PROJECT SOVEREIGN // DAY 05 - SANDBOXING LAYER

E2B Sandboxing - Firecracker microVMs

Tools via MCP run inside microVM. PII never leaves. Only hash + redacted output leaves. This is the orange box in your architecture.

Host App
Next.js

microVM (Firecracker)
E2B Sandbox

Tool via MCP
maskAadhaar / tokenize

Output
Hash only - No raw PII

INPUT DATA (simulated PII inside VM)TOOL CODE (what agent tries to run)

Blocked patterns: fetch(, axios, http.request, process.env, fs., require('fs'), eval(, child_process

Run code to see sandbox result

ExecId	Status	Output

PROD CODE - Day 05 to Day 10 migration (E2B SDK)

// npm install @e2b/code-interpreter
import { Sandbox } from '@e2b/code-interpreter'

const sbx = await Sandbox.create({ apiKey: process.env.E2B_API_KEY })
const execution = await sbx.runCode(`
  def mask_aadhaar(data):
    return "XXXX XXXX " + data[-4:]
  result = mask_aadhaar("1234 5678 9123")
  print(result)
`)
// Only result.hash leaves VM, raw data never leaves
await sbx.close()

Day 04 Audit Day 03 Policy

Next: Day 06 - Consent Ledger