diff --git a/README.md b/README.md
index a975f18..0c4586a 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,7 @@ claude mcp add mcqemu -- uv run --directory /path/to/mcqemu mcqemu
 | Group | Tools |
 |---|---|
 | Lifecycle | `launch_vm`, `stop_vm`, `pause_vm`, `resume_vm`, `attach_vm`, `forget_vm` |
+| Sandboxes | `sandbox_vm` (overlay + launch + wait-for-agent in one call), `sandbox_destroy` |
 | Inspect | `list_vms`, `vm_info` |
 | Live snapshots | `vm_snapshot_create` / `restore` / `delete` / `list` |
 | See & drive | `vm_screenshot` (PNG), `vm_send_keys`, `vm_type_text`, `vm_click`, `vm_serial_read` |
@@ -40,13 +41,28 @@ Guest tools (`guest_*`) need `qemu-guest-agent` installed inside the guest OS;
 the host-side virtio-serial channel is wired on every launch, so installing
 the agent in the guest is the only step.
 
+Port forwards accept `"2222:22"` (explicit, collision-checked up front),
+`"auto:22"`, or just `"22"` — auto forms pick a free host port and the launch
+result reports what was chosen.
+
 ## Quick start
 
+Disposable sandbox from any base image with `qemu-guest-agent` inside:
+
+```
+sandbox_vm(base_image="~/vms/ubuntu-agent.qcow2")
+# -> overlay created, VM booted, agent waited for, free port forwarded to 22
+guest_exec(name="sandbox", command="uname", args=["-a"])
+sandbox_destroy(name="sandbox")   # stops VM, deletes overlay; base untouched
+```
+
+Installing an OS from scratch:
+
 ```
 image_create(path="~/vms/test.qcow2", size="10G")
 launch_vm(name="test", disks=["~/vms/test.qcow2"], iso="~/isos/alpine.iso",
-          port_forwards=["2222:22"])
-# ... install the OS via the serial console log ...
+          port_forwards=["auto:22"])
+# ... drive the installer with vm_screenshot / vm_type_text / vm_send_keys ...
 stop_vm(name="test")
 launch_vm(name="test", disks=["~/vms/test.qcow2"])
 guest_exec(name="test", command="uname", args=["-a"])