Run short-lived code with hard limits—and keep a receipt.
Execute Python, Node, and Bash submitted by an application, agent, or user without turning your machine into the execution environment.
Skip to content
v0.8.0 is currentApp, CLI, Python wheel, and TypeScript tarball downloads are live. Named registry installs remain deferred. Generated functionsRun model-produced source outside the agent process.JSON transformsApply user-defined code to structured input.Code gradingBound hidden-test evaluation and keep the record.
One command to a real result.
With no endpoint configured, the Rookhold app starts a temporary loopback service, runs trusted code, saves the receipt, and removes the service state. It reports the weak local posture plainly.
Open the two-minute quickstartrookhold applocal · trusted code only
›rookhold run python "print(6 * 7)"
01job completed42
02networkhost
03isolationnone
receipt
.rookhold/runs/…/receipt.jsonsavedTry the Rookhold app.
The complete bundle contains the unified app, local service, remote client, MCP adapter, verifier, and setup templates.
Windows and Linux: 64-bit Intel or AMD. Mac: Apple silicon. Mac and Linux users run chmod +x once after extracting.
Add Rookhold to an application.
Install the exact v0.8.0 SDK release assets. They submit jobs to an endpoint and do not create the guarded Linux boundary by themselves.
Python
pip install https://github.com/sambai-dev/rookhold/releases/download/v0.8.0/rookhold-0.8.0-py3-none-any.whlPython guide →TypeScript
npm install https://github.com/sambai-dev/rookhold/releases/download/v0.8.0/rookhold-0.8.0.tgzTypeScript guide →Named PyPI and npm installs are deferred while maintainer registry accounts are activated; v0.8.0 ships the exact packages as verified release assets.
Already have a Rookhold server?
The standalone client is the smaller human and MCP interface. It does not include the service or local-run workflow.
The local demo is not the security boundary.
For untrusted code, operate Rookhold on a dedicated Linux x86_64 host with the pinned gVisor provider. Local development on Windows, macOS, or an unisolated Linux setup reports isolation: none.
Requested policy, observed controls, and portable proof stay separate. A run fails admission when the service cannot satisfy its required isolation class.
Build the secure boundaryChoose the right surface.
Which download should I use first?
Use the complete Rookhold app bundle for your operating system. It includes the zero-configuration local path and the server.
When should I use the standalone client?
Use it only when you already have a Rookhold endpoint and want the smaller operator or MCP interface.
Do the SDKs include the sandbox service?
No. They submit to an endpoint. The secure boundary is a separately operated Linux service.
Can I safely run untrusted code on my laptop?
No. The local mode is explicitly unisolated. Use the dedicated Linux gVisor deployment for mutually untrusted code.