Start on loopback.Keep MANAGED_AGENTS_URL at http://127.0.0.1:3000 while probing. Remote access is a separate authentication and network decision.

The seam

DeepSeek Harness → stdio MCP bridge → MANAGED_AGENTS_URL → SandBase Harness API + Console

Probe before production

  1. List mcp__sandbase__* tools and record their schemas.
  2. Create a short test Session without production credentials.
  3. Match the Session ID and terminal state in DSH and the Console.
  4. Stop it from DSH and verify downstream settlement.
  5. Remove the profile layer and prove the baseline profile still boots.

Keep these boundaries explicit

Authority

Review write, file, credential, and sandbox tools before enabling them.

Evidence

Record the SandBase tag, DSH revision, URL, tool names, approvals, Session IDs, and rollback result.

Rollback

Stop SandBase, remove the out-of-tree layer, and restore the copied baseline profile if needed.

Read the full integration guide.

The canonical guide includes setup commands, permission checks, and failure boundaries.

Open the source-backed guideOpen SandBase Harness