A
licenseNot graded
qualityD
maintenanceAn interactive Python code execution environment that allows users and LLMs to safely execute Python code and install packages in isolated Docker containers.
39
Apache 2.0
ipybox
by gradion-ai
The ipybox server provides a secure, sandboxed IPython kernel environment in a Docker container for executing Python code with state preservation across executions.
Execute Python code securely within a stateful IPython kernel that preserves variables, imports, and definitions across calls
Support direct execution of asynchronous Python code within the kernel's active event loop
Install Python packages at runtime using
!pip installcommandsUpload files from the host to the container's
/appdirectory for use in code executionDownload files from the container's
/appdirectory to retrieve results or generated artifactsStream code execution output as it is generated
Return plots generated with visualization libraries
Reset the IPython kernel to a clean state, clearing memory while preserving installed packages and files
Provides secure Python code execution in Docker containers with IPython kernels, supporting data analytics, package installation, and plot generation with configurable network restrictions
Enables safe execution of Python code through IPython kernels in sandboxed environments, supporting stateful code execution, package management, and visualization library output
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ipybox run this Python code to calculate the average of these numbers: [45, 67, 89, 23, 56]"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ipybox
mcp-name: io.github.gradion-ai/ipybox
ipybox is a unified execution environment for Python code, shell commands, and programmatic MCP tool calls.
Overview
ipybox executes code blocks in a stateful IPython kernel. A code block can contain any combination of Python code, shell commands, and programmatic MCP tool calls. Kernels can be sandboxed with sandbox-runtime, enforcing filesystem and network restrictions at OS level.
It generates Python APIs for MCP server tools via mcpygen, and supports application-level approval of individual tool calls and shell commands during code execution. ipybox runs locally on your computer, enabling protected access to your local data and tools.
NOTE
Next generation ipybox
This is the next generation of ipybox, a complete rewrite. Older versions are maintained on the 0.6.x branch and can be obtained with pip install ipybox<0.7.
Related MCP server: MCP Executor Server
Documentation:
š Documentation
šļø Architecture
š¤ llms.txt
š¤ llms-full.txt
Capabilities
Capability | Description |
Stateful execution | State persists across executions in IPython kernels |
Unified execution | Combine Python code, shell commands, and programmatic MCP tool calls in a code block |
Shell command execution | Run shell commands via |
Programmatic MCP tool calls | MCP tools called via generated Python API ("code mode"), not JSON directly |
Python tool API generation | Typed functions and Pydantic models generated from MCP tool schemas via mcpygen |
Application-level approval | Individual approval of tool calls and shell commands during code execution |
Lightweight sandboxing | Optional kernel isolation via Anthropic's sandbox-runtime |
Local execution | No cloud dependencies, everything runs locally on your machine |
Usage
Component | Description |
Python API for building applications on ipybox | |
ipybox as MCP server for code actions and programmatic tool calling | |
Plugin that bundles the ipybox MCP server and a code action skill |
TIP
Freeact agent
Freeact is a general-purpose agent built on ipybox.
Available Tools
4 toolsdownload_fileA
Download a file from the container's /app directory to the host filesystem.
Retrieves files created or modified during code execution from the container. The file at '/app/{relpath}' in the container will be saved to the specified location on the host.
Parent directories are created automatically if they don't exist.
Inputs: local_path (required), relpath (required).
execute_ipython_cellA
Execute Python code in a stateful IPython kernel within a Docker container.
The kernel maintains state across executions - variables, imports, and definitions
persist between calls. Each execution builds on the previous one, allowing you to
build complex workflows step by step. Use '!pip install package_name' to install
packages as needed.
The kernel has an active asyncio event loop, so use 'await' directly for async
code. DO NOT use asyncio.run() or create new event loops.
Executions are sequential (not concurrent) as they share kernel state. Use the
reset() tool to clear the kernel state and start fresh.
Returns:
str: Output text from execution, or empty string if no output.
Inputs: code (required), timeout. Returns: result
resetA
Reset the IPython kernel to a clean state.
Creates a new kernel instance, clearing all variables, imports, and definitions from memory. Installed packages and files in the container filesystem are preserved. Useful for starting fresh experiments or clearing memory after processing large datasets.
Inputs: no named parameters.
upload_fileA
Upload a file from the host filesystem to the container's /app directory.
Makes a file from the host available inside the container for code execution.
The uploaded file can then be accessed in execute_ipython_cell using the
path '/app/{relpath}'.
Inputs: local_path (required), relpath (required).
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelogā¦
TDQS
A4.4/5.0
Scored across 4 tools
Disambiguation5/5
Each tool has a clearly distinct purpose with no overlap: download_file retrieves files from container to host, execute_ipython_cell runs Python code in a persistent kernel, reset clears kernel state, and upload_file sends files from host to container. The boundaries are unambiguous, preventing agent misselection.
Naming Consistency5/5
All tool names follow a consistent verb_noun pattern (download_file, execute_ipython_cell, reset, upload_file) with clear, descriptive actions. Reset is a single verb but fits naturally as it describes a clear action without needing a noun, maintaining overall consistency in style and readability.
Tool Count5/5
With 4 tools, the server is well-scoped for its purpose of interactive Python execution in a container. Each tool earns its place by covering essential operations: file transfer (upload/download), code execution, and state management (reset). This count avoids bloat while providing complete workflow coverage.
Completeness5/5
The tool set provides complete coverage for the domain of container-based IPython execution. It supports the full lifecycle: uploading files, executing code with state persistence, resetting the environment, and downloading results. No obvious gaps exist; agents can perform end-to-end workflows without dead ends.
Maintenance
ActivityNo data
ResponsivenessOutdated data
Related MCP Connectors
Run Python code in a secure sandbox without local setup. Declare inline dependencies and execute sā¦
Hosted Python sandbox for package runtime verification: pip install and usable-import evidence.
Execution platform for AI agents on Firecracker microVMs in the EU. Interactive Linux sandboxes with root, templates for Python, Node.js, Go, Rust and a headless browser, public HTTPS URLs. Background jobs that outlive the connection, batches of up to 1,000 jobs with dependencies, hard cost caps reserved up front, execution receipts with SHA-256, log digests that fit the context. IPv4, dual-stack or IPv6-only with its own public address, allowlists or no network. WASI runtime for small tasks. Idle sandboxes sleep and keep their files. Also REST API, Python SDK and LangChain.
Run sandboxed Python for calculations and PDFs; no other languages, installs or network.
Related MCP Servers
- FlicenseNot gradedqualityNot gradedmaintenanceA secure server that enables code execution in isolated Docker environments, supporting Python with strict security constraints including network isolation, limited filesystem access, and resource limitations.-
- AlicenseAqualityDmaintenanceEnables code execution in isolated Docker containers with persistent IPython, Node.js, or R kernels, supporting file import/export and cross-session transfers via MCP tools.6MIT
- AlicenseNot gradedqualityDmaintenanceEnables LLMs to safely execute code in isolated Docker containers with resource limits and security controls, supporting session management and automatic dependency installation.MIT