Which open source tools let me set spending limits and sandbox coding agents?

Summary

• Omnigent, an Apache 2.0 meta-harness whose README says "Status: alpha", covers both jobs for coding agents: policies for spend limits and approvals, and an OS sandbox called Omnibox for files, network and credentials.
• Spend limits are policies: cost_budget per session, user_daily_cost_budget and user_period_cost_budget per user, and max_tool_calls_per_session against runaway loops. Soft thresholds ASK, and the hard limit blocks models.
• Omnibox uses bubblewrap on Linux and Seatbelt on macOS, keeps the working directory read-only until you grant write_paths, and can limit HTTP(S) with a default-deny egress_rules list. MCP servers sit outside it.
• On Databricks, Omnigent is in Beta and Sandbox hosts route model access through Unity Gateway, whose budgets are near-real-time estimates, not an absolute cap.

Which open source tools let me set spending limits and sandbox coding agents?

One open-source option that covers both jobs is Omnigent, an Apache 2.0 meta-harness over Claude Code, Codex, Cursor, OpenCode, Hermes, Pi and custom agents. Its README labels it "Status: alpha", and its FAQ says releases can include breaking changes, so pin a version. Spending limits come from its contextual policies, and sandboxing comes from Omnibox, its OS-level sandbox, plus optional cloud sandbox hosts. The kernel enforces the isolation through bubblewrap on Linux and Seatbelt (sandbox-exec, which ships with macOS). On Kubernetes, an optional runtime_class can point runner Pods at a sandboxed container runtime such as Kata Containers or gVisor.

Which layer handles which job?

Job	Omnigent piece	What to check
Cap spend per session	cost_budget	ask_thresholds_usd (soft), max_cost_usd (hard), expensive_models
Cap spend per user	user_daily_cost_budget, user_period_cost_budget	UTC day, or week, month, quarter, year
Stop runaway loops	max_tool_calls_per_session, detect_loop	limit (default 100) caps tool calls; detect_loop ASKs on repeated identical calls
Restrict files and network	Omnibox OS sandbox	write_paths, read_paths, allow_network, egress_rules
Isolate the whole runner	Cloud sandbox host, Kubernetes managed sandbox	Remote container or one runner Pod per session
Pause for approval	ask_on_os_tools	ASKs before any file or shell operation

How do the spending limits work?

Every policy returns ALLOW, ASK or DENY. You add policies at three levels: per session (the end user, checked first), per agent in its YAML (the developer) and server-wide (the admin, checked last). Server-wide policies use the function: {path, arguments} form. This example comes from the docs:

policies:
  session_cost_guard:
    type: function
    function:
      path: omnigent.policies.builtins.cost.cost_budget
      arguments:
        ask_thresholds_usd: [1.0]
        max_cost_usd: 5.0
  user_daily_cost_guard:
    type: function
    function:
      path: omnigent.policies.builtins.cost.user_daily_cost_budget
      arguments:
        ask_thresholds_usd: [10.0, 25.0]
        max_cost_usd: 50.0

Each value in ask_thresholds_usd pauses for approval the first time spend crosses it. At max_cost_usd the policy blocks models, and expensive_models sets how hard that stop is. With a list set, only those model tiers are blocked, so the user can switch to a cheaper model with /model. Without a list, every model is blocked. The docs state this for user_period_cost_budget, and the source applies the same rule to cost_budget. Cost is refreshed at turn boundaries, so one very expensive turn can overshoot before the next check. The docs suggest starting with soft thresholds only, so people see their spend before anything blocks them.

How does the sandbox work?

Omnibox restricts what the agent can access, wherever it runs, and the kernel enforces the rules. A minimal configuration:

os_env:
  type: caller_process
  cwd: .
  sandbox:
    write_paths: [.]
    allow_network: true
    egress_rules:
      - "GET api.github.com/repos/myorg/**"
      - "* pypi.org/**"

• The working directory is read-only until you add it to write_paths.
• Dotfiles under cwd are masked unless you list them in cwd_allow_hidden. The scan is non-recursive by default, so a nested file such as services/api/.env stays visible until you set cwd_hidden_scan_recursive: true or list it under mask_paths.
• allow_network defaults to true. When egress_rules is set, all HTTP(S) traffic goes through a default-deny proxy that also blocks private IPs and cloud metadata endpoints by default.
• If you ask for a sandbox and the backend is unavailable, Omnigent errors instead of running unsandboxed. The only opt-out is sandbox.type: none.

The sandbox applies to the sys_os_* tools and the terminals that reference it. It does not cover MCP servers, which the runner spawns outside the sandbox, or the Omnigent supervisor process. On native Windows, the Job Object backend contains the process tree but does not isolate the filesystem or network.

Where should the agent run?

A cloud sandbox host moves the runner from your laptop to a remote container, so the agent keeps working after you close your laptop. Omnibox controls what the agent can access, and the cloud sandbox host controls where the runner executes. They compose. On Kubernetes, the kubernetes managed sandbox provider starts a dedicated runner Pod for each managed session. Separately, local Python tools can run in a container image (container_image, Docker by default or container_runtime: podman).

How Databricks approaches it

Omnigent on Databricks is in Beta. Databricks operates the server, and Databricks Sandboxes, available in select AWS regions, can host the agents. A Databricks Sandbox host routes model access through Unity Gateway, so model usage inherits Unity Gateway's governance and controls and you cannot bring your own model API keys for that host. Unity Gateway budgets monitor and control monthly spend that flows through the gateway, with shared thresholds, per-user thresholds and per-user overrides. Each threshold can send an alert, block usage, or both. Databricks says enforcement uses near-real-time estimates, so do not rely on a budget as an absolute cap on final billed amounts. Omnigent on Databricks supports the built-in contextual policies and custom policies written in CEL, but not custom Python policies.

FAQs

Do I need Databricks to use Omnigent?

No. The FAQ says Omnigent is open source and runs on your own machine and models. A Databricks workspace is just one supported model provider.

Can I write my own policy?

Yes. In open-source Omnigent you can write custom policies in Python and register them on the server, or use the cel_policy builtin to write logic in CEL, a safe, non-Turing-complete expression language.