diff --git a/templates/base/sandbox.sh b/templates/base/sandbox.sh
index f2882db..bf95565 100755
--- a/templates/base/sandbox.sh
+++ b/templates/base/sandbox.sh
@@ -4,7 +4,8 @@ set -e
 echo "🔒 Initializing AI Sandbox with Pipelock Egress Firewall..."
 
 # Start supporting services (database, migrations, backend, and pipelock firewall)
-docker compose -f docker-compose.yml -f docker-compose.sandbox.yml up -d db migration backend pipelock
+docker compose -f docker-compose.yml -f docker-compose.sandbox.yml up -d --wait db migration backend pipelock
+"$(dirname "${BASH_SOURCE[0]}")/urls.sh"
 
 # Ensure backend Python dependencies are installed in the sandbox venv if python backend exists
 if [ -f backend/requirements.txt ]; then
diff --git a/templates/base/start.sh b/templates/base/start.sh
index c92ce5c..1d26d7a 100755
--- a/templates/base/start.sh
+++ b/templates/base/start.sh
@@ -46,15 +46,7 @@ docker compose up -d --build --wait "${PASS_ARGS[@]}" || {
   exit 1
 }
 
-FRONTEND_URL="http://localhost:${FRONTEND_PORT:-3000}"
-BACKEND_URL="http://localhost:${BACKEND_PORT:-8000}"
-
-echo ""
-echo "✅ Fullstack services are up and running:"
-echo "   • Frontend: $FRONTEND_URL"
-echo "   • Backend:  $BACKEND_URL"
-echo "   • Database: localhost:${POSTGRES_PORT:-5432}"
-echo ""
+"$(dirname "${BASH_SOURCE[0]}")/urls.sh"
 
 # Reopen directly in DevContainer window if interactive and editor is available
 if [ "$NO_OPEN" != "true" ] && [ -z "$CI" ] && [ -t 1 ]; then
diff --git a/templates/base/urls.sh b/templates/base/urls.sh
new file mode 100755
index 0000000..224b086
--- /dev/null
+++ b/templates/base/urls.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Prints the addresses of all running services. Usage: ./urls.sh
+cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
+
+if [ -f .env ]; then
+  export $(grep -E '^(FRONTEND_PORT|BACKEND_PORT|POSTGRES_PORT)=' .env 2>/dev/null | xargs) || true
+fi
+
+FRONTEND_URL="http://localhost:${FRONTEND_PORT:-3000}"
+BACKEND_URL="http://localhost:${BACKEND_PORT:-8000}"
+
+echo ""
+echo "✅ Fullstack services are up and running:"
+echo "   • Frontend:  $FRONTEND_URL"
+echo "   • Backend:   $BACKEND_URL"
+# Only FastAPI serves interactive API docs; probe so we don't print dead links
+if command -v curl >/dev/null 2>&1 && curl -fs -o /dev/null "$BACKEND_URL/docs"; then
+  echo "   • API docs:  $BACKEND_URL/docs"
+fi
+echo "   • Database:  localhost:${POSTGRES_PORT:-5432}"
+echo "   • Pipelock:  http://localhost:8888 (egress proxy, no UI — logs: docker compose logs -f pipelock)"
+echo ""