English Français العربية

Exec Sandbox

Official registry Other

Single exec tool running caller Python in a network-isolated locked-down sandbox.

Source code Documentation

What can you do with Exec Sandbox?

  • A non-zero exit_code or timed_out=true is a normal result, not a tool error. Only invalid
  • Sandbox v1: Python 3 with stdlib + PyYAML, Jinja2, Pillow, numpy, pandas, matplotlib.

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

OCI package docker.io/idconstruct/mcp-exec:v0.5.4
Claude Code 
claude mcp add exec-sandbox -e 'MCP_EXEC_TRANSPORT=stdio' -e 'MCP_EXEC_DEFAULT_TIMEOUT_S=30' -e 'MCP_EXEC_MAX_TIMEOUT_S=300' -e 'MCP_EXEC_MAX_OUTPUT_BYTES=1048576' -e 'MCP_EXEC_MAX_STDIN_BYTES=1048576' -e 'MCP_EXEC_AUTH_TOKEN=<your mcp_exec_auth_token>' -- docker run -i --rm docker.io/idconstruct/mcp-exec:v0.5.4
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "exec-sandbox": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "docker.io/idconstruct/mcp-exec:v0.5.4"
            ],
            "env": {
                "MCP_EXEC_TRANSPORT": "stdio",
                "MCP_EXEC_DEFAULT_TIMEOUT_S": "30",
                "MCP_EXEC_MAX_TIMEOUT_S": "300",
                "MCP_EXEC_MAX_OUTPUT_BYTES": "1048576",
                "MCP_EXEC_MAX_STDIN_BYTES": "1048576",
                "MCP_EXEC_AUTH_TOKEN": "<your mcp_exec_auth_token>"
            }
        }
    }
}

Environment variables

  • MCP_EXEC_TRANSPORT MCP transport. Must be 'stdio' for direct docker/stdio use.
  • MCP_EXEC_DEFAULT_TIMEOUT_S Default wall-clock timeout per exec, seconds.
  • MCP_EXEC_MAX_TIMEOUT_S Maximum wall-clock timeout a caller may request, seconds.
  • MCP_EXEC_MAX_OUTPUT_BYTES Cap on combined stdout/stderr before truncation.
  • MCP_EXEC_MAX_STDIN_BYTES Cap on stdin passed to the sandboxed code.
  • MCP_EXEC_AUTH_TOKEN secret Optional X-MCP-AUTH token (http/sse transports only).

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. mcp-exec
  2. The exec tool
  3. Security model (invariants)
  4. Run
  5. Configuration
  6. Not in v1
  7. License

mcp-exec

English | Русский

Public OSS MCP server (Go, MIT) exposing a single powerful tool — exec — that runs caller-supplied Python code in a network-isolated, locked-down sandbox and returns stdout / stderr / exit_code. It is the "code-execution mode" building block: instead of flooding an agent's context with hundreds of tool schemas, the agent writes code that orchestrates the work.

Works over three transports — stdio / HTTP / SSE — with an identical tool set everywhere (official modelcontextprotocol/go-sdk).

The exec tool

Input: { code: string (required), timeout_s?: int, stdin?: string } Output: { stdout, stderr, exit_code, duration_ms, truncated, timed_out }

  • A non-zero exit_code or timed_out=true is a normal result, not a tool error. Only invalid input (empty code, oversized stdin) is a tool-call error.
  • Sandbox v1: Python 3 with stdlib + PyYAML, Jinja2, Pillow, numpy, pandas, matplotlib.

Security model (invariants)

Per execution: no network, non-root, cap-drop=ALL, no-new-privileges, read-only rootfs, no CAP_SYS_ADMIN, ephemeral tmpdir (cleaned up), wall-clock timeout (kills the whole process-group), memory/PID/CPU limits, capped output (1 MiB → truncated). Runs are serialized within an instance; scale out with replicas. Caller data (code/stdin/output) is never persisted and never logged in full — only metadata.

exec is the most powerful surface there is. When embedding it in an agent, gate it behind that agent's tool-policy (trusted roles only).

Network note: --network none only applies to stdio. In HTTP/SSE the container needs networking to serve its port, so sandboxed code would inherit egress — deny it at the orchestrator. In k8s, a NetworkPolicy that allows ingress to the port and denies all egress:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: mcp-exec-lockdown }
spec:
  podSelector: { matchLabels: { app: mcp-exec } }
  policyTypes: [Ingress, Egress]
  ingress: [{ ports: [{ port: 8080 }] }]
  egress: []   # deny all egress → sandbox has no network

Run

go build -o mcp-exec ./cmd/mcp-exec
MCP_EXEC_TRANSPORT=stdio ./mcp-exec

Docker (recommended production posture):

docker run --rm -i --network none --read-only --cap-drop ALL \
  --security-opt no-new-privileges --user 65532:65532 \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  --memory 256m --pids-limit 128 --cpus 1 \
  idconstruct/mcp-exec

--tmpfs /tmp is required: the rootfs is read-only, and each run needs a writable ephemeral workspace (cleaned up after).

Optional auth (HTTP/SSE)

Set MCP_EXEC_AUTH_TOKEN to require every HTTP/SSE request to carry a matching X-MCP-AUTH header (constant-time compare; 401 otherwise). Empty token disables it. Not applicable to stdio.

Configuration

Env varPurposeDefault
MCP_EXEC_TRANSPORTstdio \http \ssestdio
MCP_EXEC_ADDRlisten address for http/sse:8080
MCP_EXEC_DEFAULT_TIMEOUT_Sdefault wall-clock timeout30
MCP_EXEC_MAX_TIMEOUT_Stimeout ceiling300
MCP_EXEC_MAX_OUTPUT_BYTEScombined stdout+stderr cap1048576
MCP_EXEC_MAX_STDIN_BYTESstdin size cap1048576
MCP_EXEC_PYTHONinterpreter pathpython3
MCP_EXEC_AUTH_TOKENif set, http/sse require X-MCP-AUTH header (constant-time); empty = off``

Not in v1

bash / multi-language, network from the sandbox, proxying other MCP servers into the sandbox.

License

MIT.

Frequently asked questions

What is Exec Sandbox?

Single exec tool running caller Python in a network-isolated locked-down sandbox.

How do I install Exec Sandbox?

It runs on your machine. In Claude Code: claude mcp add exec-sandbox -e 'MCP_EXEC_TRANSPORT=stdio' -e 'MCP_EXEC_DEFAULT_TIMEOUT_S=30' -e 'MCP_EXEC_MAX_TIMEOUT_S=300' -e 'MCP_EXEC_MAX_OUTPUT_BYTES=1048576' -e 'MCP_EXEC_MAX_STDIN_BYTES=1048576' -e 'MCP_EXEC_AUTH_TOKEN=<your mcp_exec_auth_token>' -- docker run -i --rm docker.io/idconstruct/mcp-exec:v0.5.4. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Exec Sandbox need an API key?

Yes. It expects MCP_EXEC_AUTH_TOKEN, which you set in its configuration.

Is Exec Sandbox open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains Exec Sandbox?

It is published by inhuman. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.