Daytona for AI agents

Daytona manages cloud-based development workspaces, letting a team spin up, configure, and tear down sandboxes for coding and testing through an API. Connect it once through Arc0, and your agent, or Claude, ChatGPT and Cursor, can use it through one MCP endpoint, limited to what each user approved.

Connect Daytona See the 114 actions ↓

Developer toolsOAuth 2.0MCP + RESTdaytona.io

AUDIT LOG · DAYTONAPOLICY: acme-support

09:41:07 · claude · u_8f2read

daytona.list_volumes

List Volumes✓ allowed · 212ms

09:41:08 · claude · u_8f2read

daytona.get_user

Get Authenticated User✓ allowed · 164ms

09:41:09 · claude · u_8f2write

daytona.create_backup

Create Sandbox Backup✓ approved · approved by user

09:41:12 · claude · u_8f2destructive

daytona.delete_files

Delete Sandbox File✕ blocked · policy: deny

EVERY DAYTONA CALL, ON THE RECORD

01 · USE CASES

What agents do in Daytona.

Create a new sandbox

Create a new sandbox environment ready for a developer or agent to work in.

Clone a repository into a sandbox

Clone a git repository into a sandbox before starting work on it.

Confirm before deleting a sandbox

Confirm before deleting a sandbox, since any uncommitted work inside it is lost.

02 · ACTIONS

114 Daytona actions, graded by risk.

Every Daytona action is tagged read, write or destructive, so one policy covers the whole app and new actions inherit the right default.

read

Look things up. Allowed by default.

daytona.get_user
Get Authenticated User
daytona.get_config
Get Daytona Config
daytona.get_health
Get Daytona Health Status
daytona.get_volume
Get Volume
daytona.get_api_key
Get API Key
daytona.get_sandbox
Get Sandbox
daytona.get_windows
Get Windows
daytona.get_registry
Get Docker Registry
daytona.get_snapshot
Get Snapshot
daytona.get_work_dir
Get Working Directory
daytona.list_volumes
List Volumes
daytona.search_files
Search Files
daytona.get_file_info
Get File Info (Deprecated)
daytona.list_api_keys
List API Keys
daytona.list_sandboxes
List Sandboxes
daytona.list_snapshots
List Snapshots

+ 39 MORE

write

Create and change things. Allow, or ask the user first.

daytona.create_backup
Create Sandbox Backup
daytona.create_volume
Create Volume
daytona.create_api_key
Create API Key
daytona.create_sandbox
Create Sandbox
daytona.create_registry
Create Docker Registry
daytona.create_snapshot
Create Snapshot
daytona.update_registry
Update Docker Registry
daytona.create_ssh_access
Create SSH Access
daytona.create_pty_session
Create PTY Session
daytona.create_folder_files
Create Folder in Sandbox
daytona.create_organization
Create Organization
daytona.update_last_activity
Update Last Activity
daytona.update_public_status
Update Public Status
daytona.create_process_session
Create Process Session
daytona.create_organization_role
Create Organization Role
daytona.update_organization_role
Update Organization Role

+ 23 MORE

destructive

Delete, cancel or archive. Ask first, or deny outright.

daytona.delete_files
Delete Sandbox File
daytona.delete_volume
Delete Volume
daytona.delete_api_key
Delete API Key
daytona.delete_sandbox
Delete Sandbox
daytona.delete_session
Delete Session
daytona.archive_sandbox
Archive Sandbox
daytona.delete_registry
Delete Docker Registry
daytona.delete_snapshot
Delete Snapshot
daytona.delete_recording
Delete Recording
daytona.delete_git_branch
Delete Git Branch
daytona.delete_pty_session
Delete PTY Session
daytona.delete_api_key_user
Delete API Key for User
daytona.delete_organization
Delete Organization
daytona.delete_organization_role
Delete Organization Role
daytona.cancel_organization_invitation
Cancel Organization Invitation
daytona.delete_organization_otel_config
Delete Organization OTEL Config

+ 4 MORE

03 · HOW IT WORKS

Daytona in three steps.

01Your users connect DaytonaThey sign in to Daytona on Arc0 Connect, under your brand, and approve the access you ask for.
02You set the rulesReads run, writes like “create Sandbox Backup” can wait for the user, and “delete Sandbox File” can be denied outright.
03Any agent can actYour agent calls Daytona through the Arc0 SDK or MCP, and so can Claude, ChatGPT and Cursor. Every call lands on the audit log.

POLICY.TS

await arc0.policies.set('daytona', {
  read: 'allow',
  write: 'ask',        // create_backup
  destructive: 'deny',  // delete_files
})

# Claude Code: the same connection, one URL
$ claude mcp add --transport http arc0 \
    https://mcp.arc0.ai/u/u_8f2

04 · AUTH AND DATA

How Daytona connects.

Users sign in to Daytona on Arc0 Connect and approve the scopes you request. Build with Arc0’s Daytona OAuth app, or bring your own so the Daytona consent screen names you. Tokens refresh automatically, and you can export them whenever you want.

The same Daytona connection serves your agent over MCP and your own backend over REST and the proxy, so a user connects once. How Arc0 handles credentials →

AUTH: API key · OAuth 2.0
CREDENTIALS: Per-tenant encrypted vault
MODEL SEES: Results only, never credentials
AUDIT LOG: Every call, on every plan

05 · WORKS WITH

Use Daytona from any agent.

Claude

ChatGPT

Cursor

Codex

VS Code

OpenAI Agents SDK

Claude Agent SDK

Vercel AI SDK

Mastra

LangGraph

06 · RELATED

More developer tools apps.

Addressfinder17 actions

Addresszen2 actions

Alchemy36 actions

ALL DEVELOPER TOOLS APPS →

07 · FAQ

Daytona and Arc0, answered.

Q01

Can I use Daytona with Claude, ChatGPT or Cursor?

Yes. Connect Daytona to Arc0 once, then add your Arc0 MCP URL to Claude, ChatGPT, Cursor, Claude Code or any other remote-MCP client. Each assistant only gets the Daytona actions you allow.

Q02

How do users connect Daytona?

Q03

Which Daytona actions can my agent take?

114 in total: 55 read, 39 write and 20 destructive, such as “create Sandbox Backup”. Your policies decide which of them each agent may call.

Q04

Can I stop my agent from deleting things in Daytona?

Yes. Actions like “delete Sandbox File” are graded destructive. Set destructive actions to deny, or to ask so the user approves each one, and blocked calls still show up on the audit log.

Q05

Can my own backend call Daytona too?

Yes. The same Daytona connection is available over REST and through the Arc0 proxy, so your product and your agent share one connection per user.

Get started

Plug Daytona into your agent.

Your users connect Daytona once, under your brand. Your agent gets 114 actions behind your policies, with every call on the record.

Connect Daytona Browse all apps →

Free to build · MCP + REST · Audit log on every plan