---
type: analysis
slug: research-agno-superservetools-is-a-generally-available-persistent-firecracker-sandbox
title: "Agno SuperServeTools is a generally available persistent Firecracker sandbox for long-running agents"
description: "Agno 2.7.4 ships SuperServeTools so an agent can write and run code in a SuperServe microVM that keeps files and packages across tool calls and session runs. Persistence is real, but it is bounded by session storage, auto-pause, and optional auto-delete."
published_at: 2026-11-07T16:00:00.000Z
topics: ["sandbox","agents","memory","research"]
source_urls: ["https://github.com/agno-agi/agno/releases/tag/v2.7.4","https://www.agno.com/blog/give-your-long-running-agents-a-sandbox-that-survives-between-calls","https://docs.superserve.ai/integrations/agent-harnesses/agno","https://pypi.org/project/agno/2.7.4/","https://github.com/agno-agi/agno/pull/8584","https://docs.agno.com/tools/toolkits/others/superserve","https://docs.agno.com/examples/tools/superserve-tools","https://docs.superserve.ai/sandbox/lifecycle","https://docs.superserve.ai/introduction","https://www.superserve.ai/pricing/","https://www.superserve.ai/","https://www.agno.com/changelog"]
author: "Andrey Reshetnikov"
author_profile: https://newruntime.com/owner-profile.md
---
Agno announced SuperServeTools on 17 July 2026 with SDK v2.7.4. A truncated social post said agents could write and run code inside a SuperServe Firecracker microVM whose files survive between calls. That claim is now checkable in Agno's changelog post, toolkit docs, cookbook, GitHub release, and SuperServe's Agno integration page.

This matters for long-horizon coding agents. One-shot interpreters throw away installs and working trees after each call. Persistent sandboxes let an agent iterate, but they also keep untrusted model-written code, leftover packages, and network access alive. SuperServe is a separate sandbox cloud. Agno added a toolkit that talks to it, joining existing E2B and Daytona integrations rather than replacing them.

## What we checked

- **What is the full Agno SuperServeTools announcement URL and what exactly persists between calls?** confirmed. The canonical post is Agno's 17 July 2026 changelog article. Files the agent writes and packages it installs remain on the next tool call and the next run in the same session because persistent=True stores the sandbox ID in agent session state. SuperServe pause separately checkpoints memory, processes, and filesystem; timeout auto-pauses and does not delete. [2][6][8]
- **Is SuperServeTools generally available, beta, or example-only?** confirmed. It shipped as a documented new feature in Agno v2.7.4 on 17 July 2026, is on PyPI as the superserve extra, and SuperServe's Agno guide says it is available in 2.7.4 and later. A cookbook exists, but the toolkit is a first-class SDK integration. No official source labeled it beta. [1][4][3][5]
- **Does SuperServe persist full VM memory and running processes between agent calls, or only files and packages?** partly confirmed. Agno's default persistence reuses the sandbox ID so files and installed packages remain while the sandbox exists. Full memory and process restore is SuperServe's pause and resume path. Agno exposes pause_sandbox and resume_sandbox as opt-in tools, disabled unless enable_pause_sandbox and enable_resume_sandbox or all=True. [6][8]
- **Do SuperServe secrets keep real API keys out of the sandbox and away from the model?** confirmed. SuperServe stores encrypted credentials and injects a stand-in token into the sandbox environment, swapping the real value onto outbound requests only for allowed hosts. Agno binds this with the secrets map. A bound sandbox secret does not set the host process model key. [10][6][2]

## What we found

- SuperServeTools shipped as a named new feature in Agno v2.7.4, published on GitHub on 17 July 2026, the same day as the changelog post. SuperServe's Agno guide says the toolkit is available in Agno 2.7.4 and later. PyPI lists a superserve extra on that package. The merged PR adds the toolkit, cookbook/91_tools/superserve_tools.py, 28 unit tests, and pip install "agno[superserve]". None of those sources mark it beta. [1][2][3][4][5]
- Default persistence is sandbox identity plus filesystem work, not an automatic memory checkpoint. Agno and SuperServe both say files the agent writes and packages it installs remain across tool calls. With persistent=True, the default, Agno stores the sandbox ID in session state and reuses that VM across tool calls and across runs in the same session. The cookbook warns that a script with no session database will not restore the saved ID after process restart. [6][7][3]
- SuperServe's long-lived states are active and paused. pause() checkpoints memory, processes, and filesystem to disk and stops compute billing; resume restores processes where they left off. Agno's timeout default is 300 seconds of active time before auto-pause and does not delete the sandbox. auto_delete_seconds, unset by default, deletes only after continuous pause, with SuperServe documenting a 30-day maximum. SuperServe's Agno page slightly blurs timeout as an automatic stop; the toolkit table and lifecycle docs are the precise contract. Pause tools in Agno default to off. [8][6][3]
- The default guest is superserve/code-interpreter with Python 3.11 and pip. Builders can switch templates, including superserve/node-22. Default tools cover Python, shell, files, sandbox info, shutdown, and a public preview URL. Secret attach and detach are opt-in. SuperServe also documents per-sandbox egress rules and an HTTP/HTTPS connection log. [6][9]
- Credentials can stay outside the guest. SuperServe encrypts stored secrets and puts a stand-in token in the sandbox environment, swapping the real credential onto outbound requests only for allowed hosts. Agno exposes this as SuperserveTools(secrets={...}). The toolkit docs warn that a SuperServe-bound secret does not set OPENAI_API_KEY on the host that runs the model. [10][6][2]
- SuperServe bills while the VM is active: $0.0504 per vCPU-hour and $0.0162 per GiB-hour, per second. Free is $0 list with $5 to start plus $95 when billing is added, up to 20 concurrent sandboxes and up to 2 vCPU, 2 GiB memory, and 8 GiB disk. Pro is $1,000 per month with $1,000 of metered usage included, up to 1,000 concurrent sandboxes and larger sizes. Enterprise offers self-host in AWS, GCP, or Azure. The homepage claims indefinite sessions with no 24-hour limit. [11][12]

## What it means

Treat SuperServeTools as generally available for Agno agents that need a durable code workspace, not as a beta sample. Wire persistent=True plus a real session store, or pass sandbox_id, if you expect the same VM after a process restart. Set timeout for auto-pause and auto_delete_seconds for cleanup so forgotten sandboxes do not linger; do not assume timeout deletes anything. Put production API keys in SuperServe secrets rather than env_vars. Enable pause and resume only if the agent must checkpoint running processes. Agno still ships E2B and Daytona toolkits, so choose SuperServe when you want Firecracker isolation plus SuperServe's pause, secrets proxy, and claimed unbounded session length.

## Still open

- Independent evaluations of SuperServeTools itself were not found in this pass; coverage is vendor-authored.
- Whether Agno's toolkit exposes SuperServe snapshot and fork advertised on the SuperServe homepage.
- How SuperServe's open-source and self-host claims map onto the managed API Agno calls; the SuperServe GitHub page fetched here did not return a usable README.
- Isolation properties of the default superserve/code-interpreter template versus a locked-down custom image.

## Sources

1. [Agno v2.7.4 release notes](https://github.com/agno-agi/agno/releases/tag/v2.7.4) (primary)
2. [Give your long-running agents a sandbox that survives between calls | Agno](https://www.agno.com/blog/give-your-long-running-agents-a-sandbox-that-survives-between-calls) (primary)
3. [Agno - Superserve](https://docs.superserve.ai/integrations/agent-harnesses/agno) (primary)
4. [agno 2.7.4 on PyPI](https://pypi.org/project/agno/2.7.4/) (primary)
5. [feat: Add Superserve sandbox tools (#8584)](https://github.com/agno-agi/agno/pull/8584) (primary)
6. [Superserve | Agno toolkit reference](https://docs.agno.com/tools/toolkits/others/superserve) (primary)
7. [Superserve | Agno cookbook example](https://docs.agno.com/examples/tools/superserve-tools) (primary)
8. [Pause, resume, and delete - Superserve](https://docs.superserve.ai/sandbox/lifecycle) (primary)
9. [Introduction - Superserve](https://docs.superserve.ai/introduction) (primary)
10. [Secrets - Superserve](https://docs.superserve.ai/secrets/overview) (primary)
11. [Pricing | Superserve - Sandboxes for AI agents](https://www.superserve.ai/pricing/) (primary)
12. [Superserve | Virtual machines for long-horizon agents](https://www.superserve.ai/) (primary)
13. [Agno changelog](https://www.agno.com/changelog) (primary)

Author: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- topic hub: [Agents](https://newruntime.com/topics/agents.md): Explore the agents topic hub.
- topic hub: [Memory](https://newruntime.com/topics/memory.md): Explore the memory topic hub.
- collection: [Analysis](https://newruntime.com/analysis.json): Open the latest authorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)