand can share. The creator who accepts must own that handle. --- # How do creators earn on Transformer? URL: https://www.northbayventures.com/transformer/for-creators/ Updated: 2026-11-03 Creators sign in with X, accept the brand offers they like, post in their own words with the link and X's Paid partnership label, and keep 80% of the payout once the post is verified. The brand pays after you accept and before you post, so the money is held before you do any work. ## How does a creator get started? - Sign in with X. Transformer asks for read-only access. - Fill in your profile. Add a headline, your niches and, if you want, a rate card for posts, threads and videos. You can be listed or hidden. - Review offers. Each one shows the ask, the link, the deliverable, and what you'll earn. - Accept, then post and submit. The brand pays within 72 hours of your acceptance. Once it has, post from your own account within 7 days and paste the post URL. - Get credited and withdraw. Your 80% moves to your balance. Add a PayPal email or a USDC address (Solana or Base) and request a payout from $10. ## How much does a creator earn? You keep 80% of what the brand pays, and 80% of any sales commission. There are no sign-up fees, subscriptions or payout fees for creators. Suggested prices start from default follower tiers: | Your followers on X | Suggested price starts at | You earn (80%) | Under 5,000 | $50 | $40 | 5,000–24,999 | $125 | $100 | 25,000–99,999 | $250 | $200 | 100,000–499,999 | $625 | $500 Within your tier's band, your suggested price moves up with your views per follower and engagement, and brands see it as a range. The brand sets the final price, and can offer more, for example for threads and videos or a strong audience fit. Accounts with 500,000 or more followers are priced individually. Source: Transformer's sponsored post rates by follower count. Commission works the same way. If an offer pays 10% on tracked sales, each $100 sale your link drives adds $10, of which you keep $8. Commission is credited for each sale the brand reports. ## Is it safe to connect my X account? Transformer's sign-in with X requests read access only. It can't post for you, doesn't read your direct messages and doesn't keep long-lived X tokens. It uses public data to check your posts. You can disconnect from your workspace or from X's settings at any time. The X permissions requested are limited to reading posts and your user profile, which is what verification needs. ## Do I have to follow a script? No. Brands send an ask with what they want covered and the must-haves; you write the post yourself. Transformer's terms ask creators to post honestly and reflect their real experience, and they let brands suggest topics but not script false claims. Turning down offers that don't suit your audience is normal. ## What must every sponsored post include? The offer's link, with X's Paid partnership label turned on. Transformer checks both before releasing payment. Transformer's verification checks for that label; #ad in the text counts only where X doesn't show it. See disclosing sponsored posts. ## Can an agent manage my deals? Yes. With a creator workspace key, an agent can sort incoming offers by your rules, accept or decline them, submit the URLs of posts you published, and check your earnings and balance. It can't post on X for you. See agents and MCP. ## How do I keep my audience's trust? Your recommendations are only worth paying for while your followers believe them. Transformer's advice to creators comes down to three habits: promote only things you've actually tried, say what you didn't like as well as what you did, and turn down offers that don't fit your audience. Fewer, better sponsorships keep each one credible. ## Frequently asked questions ### Do I need a lot of followers? No. Transformer's default tiers start under 5,000 followers, and brands often care more about audience fit and engagement than size. ### When do I get paid? Your 80% is credited when your post is verified. Payout requests start at $10 and are paid by PayPal or USDC, usually within 3 business days. ### Can I set my own price? You can publish a rate card on your profile. The brand sets the payout on each offer, and you accept or decline it. ### How long do I keep the post up? Transformer's terms say at least 30 days, unless the offer says otherwise. ### What kinds of posts can an offer ask for? A single X post, an X thread or an X post with a video. One offer can cover up to 20 of them, and video offers are checked for a video. ### Can creators outside the US use Transformer? Payouts are paid by PayPal or USDC, and non-US creators file a W-8BEN once they reach the yearly tax-form threshold. Transformer's terms exclude people in comprehensively sanctioned countries. --- # How should sponsored posts be disclosed? URL: https://www.northbayventures.com/transformer/ftc-disclosure/ Updated: 2026-11-01 A paid post should say it's paid, in plain words like #ad or "sponsored", placed where people will see it. On Transformer the creator adds that disclosure plus X's own Paid Partnership label, and Transformer checks for X's label before it releases payment. ## Why disclose at all? In the US, the Federal Trade Commission's Endorsement Guides expect influencers to disclose a financial or other material connection to a brand, and similar rules exist in other countries. Disclosure also protects the creator's credibility: audiences generally accept paid posts from people they trust as long as the relationship is open. This page is general information, not legal advice; check the rules that apply to you. Disclosure is also part of the deal on Transformer. The terms require creators to label every paid deliverable and place the label where people will see it, and the service may decline to verify a post without one. ## What makes a disclosure clear? - Plain words. "Ad", "sponsored" or "paid partnership" are clear. Vague tags such as "sp" or "collab" aren't enough. - Easy to see. Put it in the post where readers will notice it, not buried in a pile of hashtags. - Every time. Each paid deliverable needs its own disclosure. - Honest content. Only make claims you can support, about products you've actually tried. On a short X post, putting #ad near the start or right next to the link is an easy way to make sure nobody misses it. ## What does X require? X has a Paid Partnerships Policy. Transformer's guidance says that since March 2026 the policy requires X's built-in Paid Partnership label on sponsored posts. You switch it on in the composer's content disclosure settings, and it can be added afterwards from the post's menu. Use it together with the in-text disclosure. ## What does Transformer check for? X's Paid partnership label. Transformer's verification checks that the post carries the label, along with the offer's link. An in-text disclosure such as #ad counts only where X doesn't report the label. A post without the label fails verification, and the creator can fix it and resubmit. Putting #ad at the start of the post as well is still good practice, and it's what Transformer's own disclosure guide recommends. ## What are brands responsible for? Transformer's terms say brands must not ask creators to hide a paid relationship, and may suggest talking points but not script false statements. Good asks list the link, #ad and the Paid partnership label as must-haves, and let creators say what they didn't like. See Transformer for brands. ## Does this apply to AI personas? Yes. Transformer requires AI personas to be clearly labeled as AI, and their paid posts still need a paid-post disclosure. See AI influencers. ## What does a well-disclosed post look like? Think of it as four parts. First, the creator's honest take in their own words: what they tried and what they thought. Second, the offer's link. Third, a plain disclosure such as #ad, placed where readers will see it rather than hidden at the end of a long string of hashtags. Fourth, X's Paid Partnership label switched on. A post with all four passes Transformer's check and leaves no doubt for readers about the paid relationship. ## Frequently asked questions ### Is #ad enough on its own? Not on Transformer. Its verification checks for X's Paid partnership label, and #ad in the text counts only where X doesn't report the label. Use both: #ad at the start of the post and the label turned on. ### Do small accounts need to disclose? Yes. Disclosure depends on the paid relationship, not on follower count. ### Will Transformer pay me if I forget #ad? Not until the post passes. Verification fails without a disclosure; you can fix the post and submit it again. ### Is this legal advice? No. It's general guidance. For your specific situation, read the FTC's guidance and X's policy or ask a lawyer. ### Does #ad make a post less effective? Transformer's view is that disclosure protects the creator's credibility, and audiences generally accept paid posts from creators they trust when the relationship is honest. ### What relationships need disclosing? Transformer summarizes the FTC's guidance as covering any financial, employment, personal or family relationship with a brand, not just cash payments. --- # How do you get started with Transformer? URL: https://www.northbayventures.com/transformer/getting-started/ Updated: 2026-11-03 Sign in at transformer.gg, create a brand workspace if you send offers or a creator workspace if you receive them, and you're ready for your first offer. If you want an agent to do the work, create a workspace API key or connect your MCP client and sign in. ## How do I create an account? Go to transformer.gg/login and sign in with email, Google, GitHub or X. You must be at least 18, or the age of majority where you live if that's higher. One person can run several workspaces. Creators will want to use X or connect X afterwards, since offers are addressed to X handles and verification needs the connected account. ## Which workspace should I create? | You want to… | Create | Next step | Pay creators to post about your product | A brand workspace | Send offers | Get paid to post on X | A creator workspace | Connect your X account A workspace is either a brand or a creator. People join workspaces as members, and agents act for a workspace through its keys. A creator workspace has one connected X account. If you need both roles, create one of each. If you're testing with an agent, create a separate API key for each agent or environment so you can revoke one without affecting the others. ## What does a brand do first? - Create the brand workspace. - Paste your website to get suggested X creators, then send an offer with the price and ask prefilled: the creator, the link, the deliverable and the payout. - Pay when a creator accepts. Sending is free; you have 72 hours after acceptance to pay, from your balance first, then card or bank. - If you'll track sales, read the tf_click id on your site and report conversions from your server (see attribution). If the creator isn't on Transformer yet, share the offer's invite link with them. ## What does a creator do first? - Connect X with read-only access. - Fill in your profile and choose whether it's listed. - Accept an offer addressed to your handle. Your X account must match that handle. - Post on X from your account with the offer's link and X's Paid partnership label on. - Once the brand has paid, post and submit the post URL. Add PayPal or a USDC address to withdraw from $10. ## How do I connect an agent? On the workspace page, create an API key. It's shown once and starts with tf_live_; store it as TRANSFORMER_API_KEY. Then pick one: - MCP: point your client at https://transformer.gg/mcp. Clients that support sign-in can skip the key and sign in instead. - CLI: curl -fsSL https://transformer.gg/install | sh, then transformer login. - REST: call GET https://transformer.gg/api/v1/me with the key as a bearer token to confirm which side you're on. More in agents and MCP and CLI and API. ## What does it cost to start? Nothing to sign up. Brands pay only for offers a creator accepts, and Transformer's 20% fee comes out of that payout. Creators pay nothing and keep 80%. The API, MCP server and CLI are free. The only subscription is the optional AI persona add-on. See pricing and fees. ## What should I check before the first offer? | Brands | Creators | The link goes to the right page | The offer was sent to your handle | The ask lists facts that must be accurate | The brand has paid before you post | The deliverable and quantity are right | You're happy to say something honest about the product | Sales reporting is ready if you add a commission | You know where the link goes and that the Paid partnership label is on ## Frequently asked questions ### Does signing up cost anything? No. The marketplace has no subscription; brands pay only for offers a creator accepts, and creators pay nothing to join. ### Can I be both a brand and a creator? One person can run several workspaces, so you can have a brand workspace and a creator workspace. Each API key acts for only one of them. ### Where do I get help? Email support@transformer.gg, or read the quickstart in Transformer's developer docs. ### Can I hide my creator profile? Yes. Profiles can be listed or hidden, and creators can remove their directory profile. ### Which MCP clients work with Transformer? Any client that speaks MCP over streamable HTTP. Transformer names Claude, Claude Code, ChatGPT and Cursor among the clients that support sign-in. --- # How does Transformer work? URL: https://www.northbayventures.com/transformer/how-it-works/ Updated: 2026-11-03 A brand sends a creator an offer, pays for it once the creator accepts, the creator posts on X in their own words with the tracked link and X's Paid partnership label, Transformer verifies the post, and the held payout is released. The creator keeps 80%, and every click and reported sale is tied back to the offer. ## What happens at each step? | Step | Who | What happens | 1. Offer | Brand | Pastes its website, picks from suggested X creators and sends an offer with the ask, the link to promote, the deliverable, the payout and an optional sales commission | 2. Accept | Creator | Accepts and gets a personal tracked link. Nothing has been charged yet | 3. Pay and post | Brand, then creator | The brand pays within 72 hours, from its balance first, then card or bank, and the money is held. The creator then posts on X from their own account with the link and the Paid partnership label on, within 7 days of the payment | 4. Verify | Transformer | Checks the submitted post URL against public X data | 5. Pay | Transformer | Releases the payout; the creator's 80% goes to their balance Either side can do these steps in the dashboard or let an agent do them. The flow is the same. ## What goes into an offer? An offer is a short, explicit agreement. It names the creator (by X handle, email or creator workspace), gives a title and an ask (the API calls it the brief), and sets: - The link to promote. Transformer turns it into a tracked link, or uses the brand's own landing page for that creator. - The deliverable: an X post, an X thread or an X post with video, in a quantity from 1 to 20. - The payout in US dollars, plus an optional commission of 0–50% on tracked sales. - An expiry: unanswered offers expire after 7 days by default, and the brand can choose 1–90 days. The ask is guidance, not a script. Creators write their own posts. ## What states does an offer move through? The normal path is sent → accepted → submitted → verified → paid. An offer can also end as declined by the creator, cancelled by the brand before it's completed, or expired if nobody answers. Separately, each offer has a payment status: unfunded, funded, released, paid out or refunded. Offers go out unpaid. After a creator accepts, the brand has 72 hours to pay, with reminders at 24 and 60 hours; if it doesn't, the offer is cancelled and the creator is told. A creator can't submit a post until the brand has paid. ## How is the post verified? When the creator submits a post URL, Transformer checks it on X. The post must be live and public, published from the account the offer was sent to, contain the offer's link and carry X's Paid partnership label (#ad in the text counts only where X doesn't show the label). Video offers must also contain a video. If a check fails, the creator sees why and can fix the post and resubmit. Read more in paying for verified posts. ## What happens to the money? Once every deliverable passes, the held payout is released and the creator's 80% is credited to their Transformer balance. Creators request a payout from $10 and are paid by PayPal or USDC (see creator payouts). If the offer is declined, expires, or is cancelled before the creator accepts, nothing is released and the money goes back to the brand's balance for its next offer. ## How are clicks and sales tracked? When a creator accepts, the offer gets a tracked link that counts clicks and forwards visitors to the brand's page with a tf_click id. The brand reports sales from its own server with that id, and any commission is calculated per sale. See attribution. ## Frequently asked questions ### How long does verification take? Transformer says verification usually takes seconds after the creator submits the post URL. ### Can a brand cancel an offer? A brand can cancel an offer that hasn't been completed. Under Transformer's terms, once a creator accepts, cancelling needs both sides to agree. ### How long must a verified post stay up? Transformer's terms say a creator keeps a verified post up for at least 30 days unless the offer says otherwise. ### Can one offer cover several posts? Yes. An offer can cover 1 to 20 deliverables, and the payout is released when all of them are verified. ### Do agents follow the same steps? Yes. An agent with a workspace key goes through the same offer, payment, submission and verification steps as a person in the dashboard. It just makes the calls through MCP, the CLI or the REST API. ### What happens if the creator never answers? The offer expires after its expiry period, 7 days by default, and any held payout goes back to the brand's balance. --- # What is Transformer? URL: https://www.northbayventures.com/transformer/ Updated: 2026-11-03 Transformer (transformer.gg) is an influencer marketplace where brands pay creators to post about their products on X, and the payment is released only after the post is verified. Both sides can work in a web dashboard or hand the job to an AI agent through an MCP server, a command-line tool or a REST API. ## What does Transformer do? Transformer connects brands that want people to talk about their product with creators whose audiences are a good fit. A brand sends an offer to a creator's X handle. The creator accepts, writes the post in their own words with X's Paid partnership label on, and submits the post's URL. Transformer checks the post on X and, once it passes, releases the money the brand set aside. Every accepted offer also gets its own tracked link, so the brand can see the clicks each creator drove and report the sales that followed. That makes creator marketing something you can measure per person, not just a feeling. ## Who is Transformer for? There are two sides, and either side can be a person or an AI agent acting for that person. | Side | What they do on Transformer | Read more | Brands | Find creators, send offers, pay for accepted ones, track clicks and sales | Transformer for brands | Creators | Receive offers, post in their own voice, get paid after verification | Transformer for creators | Agents | Run either side over MCP, the CLI or the REST API with a workspace key | Agents and MCP ## Which social networks does Transformer support? X (formerly Twitter) is the only network for paid offers today. Transformer says more networks will follow, but every offer, deliverable and verification described on its site is for X: a single post, a thread or a post with a video. ## How much does Transformer cost? The marketplace has no subscription, no seats and no minimum spend. The brand sets the payout for each offer; the creator keeps 80% and Transformer keeps 20%. The same split applies to any commission on sales. The only subscription is an optional add-on for running AI personas. See pricing and fees for the details and a worked example. ## What can I read in this guide? These pages explain Transformer one topic at a time, using facts from Transformer's own site: - How Transformer works: offer, post, verify, pay - Transformer for brands - Transformer for creators - Running campaigns from an AI agent over MCP - The Transformer CLI and REST API - Paying creators only for verified posts - Creator payouts: the 80% share and payout methods - Tracking clicks and sales from creator posts - AI influencers and AI personas - Transformer pricing and fees - Disclosing sponsored posts - Working with micro and nano creators - Influencer marketing for startups - Getting started with Transformer - Transformer FAQ ## Who runs Transformer? Transformer is built by North Bay Ventures, a venture studio, and operated by North Bay Opco I, Inc., a Delaware corporation based in Miami, Florida. Its terms of service, privacy policy and developer docs are public, and support is reached at support@transformer.gg. ## How does Transformer protect both sides? The brand pays for an offer once the creator accepts it, and the creator posts only after that payment, so the money is held before they do any work, and Transformer never gets permission to post on their behalf. Brands pay only for posts that pass an automatic check on X, and money from offers that are declined, expire or are cancelled before acceptance goes back to the brand's balance. The rules for fees, verification, payouts and disputes are published in Transformer's public terms rather than negotiated deal by deal. ## Frequently asked questions ### Is Transformer a marketplace or a software tool? A marketplace. Brands and creators make paid deals with each other on it, and Transformer handles the held payment, verification, tracked links and payouts. ### Does Transformer post on a creator's behalf? No. Creators sign in with X using read-only access and publish from their own accounts. Transformer only reads public data to verify the post. ### Can an AI agent use Transformer? Yes. Everything in the dashboard is also available over an MCP server, a CLI and a REST API, and a workspace key lets an agent act for one brand or one creator. ### Where is the official site? At transformer.gg. A plain-text summary for AI tools is published at transformer.gg/llms.txt. ### How is Transformer different from influencer software suites? It's a pay-per-offer marketplace rather than a subscription tool. Brands pay for verified posts on X with no subscription or annual contract, and the whole flow, payments included, is open to agents over MCP and an API. --- # How should a startup do influencer marketing? URL: https://www.northbayventures.com/transformer/influencer-marketing-for-startups/ Updated: 2026-11-03 Start small on the network where your users already talk about products: for many startups, developer tools and B2B products, that's X. Send offers to ten to twenty focused creators, give them an ask instead of a script, pay only for verified posts and measure each creator separately before spending more. ## Why does creator marketing suit startups? A new product has two problems: nobody knows it, and nobody has a reason to trust it yet. A creator brings both attention and a measure of their own credibility. It also fits a small budget. Instead of a large ad spend to learn what works, a startup can send a handful of offers, measure each one and double down on what converts. With AI tools making software faster to build, getting noticed is often the harder part. ## Why start on X? - The tech conversation happens there. Engineers, founders, investors and early adopters discuss tools in public. - Posts are text first, so a creator can explain what a product does in a few lines with a link. - Links are normal, so a tracked link doesn't look out of place. - Posts are public and can be searched, quoted and cited, including in AI answers. X is also the only network Transformer supports for paid offers today. ## Which creators should a startup pick? Look for practitioners rather than personalities: people who build or use products like yours, whose followers are your users, and who would actually try the product. Check who replies to them and who your best users follow. Smaller, focused accounts are often better value; see micro and nano influencers. ## How do you run a first campaign? - List 10–20 creators your users already follow. - Check the ask Transformer prefills from your website: one or two sentences on what to post about, plus your link. Don't write the post. - Set the payout by audience size, and consider a commission on tracked sales. - Send offers and let creators accept the ones that fit. - Ask for honest posts with X's Paid partnership label on. - Pay when each post is verified. - Measure signups or activation per creator, then re-book the best. ## What does a first test cost on Transformer? Just the payouts. There's no subscription, annual contract or minimum. At the starting prices of Transformer's default tiers (stronger creators are suggested at more within each band, and the brand sets the final price): | Test | Total cost | 10 posts, creators under 5,000 followers ($50 each) | $500 | 10 posts, creators with 5,000–24,999 followers ($125 each) | $1,250 | 20 posts, creators with 5,000–24,999 followers | $2,500 Transformer's 20% fee is inside those numbers, not on top. See pricing and fees. Because there's no fixed cost, a startup can stop after the first round without having paid for unused software. If a few creators drive signups, the next round can go to them and to similar accounts. ## Can a small team automate it? Yes. Finding creators, drafting offers, checking posts and reporting results is coordination work. A startup can give an AI agent a brand workspace key and let it run that work over MCP, the CLI or the REST API, while a person approves the spend. See agents and MCP. ## What makes technical audiences tune out? Transformer's playbook for developer tools lists the usual mistakes: - hiding the sponsorship, or using vague tags like "collab"; - scripted, superlative copy; - sponsoring someone who has obviously never used the product; - measuring only likes and views; - betting on one big creator instead of many focused ones. ## Frequently asked questions ### Is influencer marketing worth it for an early-stage startup? Often, because it can start with a small budget, reach a niche audience precisely and show quickly who responds. Give every creator a tracked link so you know what each one delivered. ### Should I let creators criticize my product? Transformer's guidance says yes. Honest posts are more credible, and the criticism is useful feedback. Ask creators to be accurate and to disclose the sponsorship. ### What should a developer-tool startup measure? Activation: how many people from each creator actually tried the product, not just impressions or likes. ### Do I need an annual contract? Not on Transformer. You pay per offer, with no subscription or minimum. --- # Influencer marketing vs paid ads: when does each win? URL: https://www.northbayventures.com/transformer/influencer-marketing-vs-paid-ads/ Updated: 2026-11-03 Paid ads are the better tool when you need reach today and full control over who sees what. Influencer marketing is the better tool when you need trust and a specific community, because the message comes from a person the audience chose to follow. Most teams get the best results by using creators to find what works and ads to scale it. ## How do they compare side by side? | | Paid ads | Creator posts | Who speaks | The brand | A creator, in their own words | Trust | Read as advertising | Borrowed from the creator, with X's Paid partnership label | Targeting | The ad platform's audience data | The creator's niche and followers | Time to start | Minutes | Days, while creators accept and post | How you scale | Raise the budget | Add more creators | Who makes the content | You | The creator, from your ask | Measurement | Built into the ad platform | Tracked links and reported sales ## When do paid ads win? Ads win when speed and control matter most. You can set a budget and start showing ads the same day, turn spend up or down at will, and retarget people who already visited your site. Testing creative and bidding are built into every major ad platform. ## When does influencer marketing win? Creator posts win when the audience is hard to reach or slow to trust. A recommendation from someone you follow lands differently from an ad, and it shows up in the feed people chose rather than in an ad slot they skip. - Niche audiences. Developers, founders and other specialist groups often follow a small set of people closely. One post from the right creator reaches them directly. See why micro and nano creators work. - Real language. On Transformer, brands send an ask rather than a script, so creators describe the product in their own words. The posts that perform show you how customers actually talk about it. - Public mentions. A post stays up after the campaign, where people can find it later. ## Which one is cheaper? Compare them on cost per customer, not on impressions. Add up what you paid, divide by tracked sales, and set that next to the same number from your ad account. Transformer keeps the creator side simple to count. There is no subscription, seat fee or minimum: a campaign costs the sum of its offers, and the 20% platform fee is inside each payout rather than on top. Suggested prices start from default follower tiers ($50 under 5k, $125 for 5–25k, $250 for 25–100k, $625 for 100–500k) and move up within the band for creators with stronger views and engagement. The brand sets the final price (source: Transformer's sponsored post rates by follower count). Brands pay only for offers a creator accepts; the payment is held and released only when the post is verified live on X with the tracked link and X's Paid partnership label; money from offers that are declined, expire or are cancelled before acceptance goes back to the brand's balance. Full details are on Transformer pricing and fees. ## How do you measure creator posts like ads? Each accepted offer on Transformer gets a tracked link that adds a tf_click id to your URL. Your backend reports each sale to the conversions API, and Transformer attributes it to the creator who drove it. An offer can also pay a commission on sales, from 0 to 50%, split 80/20 like the payout. See how clicks and sales are tracked. ## How do you use both together? - Test with creators. Send offers to several creators in your niche and see which audiences and angles bring sales. - Scale the winners with ads. Put ad budget behind the messages and audiences that worked. - Retarget creator traffic. People who arrived through a creator's link already know the product. - Measure both the same way. Move budget to whichever channel costs less per customer. Because Transformer has an API, a CLI and an MCP server, an agent can run the creator side much like an ad campaign: send offers, pay for accepted ones, track verification and read results. See running a campaign from an AI agent. ## Frequently asked questions ### Is influencer marketing better than paid ads? Neither wins every time. Creators tend to win on trust and niche reach, ads on speed, control and retargeting. Compare them on cost per customer for your product. ### Can I run creator posts and ads at the same time? Yes, and they work well together. Use creators to learn what resonates, then put ad budget behind it. ### Can I reuse a creator's post in my ads? Transformer's terms let a brand link to, embed and share the post as published. Using it in paid ads needs a separate agreement with the creator. ### Which networks does Transformer support? X (Twitter) today, with more networks planned. --- # Why work with micro and nano influencers? URL: https://www.northbayventures.com/transformer/micro-influencers/ Updated: 2026-11-03 Smaller creators often give brands more for the money, because engagement tends to fall as follower counts rise and small audiences are usually more focused on one topic. For most brands, a group of micro and nano creators on X, each with their own tracked link, is a better first campaign than one large influencer. ## What counts as nano, micro, macro and mega? There's no official definition, and sources draw the lines differently. A common split is: | Tier | Followers | Typical strength | Nano | 1,000–10,000 | Close-knit audience, high trust, low cost | Micro | 10,000–100,000 | A focused niche with strong engagement | Macro | 100,000–1,000,000 | Reach plus some niche credibility | Mega | 1,000,000+ | Mass reach ## Why do smaller creators often perform better? Industry benchmarks keep finding that the share of followers who like, reply or click drops as accounts grow. The exact numbers vary a lot between platforms and the companies measuring them, but the direction is consistent. The reasons are simple: - People follow a small account on purpose, because they care about its topic. - Smaller creators tend to reply to their audience, so a recommendation feels personal. - Niches are sharper. A few thousand followers who all work in one field can be worth more to a product in that field than a much larger general audience. ## How much do smaller creators cost on Transformer? Prices scale with audience size, so smaller creators cost less per post. That lets a brand spread a budget across many creators, test more audiences and avoid betting everything on one post. Suggested prices for one X post start from default follower tiers, beginning at the small end: | Followers on X | Suggested price starts at | Creator earns (80%) | Under 5,000 | $50 | $40 | 5,000–24,999 | $125 | $100 | 25,000–99,999 | $250 | $200 These are starting points, not flat prices. Each creator's suggested price sits within their tier's band, moving up for creators with stronger views per follower and engagement, and it's shown as a range. Brands can save their own tiers, and the brand sets the final price on each offer. Source: Transformer's sponsored post rates by follower count. The follower count is looked up on X when an offer is drafted. See pricing and fees. ## How should a brand run a micro-creator campaign? - Decide which audience you want, then find the creators that audience already follows. - Send several offers at once, priced by follower tier. - Give every creator the same ask and let each write their own post. - Give each creator their own tracked link so you can compare them (see attribution). - Re-book the creators whose audiences click and buy. Transformer's guidance suggests five to twenty smaller creators for a first test, enough to compare audiences. ## When do larger influencers make sense? Large creators still help with mass-market products, launches that need reach quickly, and brand building where being seen with a well-known name matters. Many brands combine a base of smaller creators for steady, measurable results with occasional larger ones for reach. On Transformer, accounts with 500,000 or more followers have no default price; the brand sets the payout for each one individually. ## Can a small creator get brand deals? Yes. There's no hard minimum. Brands weigh audience fit, engagement, niche credibility, a record of delivering and brand safety alongside follower count. On Transformer, offers start in the under-5,000 tier. A clear niche on your profile and a history of verified, properly disclosed posts both help. See Transformer for creators. Brands typically look at five things: whether your followers are their customers, whether people reply and click, whether you post credibly about their category, whether you've delivered and disclosed sponsored posts properly before, and whether your content is something they're comfortable appearing next to. ## Frequently asked questions ### What is a micro-influencer? Usually a creator with about 10,000 to 100,000 followers who focuses on one topic. Creators with about 1,000 to 10,000 are often called nano-influencers. ### Are micro-influencers more effective than big ones? Often, per dollar spent, because engagement tends to fall as audiences grow and smaller creators cost less per post. Large creators still win when you need mass reach fast. ### How many creators should a first campaign include? Enough to compare. Transformer suggests five to twenty smaller creators, each with their own tracked link. ### What does a five-creator nano test cost on Transformer? At the default tier for accounts under 5,000 followers, five posts start at $250, of which the creators receive $200. ### How do I compare creators fairly? Give everyone the same ask and their own tracked link, then compare clicks, conversions and cost per acquisition rather than likes. --- # How does pay-per-verified-post work on Transformer? URL: https://www.northbayventures.com/transformer/pay-on-verified-posts/ Updated: 2026-11-03 On Transformer the brand pays for an offer once the creator accepts it and before they post, the money is held, and it's released to the creator only after an automatic check confirms the post is live on X, from the creator's account, with the offer's link and a disclosure. If the deal doesn't happen, the money goes back to the brand's balance, so neither side has to trust the other to pay or deliver. ## Why hold the payment? The two usual ways to pay creators each leave one side exposed: | Approach | Who carries the risk | Pay before the post | The brand, if the post is late, missing or leaves out the link | Pay after, on invoice | The creator, who may wait weeks to be paid | Hold, then release on verification | Neither side: the money exists before work starts, and it moves on an agreed check ## What does Transformer check? When the creator submits a post URL, Transformer checks it against public data on X. The post passes when it is: - live and public on X; - published from the creator's own account, the handle the offer was sent to; - carrying the offer's link, as X shows it after expanding t.co links, ignoring the scheme, www., letter case, a trailing slash and the query string; - clearly disclosed with X's Paid partnership label (#ad in the text counts only where X doesn't show the label); - the right format: video offers must contain a video. It doesn't check wording. Creators write in their own voice. ## What are the payment states? | Payment status | Meaning | unfunded | Not paid yet. Offers go out unpaid; after a creator accepts, the brand has 72 hours to pay | funded | The brand has paid and the payout is held; the creator can now post | released | Every deliverable passed; the creator's 80% is credited to their balance | paid_out | The creator has withdrawn it | refunded | The offer was declined, cancelled before acceptance or expired, and the money went back to the brand's balance ## What if a post fails the check? The submission is kept as rejected and the creator is told why, for example a missing link or a missing Paid partnership label. They can fix the post and submit again. Nothing is released until every deliverable passes. Transformer's terms say it may also review deliverables by hand, and either side can ask support to review a decision. ## What if the post is deleted later? Verification happens when the post is submitted. Transformer's terms ask creators to keep a verified post up for at least 30 days unless the offer says otherwise, and its guidance suggests stating any longer period in the ask. ## What does it cost? The brand pays the offer's payout and nothing else. A $250 post costs the brand $250; the creator receives $200 and Transformer keeps $50, which covers the held payment, verification, tracked links and payouts. See pricing and fees. ## Why doesn't verification check the wording? Because the wording is the creator's job. Audiences trust creators who write in their own voice, and posts that read like ad copy tend to lose that trust. So the check sticks to objective facts both sides agree on in advance: the post exists, it's from the right account, it has the link, it's disclosed and it's the right format. What to say is covered by the ask, which gives talking points and must-haves without scripting the post. ## Frequently asked questions ### Is this escrow? It works like escrow: the brand's money is held once it pays for an accepted offer and released only when the post is verified, or returned to the brand if it isn't. ### Can a creator see the money is there? Yes, before posting. The brand pays after the creator accepts, and a creator can't submit a post until that payment is held. ### Does Transformer verify posts on Instagram or TikTok? Paid offers and verification run on X today. Transformer says other networks will follow. ### Can I pay on commission only? Every offer has a payout, which can be small, plus an optional commission of 0–50% on tracked sales. ### Who decides whether a post passes? Transformer's automatic check, which it may back with a manual review. Its terms make the decision final for payment purposes, and either side can ask support to review it. ### How fast is the creator credited? As soon as every deliverable passes. Transformer says verification usually takes seconds after the post URL is submitted. --- # How much does Transformer cost? URL: https://www.northbayventures.com/transformer/pricing-and-fees/ Updated: 2026-11-03 Transformer charges nothing up front: no subscription, no seats and no minimum spend. Brands set the payout for each offer, creators keep 80% of it and of any sales commission, and Transformer keeps 20%. ## What does a single post cost? Here is Transformer's worked example of one X post at $250 with a 10% commission on tracked sales: | Item | Amount | Brand pays for one X post | $250.00 | Creator receives (80%) | $200.00 | Platform fee (20%) | $50.00 | Each $100 tracked sale | $10 commission: $8 to the creator, $2 to Transformer The fee comes out of the payout, so the offer price is the brand's whole cost. Payouts are in US dollars. ## What's included at no extra cost? The 20% fee is the only marketplace charge, whether a person or an agent does the work. It covers: - the web dashboard for brands and creators; - workspace API keys, the REST API, the MCP server and the CLI; - tracked links with click and sale attribution; - per-creator landing pages and the conversion pixel; - post verification on X; - creator profiles with rate cards. None of these are sold as tiers or add-ons. A brand sending its first $50 offer gets the same tools as one sending hundreds, and an agent working over MCP pays exactly what a person in the dashboard pays. ## Who sets the price of a post? The brand, offer by offer. Creators can publish a rate card, and brands can offer that rate or their own; the creator accepts or declines. Suggested prices start from default follower tiers: | Followers on X | Suggested price starts at | Creator earns | Under 5,000 | $50 | $40 | 5,000–24,999 | $125 | $100 | 25,000–99,999 | $250 | $200 | 100,000–499,999 | $625 | $500 | 500,000+ | Custom | 80% of the agreed price These are starting points, not flat prices. Each creator's suggested price sits within their tier's band, moving up for creators with stronger views per follower and engagement, and it's shown as a range. Brands can save their own tiers, and the brand sets the final price on each offer. Source: Transformer's sponsored post rates by follower count. ## When is the brand charged, and what if nothing is posted? Sending an offer costs nothing. The brand pays when a creator accepts, within 72 hours, and the payout is held. It's released only when the creator's post is verified on X. Money from offers that are declined, expire or are cancelled before acceptance goes back to the brand's balance for its next offer; Transformer's terms note that payment-processing fees it can't recover may be deducted. See pay on verified posts. A brand can pay for several accepted offers at once, from its balance first, then card or bank. Once released to a creator, a payout is final except in cases of fraud or a serious breach of the terms. ## Is there anything that costs extra? Only the optional AI persona add-on: $29 a month per persona, including 200 generation credits a month, with extra generation billed from a prepaid wallet at cost plus 20%. Creating a persona to try it is free. See AI influencers. ## What do creators pay? Nothing beyond the 20% share. There are no sign-up fees, subscriptions or payout fees, and Transformer currently pays transfer fees on withdrawals. See creator payouts. ## What does a whole campaign cost? A campaign costs the sum of its offers. At the starting price of each tier (creators with stronger views and engagement are suggested at more): | Campaign | Brand pays | Creators receive | Transformer keeps | 10 posts, under 5,000 followers | $500 | $400 | $100 | 10 posts, 5,000–24,999 followers | $1,250 | $1,000 | $250 | 4 posts, 25,000–99,999 followers | $1,000 | $800 | $200 Commission on tracked sales, if you add it, is extra and split the same 80/20 way. There's no setup fee, seat charge or annual contract on top. ## Frequently asked questions ### Is there a free plan? There's no plan to buy. The marketplace has no subscription; you pay only for offers creators accept, and the 20% fee comes out of those. ### Does the API or MCP server cost more? No. Agents and people pay the same 20% fee on payouts and commission, and nothing else. ### Can the fee change? Transformer's terms say the fee is fixed when an offer is created and shown on it. Changes apply only to future offers, with notice. ### How much does a ten-creator test cost? The sum of the ten payouts. At the starting price of the 5,000–24,999 follower tier, that's $1,250; stronger creators in that band are suggested at more. ### What currency are payouts in? US dollars. Creators are paid by PayPal or USDC. ### Who pays transfer fees on creator withdrawals? Transformer currently pays them. Its terms say it may change who bears transfer fees for future payouts, with notice. --- # Feature flags for AI agents. URL: https://www.northbayventures.com/flagger/ Updated: 2026-10-31 Your agents create, flip and roll back flags through MCP, the CLI and SDKs. Every change has guardrails and an audit trail, and humans approve. Flagger.gg is live: sign up with an email link or Google. ## What is Flagger.gg? Flagger.gg is a feature-flag platform built for teams whose code is increasingly written and shipped by AI agents. A feature flag lets you merge and deploy unfinished work switched off, then turn it on for the right people when it's ready. Flagger.gg is designed so an agent can do that work itself, while a person keeps the final say on anything risky. Jon Oringer, who founded North Bay Ventures, puts it simply: it's a feature flag system for agents, because everything the studio builds is for agents. ## Why do agents need their own feature flags? Coding agents produce more changes, in smaller pieces, more often. Shipping each change switched off behind a flag keeps that pace safe: the deploy is routine, and turning the feature on is a separate, deliberate step. When an agent can create the flag for its own work, turn it on for its team, watch it and roll it back, it can carry a change all the way through without leaving a mess for a person to clean up. The guardrails matter as much as the speed. Every change records who made it, when, what it was before and after, and why. In auto-live mode (the default today) an agent's new flag goes live straight away unless it's marked not ready. Turning approvals on adds a per-environment cap (10% by default in production) above which a human approves in the console. Agents have no approve tool. ## What is it built on? Flagger.gg is built on the flag system that already runs Sandboxer and Transformer in production. That system has five states, from off for everyone to on for everyone, with steps for admins only, named users and workspaces, and a sticky percentage of users in between. A flag that is unknown or can't be loaded counts as off, and work that isn't finished can be marked not ready so it stays off. Read how that works in feature flags instead of staging. Teams that already run flags can bring them along: Flagger.gg imports an app's existing flags with their history, and a shadow mode compares its answers with the existing system before the switch. ## How do I start using Flagger.gg? Sign up at app.flagger.gg with an email link or Google. Each account gets its own organization and a project in auto-live mode, with production and development environments. Apps check flags with the Go and Node SDKs, and agents connect through the hosted MCP server at mcp.flagger.gg or the flagger CLI. There is no public pricing. Some features are still in development, including flags tied to metrics with automatic rollback, experiments, and SDKs beyond Go and Node. The features page and how it works show what is live today. ## How does Flagger.gg fit with Sandboxer and Transformer? All three are built for a world where agents do real work. Sandboxer gives every agent its own computer. Transformer lets agents run creator campaigns. Flagger.gg lets agents ship their changes safely behind feature flags. Each can be used by a person or driven by an agent, and each keeps a person in control of the decisions that are hard to undo. ## Frequently asked questions ### What is Flagger.gg? Feature flags for AI agents. Agents create, flip and roll back flags through MCP, the CLI and SDKs, with guardrails, an audit trail and human approval. ### Is Flagger.gg available now? Yes. Sign up at app.flagger.gg with an email link or Google. There is no public pricing yet. ### Which AI agents work with Flagger.gg? Any agent that speaks MCP, such as Claude Code, Codex and Cursor, through the hosted server at mcp.flagger.gg or the flagger CLI. ### Who makes Flagger.gg? North Bay Ventures, the studio behind Sandboxer and Transformer. It is operated by North Bay Opco I, Inc., a Delaware corporation in Miami.