Access and network
A machine nobody can reach is not an agent. There are four doors in — an HTTPS link, a raw TCP port, SSH, and the provider's API — and the important difference is who can open each one.
Every provider gives you an HTTPS address for a port inside the machine. What differs is the lock. A provider-key link needs an API key or a signed token on every request. A token-in-the-URL link is a password you can paste: convenient, and exactly as safe as the place you pasted it. An open link has no lock at all.
The open case is more common than buyers expect. boxd's name.boxd.sh is public to the internet with no authentication in front of it. InstaBox's public ports are unauthenticated by design. Agent 37's public port is deliberately credential-free and keeps working until you delete it. In each case the URL is the only secret.
The other doors are less visible. SSH is sometimes a real port, sometimes a WebSocket tunnel, sometimes a shell over the provider's own transport. Raw TCP exists at a few providers and is missing at most. The provider's API is always a door, and sometimes the only one.
The claim on the left, the provider's own words on the right
Sandboxer puts a token in the preview URL by default and strips it before the request reaches your app. Lizard uses one token per sandbox, so a link to one port opens every exposed port on that machine. Sprites makes the URL private to the organisation, reachable with an org token.
At boxd and InstaBox the URL is the only credential. Agent 37 goes further and sells an explicitly public port that anyone can reach with no credential at all.
Runtime, boxd and Boat support a raw TCP path; Boat's depends on IPv4, which is not guaranteed. Sandboxer and InstaBox route SSH through a gateway. Lizard has no SSH protocol at all: its ssh command is an interactive shell over the provider's transport, so scp, rsync and port forwarding do not work.
Vercel exposes web ports and bills traffic to them, but a general raw TCP inbound or a personal SSH endpoint is not published.
A URL that wakes a machine is a different product from a URL that returns an error. Sprites, Runtime and InstaBox document wake on request. boxd's bot protection gates the wake: a webhook, API client or uptime monitor gets a 503 check page and the machine does not wake.
Boat cannot wake on a URL at all, because a stop removed the machine.
The details that decide the answer in practice
Who can open the link: only you, anyone you send it to, or anyone who guesses it.
Whether the token is per port or per machine.
Whether a request to a sleeping machine wakes it or returns an error.
Whether raw TCP and SSH exist, and whether SSH is a real port or a tunnel.
Whether the URL survives a stop and resume.
Docs read 28 October 2026
| Provider | Does it? | What that means |
|---|---|---|
| Agent 37 | Yes | Every port gets an HTTPS URL; instance and preview URLs require an API key or a time-boxed signed URL. A public port is deliberately unauthenticated and permanent. SSH is tunnelled; no raw TCP. |
“Instance URLs require auth on every request” | ||
| Blaxel | Partly | Specific ports can be exposed, and preview URLs back a running sandbox with optional auth and custom domains. Default ingress authentication is not published. |
“Render an application in real-time through a direct preview URL backed by a running Blaxel sandbox, with optional auth and custom domains.” | ||
| Boat | Partly | An HTTPS route per port, token-gated by default and --public to remove it; SSH on port 22; raw TCP by opening the sandbox firewall, but only IPv6 is guaranteed. |
“boat does not support custom domains.” | ||
| boxd | Yes | Every machine is on name.boxd.sh with no authentication in front of it; subdomain proxies add ports, up to three raw TCP forwards, and SSH on a dedicated port. Bot protection only gates wake-ups. |
“When a request would wake a sleeping machine, boxd first asks the visitor to pass a quick browser check.” | ||
| E2B | Partly | Public URLs are reachable by anyone who knows them, with no authentication by default. SSH runs through a WebSocket proxy rather than a native port. |
“By default, a sandbox's public URLs are reachable by anyone who knows them.” | ||
| InstaBox | Partly | An HTTPS URL per port, up to 16, with no authentication: the URL is the only secret. SSH and mosh go through a gateway; no raw TCP inbound and no custom domain. |
“It is not a secret: once published, anyone can reach the whole service until you unpublish it.” | ||
| Lizard | Partly | A preview URL per exposed port, gated by one token per sandbox that opens every port on it. WebSockets pass through. No raw TCP, no SSH protocol, no custom domains for sandboxes. |
“The token belongs to the sandbox, not to a port: it opens every port you expose on that sandbox” | ||
| Morph | Partly | An instance can expose an HTTP service through the API. Default authentication and raw TCP support are not published. |
“Expose Http Service” | ||
| Runtime | Yes | Nothing is reachable until you open a door: token-gated previews, custom domains, raw TCP ports, a WireGuard or Tailscale private network, or SSH over the API. |
“Nothing on the internet can connect in to a sandbox. These are the ways in. You open each one yourself” | ||
| Sandboxer | Yes | A stable HTTPS address per port, private by default with a token in the URL; --public removes it. A public IPv6 with the firewall closed except SSH. No raw-TCP endpoint. |
“Private (default) | https://…-3000.box.sandboxer.com?_token=… | Anyone with the full URL.” | ||
| Sprites | Partly | Every Sprite has an HTTPS URL that is private to the organisation by default, reachable with an org token. SSH requires installing a server and proxying it. |
“A Sprite URL is private by default. It's reachable only by members of your org, through the browser or with an org token” | ||
| Vercel Sandbox | Partly | Web ports can be exposed, up to 15 per sandbox, and traffic to them is billable. A general raw TCP inbound, personal SSH or public IPv4 is not published. |
“Data your sandbox sends to the internet, plus all traffic to and from exposed ports, is billable and measured in GB.” | ||
Part of Access and network. Next: put two or three providers side by side.