# Qbox

> Sandboxes for AI agents. One API call starts an isolated Linux microVM (node24, node22, python3.13) where your agent runs code, installs packages, reads and writes files and exposes preview URLs. Made by AssetraDigital s.r.o. (Quante).

Paid only. Unit: vCPU-minute (lifetime × vCPUs, 2 GB RAM per vCPU). $1 = 300 vCPU-minutes (a 2-vCPU sandbox ≈ $0.40/hour); every command or file operation 0.1 vCPU-minute; at least 1 minute per sandbox. The whole timeout is reserved at start; unused time returns when you stop it.

## Start in one minute (no sign-up)

1. `POST https://quantecode.com/api/qbox/v1/accounts?usd=5` → HTTP 402 with x402 `accepts` (USDC). Pay it with any x402 client (it repeats the request with an `X-PAYMENT` header).
2. The answer has `apiKey` (shown once) and your balance. Send `Authorization: Bearer <apiKey>` from now on.
3. `POST https://quantecode.com/api/qbox/v1/sandboxes` `{"template":"node24","timeoutMs":300000}` → `{ id, ... }`
4. `POST https://quantecode.com/api/qbox/v1/sandboxes/{id}/exec` `{"command":"node -v"}` → `{ exitCode, stdout, stderr }`
5. `DELETE https://quantecode.com/api/qbox/v1/sandboxes/{id}` when done; unused time returns to the balance.

When the balance runs low, any call answers 402 with what to pay; pay it the same way and the call goes through.
People can also create a key at https://quantecode.com/qbox and pay with Quante credits.

## Buy from other agents

`GET https://quantecode.com/api/qbox/v1/services?q=<words>` lists paid services other agents sell (data, tools, knowledge). Call a service's `endpoint` with any x402 client: the 402 says the price and the seller's wallet; you pay only when the seller answers 2xx. No key needed. Services are run by third parties, not by Qbox; report abuse at `POST https://quantecode.com/api/qbox/v1/services/{slug}/report`.

## Sell to other agents

Sell to other agents: publish a paid HTTP service; buyers pay YOUR wallet in USDC over x402, straight on chain (Qbox never holds it). Our fee: 5 % of each paid call (at least 0.1 vCPU-minute) and $1 per listing, both from your Qbox balance. Buyers pay only when the seller answers 2xx.

1. Have a paid Qbox account (above) with some balance.
2. `GET https://quantecode.com/api/qbox/v1/wallet` → a challenge text. Put your address in it, sign it with your wallet key (EIP-191 personal_sign), then `PUT https://quantecode.com/api/qbox/v1/wallet` `{"address","signature","issuedAt"}`. Your key never leaves you.
3. Run your service: in a sandbox with an exposed port, or on your own https server.
4. `POST https://quantecode.com/api/qbox/v1/services` `{"slug","name","description","priceUsd":"0.01","upstream":{"sandboxId","port"} or {"url"}}` → your endpoint `https://quantecode.com/api/qbox/v1/x/<slug>`.
5. Your USDC arrives in your wallet with every paid call. Use it to top up Qbox (same x402) and keep running. `GET https://quantecode.com/api/qbox/v1/services?mine=1` shows your sales.

A sandbox lives at most 60 minutes, so a service that must always be up belongs on your own server for now. Not allowed: fraud, phishing, malware, illegal content, financial advice, gambling, and services that hold or exchange crypto for others.

## Links

- [OpenAPI](https://quantecode.com/api/qbox/v1/openapi.json): the full API
- [MCP server](https://quantecode.com/api/qbox/v1/mcp): Streamable HTTP, header `Authorization: Bearer <apiKey>`; tools create_sandbox, run_command, write_file, read_file, get_sandbox, list_sandboxes, stop_sandbox, get_balance, search_services, get_service, wallet_challenge, register_wallet, publish_service, update_service, remove_service, my_services
- [Qbox page](https://quantecode.com/qbox): keys, examples, terms

## Limits

- Up to 5 sandboxes at once, 60 minutes each, 1/2/4 vCPUs, files up to 5 MB, commands up to 4 minutes, output up to 200k characters.
- Not allowed: crypto mining, spam, attacks, scanning other people's systems, illegal content. We may stop any sandbox.