Glossary
The terms behind running AI agents safely, defined in plain words and then explained as Ephemeral does them. Ephemeral is a hosted service, CLI and MCP server that runs AI agent tasks in disposable microVMs.
MicroVM
A microVM is a very small virtual machine that has its own kernel and its own memory, started in a fraction of a second with only the devices it needs. Because the guest does not share a kernel with the host or with other guests, a microVM isolates untrusted code more strongly than a container does, while staying much lighter to start and discard than a traditional virtual machine. Cloud providers use microVMs to run many customers' functions and workloads side by side without letting one see another.
In Ephemeral, every run starts its own microVM from a fixed worker image and destroys it when the run ends; the run's record shows when the destruction was confirmed. No machine, file or process is shared between runs or between organizations, and the machine has no direct internet access and none of your credentials. See isolation and runs.
Sandbox
A sandbox is a restricted environment in which a program can run without being able to harm or even observe the rest of the system. It limits what the program can read, write and reach on the network, so that code which is untrusted, generated or simply buggy can be executed safely. Sandboxes range from operating-system features and containers to full virtual machines, and the strength of the isolation, the way they are discarded afterwards and what they are allowed to reach decide how safe they are.
In Ephemeral, the sandbox is a microVM that exists for one run only. Inside it the agent can read the files you mounted and, if the shell is on, run commands in a scratch directory that disappears with the machine. Anything outside goes through a connection or web access that Ephemeral checks, so a run can only reach what you allowed. See running untrusted code and the FAQ.
Credential broker
A credential broker is a service that holds secrets such as API tokens on behalf of a workload and attaches them to outgoing requests, so the workload itself never sees them. The caller names the target and the operation; the broker checks that this is allowed, adds the credential, forwards the request and returns the response. This keeps secrets out of prompts, logs and the machine that runs possibly untrusted code, and means that a leaked or manipulated workload cannot copy a token it never held.
In Ephemeral, a connection is a saved HTTP API or MCP server whose credentials Ephemeral holds and injects. The agent learns each connection's name, type and tools, never its URL or secrets, and every call is checked against the run's allow-list of methods or tools, so a read-only connection really is read-only. The exact credential values are also removed from responses and events. See connections.
Run budget
A run budget is a hard spending limit set for one execution of an AI agent, covering model calls, compute and tool use. Agents decide for themselves how many steps to take, so without a limit a loop or a mistake can cost far more than intended. A budget that is reserved before the work starts, and that refuses any call which could exceed it, turns the worst-case cost into a number you know in advance rather than a surprise on an invoice.
In Ephemeral, max_cost_micros is the budget of a run. The whole amount is reserved from your prepaid credits before the run starts, a model call or web request that could take the run past it is refused before it is sent, and the unused part is released when billing settles. A run cannot spend more than its budget, and its exact final cost is recorded. See budgets and billing and pricing.
Zero data retention (ZDR)
Zero data retention, often shortened to ZDR, means that a service processes a request and then stores none of its content: no prompts, no outputs and no logs of what was said. For AI work it applies on two levels, the platform that runs the task and the model provider that answers the prompts. It is used for sensitive material such as personal, financial or confidential data, where the safest copy of the data is the one that was never kept.
In Ephemeral, zero data retention is a setting on a run or a workflow. Such a run uses only model endpoints that neither keep nor train on the request, its events are deleted minutes after it ends, its output is returned once and deleted after at most an hour, and its definition is not kept. It costs 10% more on the hosted service. See what is stored and for how long and runs.
Signed callback
A signed callback, also called a signed webhook, is an HTTP request that a service sends to your server when something happens, together with a cryptographic signature computed from the message and a shared secret. The receiver recomputes the signature and compares it, which proves that the message came from the service and was not changed on the way. Without a signature, anyone who learns the callback address could send a forged event to your system.
In Ephemeral, a run can carry a callback URL and secret. When the run ends, Ephemeral sends the result to the URL with an X-Ephemeral-Signature header, an HMAC-SHA256 of the timestamp and the raw body keyed with your secret, so your server hears about completion without polling. See the callbacks API.
MCP server
An MCP server is a program that exposes tools, data and prompts to AI applications through the Model Context Protocol, an open standard for connecting models to the outside world. A client such as an AI assistant or a code editor connects to the server, lists the tools it offers with their input schemas, and calls them on the model's behalf. Servers can run locally or be reached remotely over HTTP, and they let one tool work with many different AI clients.
Ephemeral is an MCP server, and it also calls them. As a server it lets Claude, ChatGPT, Cursor and other clients start runs, wait for results and manage workflows and schedules over Streamable HTTP, with an API key or OAuth sign-in. As a client, a run can use your MCP servers as connections, limited to the tools you allow. See the MCP server documentation.
Workflow
A workflow is a repeatable task definition that is saved under a name and started later with new input. Instead of rewriting the instructions each time, a program refers to the workflow by name and passes only what changes. When the workflow also declares the shape of its input and output, other programs and AI agents can call it correctly without reading the instructions inside it.
In Ephemeral, a workflow is a run definition saved under a name: the prompt, model, files, connections, web access and timeout. It can carry a description and JSON Schemas for its input and output, and a run that does not match its output schema fails. You start it by name from the API, the CLI or MCP, and a schedule can start it on a timetable. See workflows and use cases.
Schedule
A schedule starts work automatically at set times, usually written as a cron expression with a time zone. A cron expression has fields for minute, hour, day of month, month and day of week, so a single line can mean every Monday at 09:00 or every fifteen minutes. Time zones matter, because a report due at nine in the morning means different instants in Madrid and in Tokyo, and daylight saving shifts the hour twice a year.
In Ephemeral, a schedule starts a saved workflow on a cron timetable in any time zone, with optional input and a cost cap. You can preview the next start times before saving, pause and resume it, run it now, and read the outcome of each start. See schedules and the scheduled reports use case.
Prompt injection
Prompt injection is an attack in which text that an AI model reads, such as a web page, an email or a support ticket, contains instructions that try to override the ones its operator gave. Because a model cannot reliably tell data from commands, an agent that reads untrusted content may be talked into leaking information or taking actions its owner never intended. The most dependable defence is to limit what a manipulated agent could possibly do, rather than to trust it to resist.
In Ephemeral, the limits are enforced outside the model. A run holds no credentials, can call only the connections, methods, tools and websites you allowed, has a hard budget, and runs in a machine that is destroyed afterwards. Web requests are also checked for attacks and for data being smuggled out. See web access and the FAQ.
Idempotency key
An idempotency key is a unique value that a client sends with a request so that the server can recognise a retry of the same operation and not perform it twice. Networks fail in ways that leave the client unsure whether a request arrived, and retrying a request that creates something, such as a payment or a job, could create it twice. With a key, the server returns the result of the first attempt for every later request that carries the same key.
In Ephemeral, you can send an Idempotency-Key header with POST /v1/runs, or an idempotency_key with the MCP create_run tool, so that a retry after a timeout returns the original run instead of starting and billing a second one. See the runs API and the API overview.