Summary: OpenRouter’s shell server tool and Files API were in beta as of September 8, 2026, letting any tool-calling model run commands in a hosted isolated Linux container. The container defaults to no outbound network access, supports file persistence by container ID and workspace promotion, and can pair with server-side web search without opening the container to the internet. Sandbox time costs $0.0001 per active second with a 30-second cold-start minimum, storage is capped at 10 GiB, and the beta API may change.
An agent that needs to run code usually drags in a pile of sandbox infrastructure you have to operate yourself. OpenRouter’s new shell server tool and Files API relocate that compute to the server side, so any model with tool calling support can execute commands inside a hosted Linux container. The feature sits in beta as of September 8, 2026, and it shifts where the execution layer belongs in your agent stack.
How the shell tool works
Add openrouter:shell to the tools array of a request aimed at any tool-calling model. It is the model that decides when to reach for the terminal. When it does, OpenRouter executes the commands inside an isolated container and hands stdout, stderr and an exit code back to the model. Armed with that feedback, the model can respond to trouble—spot the error in a failing script and repair it before it answers.
curl https://openrouter.ai/api/v1/responses \
-H "Authorization: Bearer $OPENROUTER_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "deepseek/deepseek-v4-pro-0813",
"input": "Check the Python version, then write a script that prints the first 20 primes and run it.",
"tools": [
{ "type": "openrouter:shell", "parameters": { "engine": "openrouter" } }
]
}'Two compatible tools exist: openrouter:shell tracks the OpenAI spec while openrouter:bash tracks Anthropic’s. What separates them is where execution lands by default—the bash tool ordinarily asks your app to run commands locally, yet setting engine: "openrouter" on either one forces the work server-side.
Containers and files: the persistence layer
Each container is an isolated Linux environment scoped to your workspace. Outbound network access starts switched off; domains such as pypi.org can be allowlisted when you need package installs. Anything written under /workspace/home survives across requests that share a container ID, and every shell result hands back IDs for the files a command created or changed.
Moving data in and out is the Files API’s job. Upload a CSV with POST /api/v1/files, then attach it by ID in the tool’s environment. An attached file shows up in the container’s home directory as a writable copy, so changes made inside the container leave the original untouched. A generated file you want around long-term gets promoted from the container into workspace storage—and promoted files, unlike direct uploads, can be downloaded through the Files API.
Combining shell with other server tools
Shell sits alongside OpenRouter’s other server tools, web search among them. A model might search the web and then use shell to drop the results into a markdown file. The pairing earns its keep when you want the container to stay offline: web search happens outside the container, so the model can pull web content in and feed it to commands while the container keeps its default network policy and never touches the internet.
The same idea runs through the shift toward agentic infrastructure, where the platform absorbs the execution details so your attention stays on the agent’s logic instead of the plumbing.
Pricing and operational notes
Sandbox time runs $0.0001 per active second and gets billed along with the request. A cold container start carries a 30-second minimum, though only the first request in a sequence pays it. There is no separate charge for Files API usage, and total storage caps at 10 GiB. Containers sleep after 5 minutes idle, and container files are kept for 30 days unless promoted.
Workspace admins can disable server tools from the Server Tools page, a setting that covers every request the workspace makes. During beta the API may change, so treat it as a moving target for production use.