LiteLLM Agent Platform: Running Claude Code & Codex in Isolated Sandboxes With Vault Protection

AIDeveloper44 Team

What Is LiteLLM Agent Platform?

BerriAI has released LiteLLM Agent Platform, an open-source, self-hosted infrastructure for running coding agents like Claude Code and Codex inside isolated Kubernetes sandboxes. The key innovation: a credential vault that lets agents run with real permissions on external services—GitHub, databases, APIs—without ever seeing your actual API keys.

How It Works

Agents run inside fresh Kubernetes pods that only contain stub credentials (e.g., GITHUB_TOKEN=stub_github_a8f1). When the agent makes an outbound TLS connection, the vault proxy intercepts it and swaps the stub credentials for real keys from your vault. This means your actual API keys never enter the sandbox—they're used only at the perimeter.

You interact with agents via the lap CLI (command-line), the web UI, or directly via the developer API. Opening a sandbox with lap claude-code-cli1 spins up a new pod, attaches your local terminal via WebSocket, and drops you straight into the agent. Exit with Ctrl-D; the session stays alive for 24 hours.

Self-Hosting & Deployment

LiteLLM Agent Platform is built on Kubernetes using the kubernetes-sigs/agent-sandbox CRD. Local development uses kind; production deployments target AWS EKS for the sandbox cluster and Render for the web/worker layer. The repo includes automation: bin/kind-up.sh provisions a local kind cluster, and bin/eks-up.sh sets up EKS in minutes.

Prereqs are straightforward: Docker Desktop, kind, kubectl, helm, and a LiteLLM gateway URL. The setup guide walks through spinning up a local instance on localhost:3000 in minutes.

Why This Matters for AI Developers

Giving an AI agent real-world permissions is scary—and rightfully so. Most companies either sandbox agents completely (useless for real work) or give them direct access to keys (a security nightmare). LiteLLM Agent Platform solves this with a clean architecture: agents get the illusion of full permissions, but the vault controls every external request. Your keys stay secure; your agents stay useful.

This is especially powerful for coding agents. Claude Code running inside a sandbox with vault-controlled GitHub access can read/write repos, run tests, and open PRs—all without ever touching your real credentials. It's the infrastructure layer that makes agentic coding workflows actually safe for production.

Open Source & Ready to Deploy

The platform is MIT-licensed and available on GitHub. It includes everything: the agent sandbox controller, the vault sidecar, the lap CLI, the web UI, and Kubernetes manifests for both local dev and AWS EKS. The codebase is actively maintained (166 commits, 79 stars) and includes a demo video walking through setup and usage.

If you're running coding agents in production, or planning to, LiteLLM Agent Platform removes the biggest operational friction: secure credential management at the sandbox layer.

Explore the project on GitHub →

Enjoyed this?

Get more posts like this delivered to your inbox.

Subscribe