Sandy FAQs

Question 1

How does Sandy ensure security for AWS access?

Accepted Answer

Sandy creates ephemeral sandbox environments (Shuru microVMs or Docker containers) for script execution. AWS credentials are securely routed via an IMDS broker, preventing them from ever being exposed to the agent or stored within the sandbox.

Question 2

How can I integrate Sandy into my workflow?

Accepted Answer

Sandy can be used in two primary ways: as a Claude Code plugin (MCP server) for direct agent integration, or as a standalone CLI tool for scripted workflows or agents that prefer interacting via a shell.

Question 3

What are the main benefits of using Sandy for AI agents?

Accepted Answer

AI agents benefit from full AWS SDK v3 access, enabling complex queries and in-sandbox data aggregation, which reduces token usage on glue work. This is all done within a secure, isolated environment without direct host credential access.

Question 4

What is Sandy and what problem does it solve?

Accepted Answer

Sandy provides a secure, sandboxed TypeScript runtime specifically for AI coding agents to execute AWS queries. It addresses the challenge of giving agents full AWS SDK access and aggregation capabilities without exposing sensitive host-level credentials.

Question 5

What are the core prerequisites for running Sandy?

Accepted Answer

To run Sandy, you'll need either Shuru (for microVMs) or Docker (for containers) installed to create the sandbox environments. Additionally, `imds-broker` is required to securely serve AWS credentials via IMDS to the sandboxed runtime.

Sandy

Sandy

主な機能

ユースケース

主な機能

ユースケース