Registry › Compare › Cube Sandbox vs OpenShell

Cube Sandbox vs OpenShell

Both are Grade B and 1.5 points apart, so choose on what you weigh most. OpenShell leads on supply-chain integrity and adoption.

B Cube Sandbox 73.0

Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.

TencentCloud/CubeSandbox · #298 overall · #5 Sandboxes & Runtimes · coverage B (3/5)

Cube Sandbox doesn't lead on any scored dimension in this pair.

B OpenShell 74.5

OpenShell is the safe, private runtime for autonomous AI agents.

NVIDIA/OpenShell · #275 overall · #3 Sandboxes & Runtimes · coverage B (3/5)

Choose OpenShell if supply-chain integrity and adoption matter most.

+2.8Adoption: 137.4k weekly downloads against 2.6k
+1.9Safety / Integrity: 100% of recent commits signed, against 94%
+1.1Transparency: OSSF Scorecard 6.5 against 5.2

Where they differ

11.2

Safety / IntegrityOpenShell +1.9

13.1

12.9

TransparencyOpenShell +1.1

14.0

14.4

AdoptionOpenShell +2.8

17.2

+3.7

Runtime calibrationCube Sandbox +4.3

-0.6

2 dimensions identical: Identity 10.8 · Maintenance 20.0 · Full evidence table

An independent, evidence-based trust comparison of Cube Sandbox and OpenShell, two Sandboxes & Runtimes projects in the HVTracker registry. Scores come from public, checkable signals — supply-chain provenance, OSSF Scorecard, maintenance, and adoption — not popularity.

Full evidence

Signal	Cube SandboxTencentCloud/CubeSandbox	OpenShellNVIDIA/OpenShell
HVTrust score	73.0	74.5
Evidence grade	B	B
Coverage grade	B	B
Overall rank	#298	#275
Rank in Sandboxes & Runtimes	#5	#3
GitHub stars	13.1k	21.0k
Last updated	today	today
Build provenance	No	No
OSSF Scorecard	5.2 / 10	6.5 / 10
License	NOASSERTION	Apache-2.0
Downloads	3k/wk	137k/wk
Trust dimensions (points earned)
Safety / integrity / 25	11.2	13.1
Identity & provenance / 18	10.8	10.8
Transparency / 17	12.9	14.0
Maintenance / 20	20.0	20.0
Adoption / 20	14.4	17.2
Runtime capability surface (full matrix)
MCP server	—	—
External providers	—	—
Requires API keys	No	No
Plugin surface	plugins	extensions
Provenance drift	Match	Unknown

Open in the live compare tool → Cube Sandbox profile OpenShell profile More Sandboxes & Runtimes →

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption, scaled by an evidence-confidence factor. Grade bands: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Signals refresh daily. Full methodology v4.4 →