sandbox_media

Lists the screenshots and recordings that steps left in every box of the account, stopped boxes included, oldest first, with a download URL for each. It only reads and never wakes a box.

Use it to gather what was built and checked over a period without knowing which boxes did it, for example last week's changes for a release note or a weekly report. It covers every box of the account, teammates' and stopped ones included, and is not limited to the 100 boxes sandbox_list shows.

sandbox_media { "since": "2026-09-28T00:00:00+08:00", "until": "2026-10-05T00:00:00+08:00" }
sandbox_media { "since": "2026-09-28T00:00:00+08:00", "query": "checkout", "limit": 50 }
sandbox_media { "since": "2026-09-28T00:00:00+08:00", "until": "2026-10-05T00:00:00+08:00", "cursor": "<nextCursor>" }

• since and until are RFC3339 times with a time zone offset; a step is listed when since ≤ its at < until. Without since the period starts 30 days back, the oldest screenshots kept (recordings only go back 7 days); without until it runs to now. There is no cap on how many steps a period holds: page through them. A time that is not RFC3339 is an error that says so.
• query keeps only the steps whose box name or goal, or whose own note or summary, contains the text, ignoring case. It is one piece of text matched as a whole, not words joined by or; it never looks at what is in the pictures. The names and goals you give boxes and the notes you give sandbox_exec are what make a period searchable later.
• A page holds limit steps, 20 by default and 50 at most. When there are more, pass nextCursor back as cursor, with the same since, until and query (limit may change); the last page has no nextCursor. A cursor does not expire.
• Each step has at (when the step was recorded, in UTC; for a command, when it ended), boxId, the box's boxName and goal, the step's kind (exec for a command, shot for sandbox_shot), summary (the command, or what was captured), note, and media[]: kind image or video, bytes, durationSec for a video, and url, a download URL valid for at least an hour; call again for fresh ones.
• Screenshots are kept 30 days after capture. Recordings are kept 7 days: after that a step that has a screenshot keeps only the screenshot, and a step that had only a recording (a sandbox_shot recording) is gone. So a job that gathers last week every Monday finds the screenshots of the whole week, but the recordings of its first day or two may already be gone.
• Only steps that left pictures are listed: a command gets them only when the box's screen changed while it ran, and a sandbox_shot with urls records one step without pictures (sandbox_shot). Steps hidden by sandbox_review with clearActivity: true are still listed: they leave the box's timeline, not the account. Pictures that were deleted are not: by DELETE /v1/boxes/{id}/media or DELETE /v1/boxes/{id}/events (which deletes hidden steps too).
• Only this account's boxes are listed: every box any key or teammate on the account started, never another account's. The call does not wake, use or take over any box, and uses no credits itself; stored pictures count toward stored files until they are deleted (Credits).
• It is an MCP tool only: over REST there is the per-box list below, with no call across boxes.
• One box's pictures, the list the app shows: GET /v1/boxes/{id}/media (REST). Which steps get pictures: sandbox_exec and sandbox_shot.

Every tool and topic is listed in the tool reference.