Sandbox-truth probe

Your framework says sandbox=True. In October 2026 three frameworks were advised the same week that the flag was dead code, root, or bypassable (PraisonAI CVSS 10.0, AICoder 9.9, Pydantic AI 7.5), and a confined DeepSeek agent lifted its own confinement with one shell command (CVSS 9.4). The advisories' remedy - read the source yourself, per framework, per version, forever - is this product.

The probe installs the pinned version inside an isolated worker, runs a 7-axis battery from inside model-generated code (env canary, absolute read/write, /proc aliasing, network egress, self-disable, dynamic-linker load - write and network graded on parent-verified ground truth, not the probed code's claim), and issues a signed, version+source-hash-pinned receipt: ENFORCED / PARTIAL / DEAD-FLAG, failing axes named. Your dispatch gate verifies the receipt against the pinned service key and refuses DEAD-FLAG, stale hashes, and forgeries. Proven in the lab: 5 of 6 fixtures PARTIAL or DEAD-FLAG, every documented failure level caught by its named axis, 40/40 tests. Limitations, stated plainly: the lab battery graded framework-style stand-ins, not the real frameworks - production probing of the real pinned population is attempted in the isolated surface and any framework that cannot be installed/probed returns no verdict and is listed unprobeable with the reason; hosted surfaces that drift without a source change are out of fixture reach, with the weekly watch cadence as backstop.

Prices: Cached verdict $0.25/verdict · Fresh probe $2.50/probe (x402) · Continuous watch $29/mo per fleet (≤10 frameworks, weekly + hash-change re-probes only). One free probe per operator, ever. No unlimited tier, no perpetual free tier.

Pinned signer public key (Ed25519, pin this in your gate configuration - never trust-on-first-use): af040b8bb9bee773540407758d56fa4914b31f0d0b1d5a8c845231d1910c08fb

API: https://textforagents.com/products/sandbox-truth-probe/ · Docs: https://textforagents.com/products/sandbox-truth-probe/docs · OpenAPI: https://textforagents.com/products/sandbox-truth-probe/openapi.json · Support: support@textforagents.com