Connect the assistant’s harness—the component that runs the model and tool loop—to an isolated execution environment through the assistant’s supported executor or tool interface. For OpenAI’s Agents API, that environment can be OpenAI-hosted or self-hosted. Keep orchestration, application credentials, and approval controls in trusted application infrastructure where possible, and give the sandbox only the workspace access, network reach, and scoped credentials the task needs.
Understand the parts before choosing a sandbox
In the OpenAI Agents API architecture, three components have distinct jobs:
- Harness: runs the model and tool loop and maintains session state.
- Environment: runs commands and provides the filesystem where code and files can be read or changed.
- Application server: starts tasks, receives events, handles function tools, and can manage the lifecycle of a self-hosted environment.
A sandbox is useful when an agent must execute code, change files, install or use dependencies, create artifacts, expose a service, or preserve resumable work. It is not automatically necessary for a task that only answers questions or calls remote services; a harness can instead use function tools or remote MCP servers without a built-in shell or workspace. The Agents SDK describes the harness as the control plane and sandbox compute as the execution plane in its sandbox-agent pattern.
Choose the connection pattern that fits the task
| Pattern | Who operates compute | When it fits | Important distinction |
|---|---|---|---|
| No execution environment | No sandbox compute is provisioned. | The agent only needs answers, function tools, or remote services. | There is no built-in shell or mutable workspace. See the Agents API architecture. |
| OpenAI-hosted environment | OpenAI provisions and manages the environment. | The agent needs command execution or a workspace, and managed compute is suitable. | Your application still submits tasks, receives progress and results, and handles any function tools. See environment choices. |
| Self-hosted Agents API environment | Your application provisions compute and manages its lifecycle. | The task needs your infrastructure, private-network access, or custom software. | You connect an executor to the API and handle reconnection, shutdown, and any files that must persist. See self-hosted sandbox setup. |
| Agents SDK sandbox pattern | Your application runs the harness and provides or connects the execution plane. | You need workspaces, commands, generated files, exposed services, or resumable state. | This is an SDK architecture pattern, not a universal executor protocol. See Sandbox Agents. |
| Local Docker sandbox for Codex | Docker runs the local sandbox workflow. | You want to run Codex from a project directory in Docker’s documented setup. | The documented command is sbx run codex; authentication is performed on the host before the sandbox starts. See Docker’s Codex instructions. |
Compare private-network reach, custom software, filesystem persistence, outbound network policy, credential handling, MCP connection origin, approval and audit needs, and who owns operations. The cited official documentation does not establish comparable prices or performance figures. These are OpenAI Agents API and Codex patterns; another coding assistant may use a different API and executor protocol. In particular, codex exec-server is not a general-purpose connector for every assistant.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Connect a self-hosted environment to the OpenAI Agents API
In the self-hosted pattern, your application supplies the compute and workspace; an executor running in that environment registers with the API and carries out requested work. Follow the current self-hosted environment guide for exact configuration fields, which can change.
- Provision an isolated environment. Prepare the workspace, required files, dependencies, and software for the user or workload. Avoid sharing an environment across users or workloads when they must not share files, credentials, or other resources.
- Install and run the executor. For this documented OpenAI pattern, run
codex exec-serverin the environment. It can run shell commands, read and write files, and use local MCP servers at the harness’s request. - Create the session for that environment. Configure the session to use the self-hosted environment and its workspace directory. The executor registers with the API using an environment ID and a restricted environment key.
- Allow the required outbound connections. The guide names
https://api.openai.comfor registration andwss://codex-cloud-environments.chatgpt.comfor commands and results. Check the guide’s current host requirements before deployment; endpoints may change. - Keep the application API key out of the sandbox. Pass the executor only the restricted environment key as
CODEX_API_KEY. That key permits environment connection, not other API actions, but code running in the environment can still read it. - Manage lifecycle in the application. Handle executor reconnection and coordinate incoming work before shutting down compute. Confirm no execution is pending, and preserve any files the application needs after shutdown.
This flow is specific to the documented OpenAI-managed harness with a self-hosted environment; it should not be treated as a generic recipe for unrelated coding assistants.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Connect MCP tools from the right network location
An MCP server publishes tool definitions and handles tool calls. Choose the connection origin according to where the server is reachable, as described in the Agents API MCP connections guide:
- Service-origin connection: Use this when the MCP server is reachable from the OpenAI service. The MCP guide describes session HTTP credentials and vault-backed credentials for this origin.
- Environment-origin connection: Use this for a private-network server or software installed in the sandbox. The environment must be able to reach the server; authentication may require inline credentials or a trusted proxy.
Set allowed_tools to restrict which tools the agent can discover and call. Decide whether MCP server initialization is required for the task to proceed. For a private MCP service behind a firewall, OpenAI documents Secure MCP Tunnel as a connection option that avoids exposing the server publicly in its MCP server guidance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
When an MCP connection fails, check the server URL against the chosen origin, confirm the executor is connected if the environment is the origin, verify that origin can reach the server, and check the credentials. Also confirm that configured commands, dependencies, and working directories exist.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Limit what code and tools can access
Treat agent-generated code as untrusted workload code: it can access the files, credentials, and network made available to its environment. OpenAI’s sandbox security guidance describes controls for isolation, egress, and credential brokering.
Quick Recap
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Isolate environments by user or workload when their data or resources must remain separate.
- Restrict outbound network access to approved destinations rather than granting unrestricted egress.
- Keep the application API key and third-party credentials outside agent-accessible compute. Any secret placed inside the environment should be treated as visible to the code running there, even if its permissions are limited.
- Broker third-party access through a trusted proxy or server where practical. For OpenAI-hosted sandboxes, the security guide describes vault secrets used as placeholders that a network proxy replaces for approved hosts.
- Require approval for sensitive tool actions, expose only tools needed for the task, review what data is sent to MCP servers, and use servers operated by providers you trust. The MCP server guidance also discusses prompt injection in user-provided content and tool outputs, third-party data policies, and the possibility that server behavior changes.
- Log and review tool activity and data sharing in line with your organization’s retention and residency requirements.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
