Hotcell

Prompt injection in agent code, a leaked log, or a malicious dependency can exfiltrate a provider API key if you hand the real credential to the sandbox. Hotcell is a self-hosted daemon that prevents this: it holds your real keys in a local keychain, proxies all provider traffic through a gateway, and injects a per-sandbox revocable token into each cell instead. The agent never sees the actual key. Hard spend caps enforce a blast radius limit — an agent that goes wrong stops spending at the ceiling you set, rather than running until you notice the bill.

The core workflow is a single CLI command: point Hotcell at a repo, tell it how many sandboxes to spin up, enable keyless egress, and optionally preinstall an agent (OpenCode, Codex, Claude Code, and Mastra are called out explicitly in the docs). Each cell gets the repo cloned into its own workspace on an auto-named branch. You open a terminal per cell, assign each agent a different task, and when you are done, one teardown command removes all cells and revokes all tokens simultaneously. Git push works keylessly through the gateway.

Hotcell’s differentiating constraint is that it is infrastructure, not an agent — it contains and manages agent execution environments rather than doing any autonomous task planning itself. That distinction matters: you bring the agent, Hotcell brings the walls. Isolation tiers escalate from Docker (lower overhead) through Firecracker and Apple VZ (harder kernel boundaries), so you can match containment to trust level.

The tool is Apache-2.0 licensed with no required paid tier. It runs on any Mac, Linux VM, or bare-metal box, which means the ceiling on parallel sandboxes is your local hardware, not a cloud quota. A managed cloud path exists but is waitlisted at the time of this listing. Teams that need elastic scale beyond what a single machine provides will hit that hardware ceiling and need to either queue jobs or look elsewhere.