Skip to main content

KernelBox logo

The lightweight GenAI kernels for agentic Python — persistent kernels, zero token waste, self-healing execution.

PyPI version Python 3.10+ Documentation MIT License


Install

pip install kernelbox

Using uv?  uv add kernelbox


30-second demo

Spin up a persistent Python kernel, run stateful agentic code — no notebook server, no setup overhead:

from kernelbox import get_or_create, execute, destroy

# Agentic AI: give your agent a named, persistent execution kernel
kernel = get_or_create("agent-sandbox")

# Step 1 — agent sends first code block
result = execute(kernel, "x = [1, 2, 3]\nsum(x)")
print(result.status)        # success
print(result.return_value)  # 6

# Step 2 — kernel remembers x. No context re-serialisation needed.
result = execute(kernel, "x.append(4)\nsum(x)")
print(result.return_value)  # 10

destroy("agent-sandbox")

That's it. One import. No server to start, no notebook to open, no context window wasted on state.


The context engineering problem

In 2026, agentic AI systems don't just call an LLM once — they run Python code across dozens of steps, loop, retry, and self-correct. That creates a brutal bottleneck: state management.

Every time an agent moves to the next step, it faces a choice: carry the full execution state forward in the prompt (burning tokens on dataframes, variables, and imports), or lose it entirely and re-run from scratch.

KernelBox solves this at the kernel level. State lives natively inside a persistent Python kernel — not in the context window. The agent just sends the next line of code. The kernel remembers everything else.

💡 In practice: a multi-step GenAI data pipeline that re-serialises state into the prompt can burn 5–20× more tokens per run than one backed by a persistent kernel. With KernelBox, context engineering becomes trivial — your agent's context window stays clean.

Why KernelBox?

Approach The real cost
Subprocess per call State lost — agent re-runs or re-serialises from scratch every step
Feed state into LLM prompt 💸 Token burn explodes — each step re-sends the full execution context
Full Jupyter server Heavy, slow — REST + WebSocket overhead, not built for agentic workflows
KernelBox ✅ Lightweight GenAI sandbox. Persistent kernel. Zero token waste. Self-healing.

KernelBox gives every agentic AI workflow a dedicated, lightweight Python kernel — stateful, fast, and isolated. No re-running. No re-serialising. No context window pollution.


Features

  • 🪙 Drastic token savings — state lives in the Python kernel, not the prompt; perfect for context engineering in agentic AI
  • 🧠 Agentic AI ready — named, persistent kernels designed for multi-step LLM-driven workflows
  • 🔁 Stateful execution — variables, imports, and objects survive between agent calls automatically
  • 🩹 Self-healing execution — built-in retry API with caller-owned repair callbacks; agents auto-correct on failure
  • 🏖️ Lightweight GenAI sandbox — isolated Python kernel per agent session, no notebook server, minimal footprint
  • ⚡ ZeroMQ direct communication — no HTTP round-trip, no serialisation overhead, kernel-speed execution
  • 🐚 Bash execution — run shell commands inside the same persistent kernel session
  • 🌐 FastAPI REST service — expose kernels over HTTP with Swagger UI and OpenAPI schema
  • 🖥️ CLI — manage kernels from the terminal with structured JSON output
  • 🐳 Docker support — hardened non-root GenAI sandbox container for production isolation
  • 🔧 Fully configurable — all settings overridable with environment variables

Quick CLI test

After install, verify everything works in one line:

kernelbox exec --name test "print('KernelBox is working!')"
{"status": "success", "output": "KernelBox is working!\n", "return_value": null}


📚 Full Documentation

→ vinaychaudhari1996.github.io/KernelBox

Includes guides for Docker deployment, the FastAPI server, CLI reference, agentic AI patterns, and context engineering best practices.



🤓 For Nerds — Full API, CLI & Config Reference

Python API reference

KernelBox exposes four lightweight functions that cover the full agentic kernel lifecycle:

from kernelbox import get_or_create, execute, execute_with_retry, destroy

get_or_create(name)

Returns a live named kernel, creating it if it doesn't exist yet.

kernel = get_or_create("data-pipeline")

execute(kernel, code, *, language, timeout)

Runs code and returns an ExecutionResult.

result = execute(kernel, "import pandas as pd\ndf = pd.DataFrame({'a': [1,2,3]})")

result.status        # "success" | "error" | "timeout"
result.output        # stdout as string
result.stderr        # stderr as string
result.return_value  # last expression value as string
result.duration_ms   # wall-clock time in milliseconds
result.truncated     # True if output was cut at KERNELBOX_OUTPUT_CHAR_LIMIT

Run a bash command in the same session:

result = execute(kernel, "echo $HOME", language="bash")

execute_with_retry(kernel, code, on_error_fn, *, max_attempts, language, timeout)

Self-healing execution — runs code and calls your on_error_fn on failure, letting the agentic AI loop self-correct before giving up.

from kernelbox import execute_with_retry, get_or_create

kernel = get_or_create("agent")

def fix_code(result, attempt):
    # result.error has: .ename, .evalue, .traceback
    # Return new code to retry, or None to retry the same code
    return f"# attempt {attempt}\nx = 41\nx + 1"

result = execute_with_retry(kernel, "x + 1", on_error_fn=fix_code)
result.status        # "success"
result.return_value  # "42"
len(result.attempts) # number of attempts made

destroy(name)

Shuts down the kernel process and removes it from the registry.

destroy("data-pipeline")

CLI reference

kernelbox create --name my-kernel
kernelbox list
kernelbox list --refresh          # re-ping each kernel for live status
kernelbox status --name my-kernel
kernelbox exec --name my-kernel "print(1 + 1)"
kernelbox exec --name my-kernel --bash "echo hello"
kernelbox exec --name my-kernel --timeout 30 "some_long_call()"
kernelbox restart --name my-kernel
kernelbox destroy --name my-kernel
kernelbox wipe                    # destroy ALL registered kernels

All commands output JSON — easy to pipe into jq:

kernelbox exec --name demo "2 ** 10" | jq .return_value
# "1024"

If you installed KernelBox inside a uv project, prefix commands with uv run kernelbox ...


FastAPI HTTP service

# Development mode (hot-reload)
uvicorn kernelbox.server.app:app --port 8080 --reload

# Or via uv
uv run fastapi dev --port 8080
Endpoint Description
http://127.0.0.1:8080/docs Swagger UI
http://127.0.0.1:8080/redoc ReDoc
http://127.0.0.1:8080/openapi.json OpenAPI schema

docker-compose up --build -d   # API at http://localhost:8080
docker-compose down

Runs as a non-root user with dropped capabilities and a read-only filesystem.


Configuration

All settings are read from environment variables — no config file needed.

Variable Default Description
KERNELBOX_MAX_RETRIES 5 Max attempts in execute_with_retry
KERNELBOX_EXECUTION_TIMEOUT 60 Seconds before a single execution times out
KERNELBOX_KERNEL_IDLE_TIMEOUT 1800 Seconds before an idle kernel is considered stale
KERNELBOX_OUTPUT_CHAR_LIMIT 10000 Max characters of stdout/stderr captured
KERNELBOX_STORE_BACKEND file file (survives restarts) or memory (in-process only)
KERNELBOX_REGISTRY_PATH .kernelbox/registry.json Where the file registry is stored
KERNELBOX_RUNTIME_DIR .kernelbox/runtime Where kernel connection files live
KERNELBOX_STARTUP_CODE (unset) Python code executed after every new kernel starts
KERNELBOX_KERNEL_TYPE python3 Jupyter kernelspec name
KERNELBOX_HOME (unset) Override base directory for registry and runtime paths

PowerShell:

$env:KERNELBOX_EXECUTION_TIMEOUT = "120"
uv run fastapi dev --port 8080

Bash/zsh:

export KERNELBOX_EXECUTION_TIMEOUT=120
uv run fastapi dev --port 8080

Assumptions & Limitations

Area Behaviour
Sandboxing Kernels run with the same OS privileges as the calling process. Use Docker for isolation.
Authentication The FastAPI server has no authentication. Bind to 127.0.0.1 or use a reverse proxy.
Kernel type Only python3 kernelspec is tested. Other kernels may work but are unsupported.
Concurrency The file registry is not designed for heavy concurrent writes from multiple processes.
Windows ACL KernelBox patches Jupyter's ACL restriction on Windows to avoid PermissionError. Connection files may have broader read permissions.
Idle detection KERNELBOX_KERNEL_IDLE_TIMEOUT is tracked in metadata only — KernelBox does not automatically kill idle kernels.
Output size stdout/stderr is truncated at KERNELBOX_OUTPUT_CHAR_LIMIT. result.truncated will be True.
Bash execution Bash runs through IPython's %%bash cell magic, not a real shell. Environment variables and working directory may differ.

Development (from source)

git clone https://github.com/VinayChaudhari1996/KernelBox.git
cd KernelBox

# Bootstrap: installs uv, creates .venv, syncs dev deps
python scripts/bootstrap.py

# Or manually if uv is already installed
uv venv && uv sync --extra dev
uv run pytest              # test suite
uv run ruff check .        # lint
uv run ruff format .       # format
uv run zensical serve      # docs at http://127.0.0.1:8000
uv run fastapi dev --port 8080  # API at http://127.0.0.1:8080

See the Development Guide for architecture details and contribution workflow.


License

MIT © Vinay Chaudhari

Metadata

Release files for kernelbox 0.1.2

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for kernelbox 0.1.2
File Size Uploaded Provenance Actions
kernelbox-0.1.2.tar.gz 2.2 MB Without provenance Details for kernelbox-0.1.2.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for kernelbox 0.1.2
File Interpreter ABI Platform Actions
kernelbox-0.1.2-py3-none-any.whl Python 3 none any Details for kernelbox-0.1.2-py3-none-any.whl

Total release size: 2.2 MB

Release files / kernelbox-0.1.2.tar.gz

Download URL kernelbox-0.1.2.tar.gz
Size 2.2 MB
Tags Source
SHA-256 checksum
How to use checksums
f5ae786f107e812d0dfa6273a939c0b5d658d5a8027df25a62cfb39b19deda63
BLAKE2b-256 checksum
How to use checksums
b52d7478ecfce3d7fe58b281135a8e785b366091bc9ceef3e4316472159a14e8
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via uv/0.11.12 {"installer":{"name":"uv","version":"0.11.12","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":null,"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}

Release files / kernelbox-0.1.2-py3-none-any.whl

Download URL kernelbox-0.1.2-py3-none-any.whl
Size 24.7 kB
Tags Python 3
SHA-256 checksum
How to use checksums
0a4f840eed2dce86c38a417e87bcc61aafa0786b813629c484ad0ff6098edbd7
BLAKE2b-256 checksum
How to use checksums
b7c2bd0a9244ec4ff6da022cad163536dc703807464d262f6ec91a0ea3f84576
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via uv/0.11.12 {"installer":{"name":"uv","version":"0.11.12","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":null,"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}

Security for kernelbox 0.1.2

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page