Run untrusted code safely, with one API.
CodeForge executes code your users write in isolated, network-free sandboxes, so you can add a “Run” button to your product without building or securing compiler servers.
# Submit code curl -X POST $CODEFORGE_API/v1/executions \ -H "Authorization: Bearer $CODEFORGE_KEY" \ -d '{"language":"python", "source":"print(sum(range(10)))"}'
# Poll the result { "status": "SUCCEEDED", "stdout": "45\n", "exitCode": 0, "durationMs": 14 }
Code execution infrastructure you don’t have to build
Running strangers’ code is a security problem first. CodeForge handles isolation, limits and metering so your team can focus on the product.
Isolated by design
Every language runs in its own micro-VM-based sandbox with no cloud credentials, strict CPU, memory and process limits, and cleanup between runs.
No network, no surprises
Sandboxes have no route to the internet and no DNS. User code can’t exfiltrate data, mine crypto or attack third parties.
Safe to retry
Idempotency keys make retries free: the same request returns the original execution, never a duplicate run or charge.
Fair limits per tenant
Monthly allowances and concurrency limits are enforced atomically, so one customer can never starve another.
Transparent usage
See runs per day and per language in the dashboard or via the API. Platform failures are refunded automatically.
One predictable contract
An OpenAPI 3.1 spec, a single error format with request IDs, and clear statuses from QUEUED to SUCCEEDED.
From API key to first result in minutes
An asynchronous REST API that fits any backend: submit, then poll.
Create an API key
Sign in to the dashboard and generate a key. Keep it on your server.
Authorization: Bearer cf_live_…
Submit code
POST the language, source and optional stdin. You get an execution ID right away.
POST /v1/executions → 202 QUEUED
Fetch the result
Poll until it finishes and read stdout, stderr, compiler output and exit code.
GET /v1/executions/{id} → SUCCEEDEDBuilt for products that run user code
Coding education
Let learners run exercises in four languages straight from your course pages.
Learn more →
Assessments & interviews
Grade candidate submissions against stdin test cases at scale.
Learn more →
Developer tools
Add “Run” buttons to docs, playgrounds and internal tools without running servers.
Learn more →
AI code evaluation
Execute model-generated code in a network-free sandbox and score the output.
Learn more →
Measured, not promised
Median time from API request to result for a short program, measured from a client in India calling our us-east-1 region over the public internet.
Measured 2026-11-12 on warm sandboxes; about half a second of each figure is the India ↔ US network round trip. The first run after an idle period starts a fresh sandbox and takes longer.
Simple plans that grow with you
Start free. Paid plans are introduced at general availability; beta customers keep their limits until then.
Free
Evaluate the API and build a prototype.
- 500 runs per month
- 1 run at a time
- All four languages
- Dashboard & playground
Developer
For individual builders shipping a product.
- 10,000 runs per month
- 2 concurrent runs
- Usage API
- Email support
Startup
For small teams with growing traffic.
- 50,000 runs per month
- 5 concurrent runs
- Priority support
- Usage exports
Business
Higher volume, custom limits and terms.
- Custom run volume
- Custom concurrency
- Dedicated onboarding
- Invoicing
Prices in USD, excluding taxes. Planned paid-plan prices may change before launch.
Assume every program is hostile
Isolation is the product. These controls apply to every execution, on every plan.
- Micro-VM-based isolationEach language runs in its own Firecracker-backed sandbox; nothing is shared with the control plane.
- No network routeSandboxes live in isolated subnets with no internet gateway, NAT or DNS.
- No credentials to stealSandbox permissions are empty; results return only through the invocation itself.
- Encrypted, signed jobsEach job is encrypted for the sandbox and every result is signed, so a tampered result is rejected.
- Hard resource limitsWall-clock kill, memory, process and file limits, and capped output on every run.
- Clean slate between runsLeftover files and processes are removed; an environment that can’t be verified clean is discarded.
Questions, answered
Which languages and versions are supported?
Python (CPython 3.12), JavaScript (Node.js 24), Java (OpenJDK 21) and C++ (g++ 11, C++17). Programs use the standard library; package installation isn’t available.
Can submitted code access the network?
No. Sandboxes have no route to the internet and no DNS, so code can’t call external services or exfiltrate data.
How is usage counted?
Each accepted execution counts as one run. Rejected requests are never charged, retries with the same Idempotency-Key are free, and executions that fail because of a platform error are refunded.
What are the limits per run?
Source and stdin up to 64 KiB each, a default 5-second run time (up to 10 seconds), output up to 64 KiB per stream, and a fixed memory limit per language.
Do you store my source code?
Only while it runs. Source code and stdin are deleted from our database as soon as the execution finishes, and are never written to logs. Results (output, status, exit code) are kept for 24 hours so you can fetch them, then deleted automatically.
Is CodeForge production-ready?
CodeForge is in private beta. We don’t yet offer an SLA or security certification; an independent security review is part of our launch plan.
Add code execution to your product
Read the docs, create a key and run your first program in minutes.