Skip to main content
Glama

Sandbox MCP

AI coding agents are powerful because they can execute code. That is also their biggest risk: experimentation can modify the developer's environment.

An agent that is genuinely useful has to be able to run npm install, apply a migration, try a build, or run code it has not read. Every one of those actions, performed on your machine, can install something you did not want, overwrite work in progress, burn your CPU, read your credentials, or leave behind an environment that no longer builds.

The usual answers are both bad. Deny the agent those tools and it can only guess. Allow them and you are trusting a probabilistic system with your laptop.

Sandbox MCP is the third answer: give the agent somewhere real to work that is not your machine.

"Experiment with this project, but don't touch my actual environment."


Without a sandbox

flowchart TD
    CC["Claude Code"] --> HOST["Your machine"]
    HOST --> A["npm install"]
    HOST --> B["scripts"]
    HOST --> C["migrations"]
    HOST --> D["file modifications"]
    HOST --> E["arbitrary execution"]

    classDef danger fill:#fdeceb,stroke:#d1453b,color:#7a1f18
    classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
    class HOST,A,B,C,D,E danger
    class CC actor

Related MCP server: anvil

With Sandbox MCP

flowchart TD
    CC["Claude Code"] --> MCP["FastMCP"]
    MCP --> POL["Experiment policy"]
    POL --> SBX["Docker sandbox"]
    SBX --> WORK["execute · modify · test<br/>build · experiment"]
    WORK --> RES["Results"]
    RES --> CC

    classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
    classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
    class SBX,WORK safe
    class CC,MCP,POL,RES actor

What makes this different from a Docker MCP server

Existing Docker MCP implementations expose Docker operations to AI agents. Sandbox MCP exposes an experimentation abstraction.

That is not a wording preference; it changes what the agent can do.

A Docker MCP server

Sandbox MCP

Tools

docker_run, docker_exec, docker_ps

create_experiment, run_tests, inspect_changes

The agent decides

flags, mounts, network mode, privileges

what it wants to find out

Isolation

whatever the agent passed

enforced by policy before Docker is called

Host filesystem

reachable via -v $(pwd):/app

not reachable; the project is snapshot-copied

"What changed?"

ask the agent to diff it

inspect_changes, against a baseline taken pre-container

Failure mode

an agent that mounts / writable

a request the policy engine rejects

The agent never receives Docker API access. It states an intent; the server decides how that intent is realised.

flowchart TB
    CC["Claude Code"] -- "MCP tool call" --> SERVER

    subgraph SERVER["Sandbox MCP · the only component holding the socket"]
        direction LR
        POL["Policy / Security<br/><i>validates · clamps · refuses</i>"]
        EXP["Experiment Manager<br/><i>lifecycle · state machine</i>"]
        JOB["Job Manager<br/><i>async · timeouts · cancellation</i>"]
        COL["Result Collector<br/><i>diffs · artifacts · reports</i>"]
        POL --> EXP --> JOB --> COL
    end

    SERVER --> API["Docker Engine API<br/><i>/var/run/docker.sock — SDK only, no docker CLI</i>"]
    API --> SBX["Disposable sandbox<br/><i>no socket · no host filesystem · no network</i>"]
    SBX --> OUT["Structured result<br/><i>back to Claude Code</i>"]

    classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
    classDef infra fill:#eaf1fb,stroke:#3a6ea8,color:#173352
    classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
    class CC,POL,EXP,JOB,COL,OUT actor
    class API infra
    class SBX safe
    style SERVER fill:#fbfcfd,stroke:#9aa7b4,color:#22303f

Docker is the isolation mechanism. MCP is the agent interface. Sandbox MCP is the experimentation layer.

There is deliberately no orchestrator here. The agent already is one: Claude Code plans, reads output, forms a hypothesis and retries better than any loop this server could ship. Putting a second, dumber loop underneath it would only compete with the caller. This project's job is the surface the agent drives — and making that surface one it cannot hurt you with.


The central abstraction: an experiment

Experiment:      exp_2859b8eb8656
Project:         payments-service
Base image:      node:22-slim
Network:         disabled
CPU:             2 cores
Memory:          1GB
Timeout:         300s
Status:          READY

Commands:        1. npm install --no-audit --no-fund   (exit 1, EBADENGINE)
                 2. npm install --no-audit --no-fund   (exit 0)
                 3. npm test                           (37 passed, 3 failed)
                 4. npm test                           (40 passed, 0 failed)

Changes:         3 files modified, +9 -4

Experiments move through an explicit, validated state machine. An illegal transition is an error, not a silently corrupted record — which matters, because DESTROYED is what tells the server a container no longer exists.

stateDiagram-v2
    direction TB
    [*] --> CREATING
    CREATING --> READY: sandbox provisioned
    READY --> RUNNING: command submitted
    RUNNING --> READY: exit 0

    state "terminal, but the sandbox is still alive" as OUTCOME {
        direction LR
        COMPLETED
        FAILED
        TIMEOUT
        CANCELLED
    }

    CREATING --> FAILED: could not start
    RUNNING --> OUTCOME
    OUTCOME --> RUNNING: more work
    OUTCOME --> DESTROYED: destroy_experiment
    READY --> DESTROYED: destroy_experiment
    DESTROYED --> [*]

Security model

The Docker socket is a highly privileged interface — access to it is effectively root on the host. It is held by the server and by nothing else. The agent talks to the server; the server talks to Docker.

Filesystem

The project is copied, not mounted:

flowchart LR
    HOST["HOST PROJECT<br/><i>read once, never written</i>"]
    SNAP["SANDBOX COPY<br/><i>also the baseline every diff uses</i>"]
    CON["DOCKER CONTAINER"]

    HOST -- "snapshot: filtered, read-only pass" --> SNAP
    SNAP -- "put_archive" --> CON
    CON -. "no path back" .-x HOST

    classDef host fill:#fdeceb,stroke:#d1453b,color:#7a1f18
    classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
    class HOST host
    class SNAP,CON safe
  • Default strategy is COPY_TO_SANDBOX. READ_ONLY_BIND_MOUNT exists for large repositories you only need to read. Writable host bind mounts are not implemented — there is no configuration that produces one.

  • .env files, *.pem, *.key, id_rsa*, .netrc, .ssh/, .aws/, .gnupg/, .kube/ and similar are never copied, regardless of configuration. Build output (node_modules, dist, target, …) is skipped by default and that list is configurable.

  • Project paths are resolved before they are checked, so a symlink cannot launder a denied location. The home directory and filesystem root are refused outright.

  • Paths inside the sandbox are confined to the workspace: ../../etc/passwd and /etc/shadow are rejected by every tool that takes a path.

One deliberate exception worth knowing: .npmrc is copied, because the real behaviour of npm install often depends on it. If yours holds an _authToken, add it to SANDBOX_MCP_SNAPSHOT_EXCLUDES.

Network

Disabled by default. network_mode is an explicit decision at creation time:

Mode

Behaviour

none

No interfaces at all. The default.

restricted

A private bridge network of its own — egress works, no reach to other sandboxes

enabled

The daemon's default bridge. Full egress.

restricted prevents lateral movement between sandboxes. It does not firewall egress; per-experiment network allowlists are listed under future extensions.

Environment variables

The host environment is never inherited. Variables cross the boundary only when named: "CI" forwards the host's value, "NODE_ENV=test" injects a literal.

Credential-shaped names (*_TOKEN, *_SECRET, *API_KEY*, AWS_*, DATABASE_URL, …) are refused even when explicitly allowlisted, because an agent asking for AWS_SECRET_ACCESS_KEY inside a throwaway container is never right. Set SANDBOX_MCP_STRICT_ENV_DENYLIST=false if you disagree.

Values are never written to the database or the logs — only names.

Container privileges

  • privileged=False, always. There is no setting that changes it.

  • cap_drop: ALL, then a small set added back: CHOWN, DAC_OVERRIDE, FOWNER, FSETID, SETUID, SETGID, KILL. That is what package managers actually need (they chown caches and drop privileges for lifecycle scripts). It excludes NET_RAW, MKNOD, SYS_ADMIN, SYS_CHROOT, SETPCAP and SETFCAP — the ones that matter for escape.

  • no-new-privileges:true.

  • The Docker socket is never mounted into a sandbox. There is no code path that does it, and an integration test asserts its absence.

  • SANDBOX_MCP_SANDBOX_USER runs containers as a non-root user where the toolchain tolerates it.

Resource limits

Every sandbox is capped, and a request may only ask for less than the configured ceiling. Asking for more is clamped, and the clamp is returned to the agent as a warning rather than failing silently.

Limit

Default

Ceiling

Enforced by

CPU

2 cores

4 cores

NanoCpus

Memory

2GB

8GB

Memory and MemorySwap (no swap escape)

Processes

512

2048

PidsLimit

Wall clock

120s

1800s

the job manager, which kills the process

/tmp

512MB

tmpfs

Captured output

1MB/stream

truncated, and flagged as truncated


Installation

Requires Python 3.12+ and a running Docker engine (Docker Desktop, OrbStack, Colima or Rancher Desktop).

git clone https://github.com/AbhiteshPundir/sandbox-mcp.git
cd sandbox-mcp
uv sync                     # exact versions from uv.lock

Confirm the server can reach Docker before wiring it to anything:

uv run sandbox-mcp --check
{
  "docker_host": "unix:///var/run/docker.sock",
  "state_dir": "/Users/you/.sandbox-mcp",
  "defaults": { "base_image": "debian:bookworm-slim", "network_mode": "none", ... },
  "docker": { "server_version": "29.4.0", "api_version": "1.54" },
  "ok": true
}

ok: false with DOCKER_UNAVAILABLE means the daemon is not running or the socket is somewhere unusual. The server probes /var/run/docker.sock, ~/.docker/run/docker.sock, ~/.orbstack/run/docker.sock, ~/.colima/default/docker.sock and ~/.rd/docker.sock in that order — the Docker CLI's context is not consulted, so set DOCKER_HOST explicitly if yours is elsewhere.

Optional extras:

uv sync --extra dev     # pytest, ruff, mypy

Connecting Claude Code

claude mcp add sandbox -- uv --directory /absolute/path/to/sandbox-mcp run sandbox-mcp

Or, if you installed it into an environment already on your PATH:

claude mcp add sandbox -- sandbox-mcp

Then, inside Claude Code:

/mcp                       # should list "sandbox" as connected

Equivalent .mcp.json, if you prefer to commit the configuration:

{
  "mcpServers": {
    "sandbox": {
      "command": "uv",
      "args": ["--directory", "/absolute/path/to/sandbox-mcp", "run", "sandbox-mcp"],
      "env": {
        "SANDBOX_MCP_LOG_LEVEL": "INFO"
      }
    }
  }
}

Remote (Streamable HTTP)

uv run sandbox-mcp --transport http --host 127.0.0.1 --port 8000
claude mcp add --transport http sandbox http://127.0.0.1:8000/mcp

Or run the server itself in a container:

docker compose up -d
claude mcp add --transport http sandbox http://127.0.0.1:8000/mcp

The compose file mounts the Docker socket into the server — read the warning at the top of it first, and do not expose port 8000 beyond localhost without authentication in front of it.

flowchart TD
    CC["Claude Code"] --> SRV["Sandbox MCP<br/><i>holds the socket</i>"]
    SRV --> ENG["Docker Desktop / OrbStack"]
    ENG --> SBX["Sandbox<br/><i>no socket · no host filesystem · no network</i>"]

    classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
    classDef infra fill:#eaf1fb,stroke:#3a6ea8,color:#173352
    classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
    class CC,SRV actor
    class ENG infra
    class SBX safe

Tools

Tool

Purpose

create_experiment

Create a disposable environment and copy a project into it

execute_experiment

Run a command inside the sandbox (sync or background)

run_tests

Detect the test runner, run it, parse the results

read_sandbox_file

Read a file from the sandbox to investigate a failure

write_sandbox_file

Apply a candidate fix without shell-quoting hazards

inspect_changes

What changed, against the pre-container baseline

collect_artifacts

Lift build output, reports or logs out before teardown

get_experiment

Full state and a summary of what happened

list_experiments

Find earlier experiments, including ones left running

get_job_status

Poll a background command

get_job_result

Fetch a completed background result

cancel_job

Stop a running command and kill its process

destroy_experiment

Tear down; idempotent; returns the final report

compare_experiments

Rank several approaches and recommend one

check_sandbox_runtime

Confirm Docker is reachable and show the active policy

Notably absent: docker_run, docker_exec, docker_ps, docker_build, docker_pull. A test asserts that no tool name begins with docker_.

Resources

sandbox://experiments                              all experiments
sandbox://experiments/{experiment_id}              metadata + state history
sandbox://experiments/{experiment_id}/logs         every command, with output
sandbox://experiments/{experiment_id}/diff         unified diff
sandbox://experiments/{experiment_id}/artifacts    collected files

The primary demo: Node 20 → Node 22

examples/node-upgrade/ is a real, dependency-free Node library pinned to Node 20. It fails on Node 22 for two independent and entirely realistic reasons:

  1. package.json declares engines.node: ">=18 <21" and .npmrc sets engine-strict=true, so npm install fails with EBADENGINE before a single test runs.

  2. src/crypto.js calls crypto.createCipher, deprecated since Node 10 and removed in Node 22.0.0.

Ask Claude Code:

Determine whether examples/node-upgrade can be upgraded from Node 20 to Node 22. You may install dependencies, modify files, run tests and experiment freely, but do not modify my actual working tree.

What happens — every figure below is from an actual run, and the whole thing works with the network disabled:

sequenceDiagram
    autonumber
    participant CC as Claude Code
    participant S as Sandbox MCP
    participant D as Disposable sandbox

    CC->>S: create_experiment(node:22-slim, network none)
    S->>D: snapshot 13 files, start container
    S-->>CC: exp_2859b8eb8656 · READY

    CC->>S: execute_experiment("npm install")
    S-->>CC: exit 1 · EBADENGINE
    CC->>S: read_sandbox_file("package.json")
    S-->>CC: engines.node ">=18 <21"
    CC->>S: write_sandbox_file("package.json", ">=18")
    CC->>S: execute_experiment("npm install")
    S-->>CC: exit 0

    CC->>S: run_tests()
    S-->>CC: 37 passed · 3 failed<br/>seal produces hex output<br/>seal and open round-trip<br/>seal round-trips unicode
    CC->>S: read_sandbox_file("src/crypto.js")
    S-->>CC: crypto.createCipher(...)
    CC->>S: write_sandbox_file("src/crypto.js", createCipheriv + scrypt key + IV)
    CC->>S: run_tests()
    S-->>CC: 40 passed · 0 failed

    CC->>S: inspect_changes()
    S-->>CC: 3 modified · +9 -4
    CC->>S: collect_artifacts(["src/crypto.js"])
    S-->>CC: kept for the developer
    CC->>S: destroy_experiment()
    S->>D: remove container and snapshot
    S-->>CC: report · host working tree UNCHANGED
Experiment:         Node 20 → Node 22
Result:             COMPATIBLE (with 2 source changes)
Tests:              40 passed, 0 failed
Changes:            3 files modified (+9 -4)
Host working tree:  UNCHANGED
Sandbox:            DESTROYED

That last pair of lines is the product. This exact sequence runs as a test:

uv run pytest tests/integration/test_node_upgrade_demo.py -m integration

Other things this makes possible

  • Dependency upgrade — "try upgrading React to the latest compatible version; don't modify my working tree." Needs network_mode="restricted" to reach the registry.

  • Database migration — create an experiment on postgres:16, run the migration, report whether it applied, destroy it.

  • Build debugging — "work out why this build fails; experiment freely."

  • Multi-approach debuggingexamples/failing-project/ is a Python project whose money arithmetic is done in floats; 3 of its 14 tests fail. Three fixes are plausible (round(), Decimal, truncation) and they are not equivalent. Run each in its own experiment, then call compare_experiments, which ranks them on failures, exit code, change size and duration, and recommends one.


Why there is no orchestration layer

An earlier cut of this server shipped a LangGraph loop — plan, test, diagnose, fix, retest — behind a run_autonomous_experiment tool. It was removed, on purpose.

The caller is already an agent. Claude Code reads a failing test, forms a hypothesis, edits a file and retries; it does that better than a graph of hardcoded repair strategies ever will, because it has judgement and the strategies had a lookup table. Shipping a second, weaker loop underneath a strong one does not add a capability — it competes with the caller for the same decision, and it is the one more likely to be wrong.

What is left is the part the agent genuinely cannot do for itself: the isolation boundary, the policy that enforces it, the state machine, the baseline diff, and the audit trail. Those are the product.

Concretely, the loop lives in the transcript instead of inside the server:

flowchart LR
    DEC["Decide the next step<br/><i>Claude Code — the loop lives here</i>"]
    ACT["Call a tool"]
    SRV["Sandbox MCP<br/><i>enforces · refuses · records</i>"]
    OBS["Read the full output"]

    DEC --> ACT --> SRV --> OBS --> DEC

    classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
    classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
    class DEC,ACT,OBS actor
    class SRV safe

That is the primary demo, and it is what the integration suite runs.

Observability

Every operation emits a structured JSON event to stderr (stdout carries the MCP protocol under stdio transport):

{"event": "command_completed", "experiment_id": "exp_2859b8eb8656",
 "job_id": "job_4f1c8a2b90de", "operation": "job.run", "status": "COMPLETED",
 "exit_code": 0, "duration_ms": 1432, "timestamp": "2026-09-07T10:29:41Z"}

Credential-shaped keys are scrubbed at the processor level, so no individual call site can leak by forgetting.

Everything needed to answer "what exactly did the agent do?" is persisted in SQLite (~/.sandbox-mcp/sandbox.db): experiments, jobs with their commands, exit codes and captured output, state transitions with timestamps and reasons, artifacts with checksums, the pre-container baseline, and the change statistics — which are written before teardown, so a destroyed experiment is still comparable against a live one.

The database stores no secrets: environment variable names, never values.


Project layout

src/sandbox_mcp/
├── server.py            MCP tools and resources — the agent-facing surface
├── app.py               composition root; the only place the graph is wired
├── config.py            every tunable, in one auditable place
├── models.py            domain models (experiments, jobs, changes, reports)
├── errors.py            structured errors; no traceback ever reaches a client
├── logging.py           structured logging to stderr, with redaction
├── sandbox/
│   ├── interface.py     SandboxBackend — the seam other runtimes target
│   └── docker.py        Docker Engine API via the SDK; all hardening lives here
├── experiments/
│   ├── manager.py       the domain core
│   ├── state.py         the validated state machine
│   ├── repository.py    ExperimentRepository + the SQLite implementation
│   ├── changes.py       diffing the sandbox against its baseline
│   └── testing.py       test-runner detection and output parsing
├── execution/
│   ├── manager.py       job lifecycle: timeouts, cancellation, persistence
│   ├── jobs.py          live task registry and concurrency limits
│   └── executor.py      JobExecutor interface + the sandbox implementation
├── artifacts/manager.py pulling files out before teardown
└── security/
    ├── policy.py        validates and clamps every request
    ├── filesystem.py    path confinement and snapshotting
    └── resources.py     limit parsing

SandboxBackend, ExperimentRepository and JobExecutor are abstract. Docker implements the first; the MCP tool surface does not know it exists. Supporting Firecracker, Kubernetes Jobs or remote workers means one new implementation and no change to the agent-facing API — the in-memory FakeSandboxBackend the unit tests run against is the proof that the seam is real.

Three deviations from a literal reading of the brief, all deliberate: experiments/changes.py and experiments/testing.py exist as focused modules rather than being folded into manager.py; commands/results are columns on the jobs table rather than separate tables, since a job is a command and its result; and there is no orchestration/ package, for the reason given above.


Development

uv sync --extra dev

uv run pytest -m "not integration"     # 225 unit tests, no Docker needed
uv run pytest -m integration           # 23 tests against a live daemon
uv run pytest                          # everything

uv run ruff check . && uv run ruff format --check .
uv run mypy

The unit suite runs against FakeSandboxBackend and needs no daemon. The integration suite is the one that proves the product claim: the nine-step isolation checklist, the host tree unchanged byte-for-byte, the network genuinely off, secrets genuinely absent, the memory cap actually biting, timeouts killing the process, cancellation killing the process, hardening flags present on the real container, orphan containers swept at startup, and the full Node 20 → 22 demo.


MVP boundaries

Not built, on purpose: a web dashboard, authentication, cloud infrastructure, Kubernetes support, distributed scheduling, billing, multi-tenant production infrastructure. This is a polished local-first MVP.

Known limits, stated plainly:

  • Killing a timed-out command signals the command's own process. Descendants it spawned may survive until the sandbox is destroyed; pids_limit bounds the damage in the meantime.

  • restricted networking isolates sandboxes from each other but does not filter egress.

  • Change detection covers regular files. Symlinks are copied but not tracked in diffs.

  • Per-sandbox disk quotas need a storage driver that supports them (overlay2 on XFS with pquota); /tmp is capped via tmpfs, the workspace is not.

Future extensions

  1. Remote sandbox execution

  2. Firecracker isolation

  3. Kubernetes sandbox workers

  4. Persistent base-image cache

  5. Snapshot / restore

  6. Parallel experiments

  7. Experiment replay

  8. Resource usage analytics

  9. Network allowlists

  10. Human approval before applying changes

  11. Agent experiment benchmarking


Licence

MIT.

Available Tools

15 tools
cancel_jobCancel JobA

Stop a running command and kill its process inside the sandbox.

USE THIS when a command is clearly stuck or no longer needed. Safe on a job that already finished -- it returns the final state untouched.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesJob id to cancel.

Output Schema

ParametersJSON Schema
NameRequiredDescription
errorNo
job_idYes
statusYes
stderrNo
stdoutNo
commandYes
exit_codeNo
duration_msNo
experiment_idYes
stderr_truncatedNo
stdout_truncatedNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that cancellation kills the process and that calling it on a finished job is safe and returns the final state untouched. This covers the key behavioral expectations, though it does not mention side effects like partial artifacts or queued jobs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured. It leads with the core action, then gives a direct usage condition, and closes with an important safety note. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has one simple parameter and an output schema, so the description does not need to explain return values. It sufficiently covers action, usage, and safety. Some edge cases, such as cancelling a queued versus running job, are not addressed, keeping it just short of a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents job_id as 'Job id to cancel' with 100% coverage. The description does not add additional meaning about the parameter, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs ('stop', 'kill') and names the resource ('a running command inside the sandbox'). It clearly differentiates this from sibling tools like get_job_status or get_job_result by focusing on cancellation rather than inspection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use it: when a command is 'clearly stuck or no longer needed'. It also gives a helpful safety condition about already-finished jobs. It does not explicitly name alternatives or exclusions, so it misses the top score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_sandbox_runtimeCheck Sandbox RuntimeA

Confirm the sandbox runtime is available and report the active defaults.

USE THIS first if create_experiment fails, to tell a stopped Docker daemon apart from a rejected request. Returns the Docker version the server is talking to and the isolation defaults every experiment starts from.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden. It discloses that the tool returns the Docker version and isolation defaults, and frames the action as a non-mutating check. It could further clarify failure behavior, but for a zero-parameter diagnostic tool this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the first sentence states the core purpose, and the second adds a valuable usage cue and return details. Every sentence earns its place with no repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (0 params, output schema present), and the description fully covers when to use it, what it does, and what it returns. Nothing essential is missing for an agent to select and call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty input schema, so parameter documentation is not needed. The description correctly focuses on behavior and output rather than parameter details, matching the baseline for parameter-less tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: confirm sandbox runtime availability and report active defaults. It names the specific resource (sandbox runtime) and the exact outputs (Docker version, isolation defaults), distinguishing it from experiment-related siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit situational guidance: use this first if create_experiment fails to distinguish a stopped Docker daemon from a rejected request. This directly tells an agent when to invoke it over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

collect_artifactsCollect ArtifactsA

Copy selected files out of a sandbox before it is destroyed.

USE THIS for build output, test reports, coverage, benchmark results or logs you want to keep or quote.

Patterns are workspace-relative shell globs ('dist/*.js'), or '/name' for a recursive search ('/junit.xml'). Files land in the server's own state directory; this tool cannot write anywhere on the developer's machine.

ParametersJSON Schema
NameRequiredDescriptionDefault
patternsYesWorkspace-relative globs, e.g. ['dist/*.js'].
experiment_idYesThe experiment to collect from.

Output Schema

ParametersJSON Schema
NameRequiredDescription
skippedNo
artifactsYes
total_bytesNo
experiment_idYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It explains that files land in the server's state directory, that the tool cannot write to the developer's machine, and that it is meant to run before sandbox destruction. It stops short of detailing edge cases like empty pattern matches or overwrite behavior, but the core side effects are transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the core action, the primary use cases, and the pattern/destination details. The most important information is front-loaded, and there is no redundant restating of the tool name or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only two required parameters and an output schema, this description is complete. It tells the agent what the tool does, when to use it, how patterns work, where files go, and key constraints. No annotations are provided, but the description compensates with sufficient behavioral context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and parameter descriptions are already present. The description adds meaningful glob semantics beyond the schema: workspace-relative patterns, examples like 'dist/*.js', and the '**/name' recursive-search convention. This helps the agent construct valid inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Copy selected files out of a sandbox before it is destroyed.' This clearly distinguishes it from siblings like read_sandbox_file, which reads a file without copying it out, and get_job_result, which returns job outputs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'USE THIS for build output, test reports, coverage, benchmark results or logs you want to keep or quote,' giving the agent clear triggering conditions. It also states a limitation ('cannot write anywhere on the developer's machine') that implies when not to use it, though it does not explicitly name an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compare_experimentsCompare ExperimentsA

Compare two or more experiments side by side.

USE THIS when you tried several approaches -- three candidate fixes, two runtime versions, a couple of dependency upgrades -- and have to recommend one. Run each approach in its own experiment, then compare.

RETURNS per-experiment test results, failing test names, exit codes, change size, duration and artifact counts, plus a recommendation when the evidence supports one. Destroyed experiments are still comparable: their findings were recorded before teardown.

ParametersJSON Schema
NameRequiredDescriptionDefault
labelsNoOptional experiment_id -> human label, e.g. {'exp_a': 'Node 22'}.
experiment_idsYesTwo or more experiment ids.

Output Schema

ParametersJSON Schema
NameRequiredDescription
notesNo
dimensionsNoPer-dimension map of experiment_id -> value.
experimentsYes
recommendationNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral disclosure burden. It is transparent about the return payload (test results, failing tests, exit codes, change size, duration, artifact counts, conditional recommendation) and explicitly notes that destroyed experiments remain comparable because findings were recorded pre-teardown.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then uses clear 'USE THIS' and 'RETURNS' signals to organize usage and behavior. Every sentence contributes distinct information; the examples make the usage guidance concrete without padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple two-parameter schema and presence of an output schema, the description covers the decision context, prerequisites implied by sibling tools, and the key edge case (destroyed experiments). Nothing critical is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters (experiment_ids, labels). The description adds no further parameter-level detail, which is acceptable at the baseline for fully documented schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Compare two or more experiments side by side.' This clearly distinguishes it from sibling tools like create_experiment, get_experiment, and list_experiments.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'USE THIS when...' section gives explicit scenarios (multiple candidate fixes, runtime versions, dependency upgrades) where the tool should be chosen. It does not enumerate alternatives or explicit when-not-to-use cases, but the context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_experimentCreate ExperimentA

Create a disposable, isolated environment and copy a project into it.

USE THIS when you are about to do something you should not do on the developer's machine: install dependencies, run a build or a migration, try an upgrade, run unfamiliar code, or explore a fix you are not sure about. Reach for it before the risky step, not after.

The project is SNAPSHOT-COPIED into the sandbox. Files you change inside never propagate back; the developer's working tree is untouched by construction. Secrets (.env files, keys, credential directories) are withheld from the copy, as are node_modules and other build output.

RETURNS an experiment_id plus the isolation actually applied -- read the warnings field, which tells you where your request was clamped.

SAFETY: network is disabled unless you ask for it; no host environment variable is passed unless you name it, and credential-shaped names are refused even then; CPU, memory, PIDs and wall-clock are capped.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNoDefault per-command wall-clock limit in seconds.
cpu_limitNoCPU cores. Clamped.
objectiveNoWhat you are trying to find out. Shows up in the report.
base_imageNoDocker image to run in, e.g. 'node:22-slim', 'python:3.12-slim'. Choose the runtime the experiment is actually about.
memory_limitNoMemory, e.g. '2GB'. Clamped.
network_modeNo'none' (default, no network at all), 'restricted' (egress on a private bridge, no reach to other sandboxes), or 'enabled'. Use 'restricted' when you must install packages.
project_pathNoAbsolute path to the project to copy in. Omit for an empty sandbox. Must not be a home or system directory.
mount_strategyNo'COPY_TO_SANDBOX' (default, safest) or 'READ_ONLY_BIND_MOUNT' for a large repo you only need to read. Writable host mounts do not exist.
setup_commandsNoCommands to run once the sandbox is ready, in order. Stops at the first failure and reports it.
environment_allowlistNoEnvironment variables to expose. 'NAME' forwards the host's value; 'NAME=value' injects a literal. Nothing else crosses the boundary.

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusYes
warningsNo
base_imageYes
setup_jobsNo
files_copiedNo
network_modeYesHow much of the network the sandbox can see. ``NONE`` -- no interfaces at all. The default. ``RESTRICTED`` -- an isolated bridge network shared by nothing else; egress works, but the sandbox cannot reach other sandboxes or the host's service ports. ``ENABLED`` -- the daemon's default bridge. Full egress.
project_nameYes
experiment_idYes
mount_strategyYesHow the project reaches the sandbox. ``COPY_TO_SANDBOX`` -- snapshot the tree, hand the copy to the container. The host tree is unreachable. ``READ_ONLY_BIND_MOUNT`` -- bind the real tree read-only. Faster on large repos; writes to it fail by construction.
workspace_pathYes
resource_limitsYes
environment_passedNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully carries the behavioral disclosure burden. It explains that the project is snapshot-copied, changes never propagate back, secrets and build output are withheld, network is disabled by default, environment variables are restricted, and CPU/memory/PIDs/wall-clock are capped. It also warns about the returned warnings field.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but well-structured and front-loaded: purpose, usage, isolation behavior, return value, and safety. Every sentence earns its place and the use of short labeled sections ('RETURNS', 'SAFETY') makes the content easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 10-parameter tool with no annotations, this description is exceptionally complete. It covers purpose, usage timing, data-flow guarantees, security boundaries, returned values, and limitations. The output schema exists, so return details are already structured, and the description still adds the key warning-field guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents every parameter. The description adds valuable behavioral semantics beyond the schema: credential-shaped environment variable names are refused, resource limits are clamped/capped, and network is off unless requested. This extra context enhances correct parameter usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Create a disposable, isolated environment and copy a project into it.' It clearly distinguishes this creation tool from its siblings by focusing on setup and isolation, and the later 'USE THIS when' section reinforces what this tool is for.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit, concrete usage guidance: use this before risky actions like installing dependencies, running builds, migrations, upgrades, or unfamiliar code. It strongly communicates the when, but does not explicitly name alternative tools or state when not to use it, so it falls just short of a perfect 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

destroy_experimentDestroy ExperimentA

Destroy a sandbox and everything in it, returning a final report.

USE THIS as soon as an experiment has told you what you needed. Always call it -- a sandbox left running keeps consuming the developer's CPU and memory.

IDEMPOTENT: calling it on an already-destroyed experiment is safe and returns the stored report rather than an error.

RETURNS the final report, including what changed inside the sandbox, so you can summarise the experiment after it is gone.

ParametersJSON Schema
NameRequiredDescriptionDefault
experiment_idYesThe experiment to destroy.

Output Schema

ParametersJSON Schema
NameRequiredDescription
reportNo
statusYes
experiment_idYes
jobs_cancelledNo
snapshot_removedNo
already_destroyedNo
container_removedNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It clearly warns that the tool destroys the sandbox and everything in it, states that it is idempotent, and explains that calling it on an already-destroyed experiment returns the stored report instead of erroring.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with front-loaded purpose, then usage guidance, idempotency, and return-value explanation. Each sentence earns its place and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema, the description is complete. It covers when to use it, what it does, the destructive scope, idempotency behavior, and what the return report contains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds extra meaning beyond the schema by explaining that experiment_id may refer to an already-destroyed experiment and that the call remains safe, returning the stored report rather than failing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Destroy a sandbox and everything in it.' It also clarifies the return value, a final report, which distinguishes it from sibling tools that create, execute, read, or inspect experiments. There is no ambiguity about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'USE THIS as soon as an experiment has told you what you needed' and 'Always call it,' giving a clear trigger and a strong directive. It also explains the downside of not calling it: a sandbox left running keeps consuming CPU and memory.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_experimentExecute ExperimentA

Run a shell command inside a sandbox.

USE THIS for anything you would otherwise run in the developer's terminal: installs, builds, scripts, migrations, one-off exploration. The command runs in the container, never on the host.

RETURNS exit code, stdout, stderr and duration. A non-zero exit is a normal result, not an error -- read it and decide what to try next.

Set background=true for something long-running, then poll get_job_status and fetch get_job_result when it finishes. Otherwise this waits, bounded by the timeout, so it cannot hang your session.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYesShell command. Runs via /bin/sh in the workspace.
timeoutNoSeconds before the command is killed. Defaults to the experiment's.
workdirNoWorking directory. Must be inside the workspace.
backgroundNoReturn a job id immediately instead of waiting.
experiment_idYesThe experiment to run in.

Output Schema

ParametersJSON Schema
NameRequiredDescription
errorNo
job_idYes
statusYes
stderrNo
stdoutNo
commandYes
exit_codeNo
duration_msNo
experiment_idYes
stderr_truncatedNo
stdout_truncatedNo

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden of behavioral disclosure. It does so thoroughly: commands run in the container, never the host; returns exit code, stdout, stderr, duration; a non-zero exit is a normal result; background mode returns a job id; and the call is bounded by timeout so it cannot hang the session. This gives the agent a complete mental model of the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly organized: purpose, usage guidance, return behavior, and background-mode instructions. Every sentence adds value, and the most important information is front-loaded. It remains concise despite covering a lot of behavioral ground.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 5 parameters, an output schema, and a diverse sibling set. The description covers the core function, return values, error semantics, timeout behavior, background job handling, and boundary (sandbox vs host). It gives the agent everything needed to call this tool correctly and react to results, with no significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds some context around background=true (poll get_job_status, fetch get_job_result) and timeout ('bounded by the timeout'), but the schema already documents each parameter adequately. The description does not materially increase parameter understanding beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Run a shell command inside a sandbox.' This clearly distinguishes it from sibling tools like read_sandbox_file, write_sandbox_file, and run_tests by framing it as a general-purpose command executor.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says 'USE THIS for anything you would otherwise run in the developer's terminal' and gives concrete examples (installs, builds, scripts, migrations). It also provides guidance for long-running commands via background=true and mentions polling get_job_status and get_job_result. It does not explicitly contrast with run_tests or inspect_changes, so it misses the 'when not to use' part, but the context is otherwise very clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_experimentGet ExperimentA

Fetch an experiment's full state and a summary of what happened in it.

USE THIS to re-orient -- after a long gap, or to check whether a sandbox is still alive before sending more commands.

RETURNS status, base image, isolation settings, resource limits, how many commands ran and how many failed, the last test summary, change statistics and artifact count.

ParametersJSON Schema
NameRequiredDescriptionDefault
experiment_idYesThe experiment to describe.

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusYes
changesNo
sandboxNo
artifactsNo
objectiveYes
resourcesYes
base_imageYes
duration_msNo
commands_runYes
network_modeYesHow much of the network the sandbox can see. ``NONE`` -- no interfaces at all. The default. ``RESTRICTED`` -- an isolated bridge network shared by nothing else; egress works, but the sandbox cannot reach other sandboxes or the host's service ports. ``ENABLED`` -- the daemon's default bridge. Full egress.
project_nameYes
test_summaryNo
experiment_idYes
failed_commandsYes
host_working_treeNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the behavioral burden. 'Fetch' implies a read-only operation, and the description clearly lists the state and summary data returned, including liveness. It does not explicitly state side-effect-freeness or permissions, but nothing suggests mutation or hidden costs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: one sentence for what it does, one for when to use it, and one for what it returns. Every sentence earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a single parameter, an output schema, and no annotations, the description is largely complete: it covers purpose, return content, and a representative use case. A short note about which sibling tools to prefer for narrower needs would make it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single parameter experiment_id is already described as 'The experiment to describe.' The description adds no new parameter-level detail, which matches the baseline for fully covered schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Fetch' with a clear resource ('an experiment's full state and a summary of what happened in it') and enumerates the returned items. This makes it easy to distinguish from sibling tools like list_experiments or inspect_changes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly gives use cases: re-orienting after a long gap and checking whether a sandbox is still alive before more commands. It does not name alternatives or exclusions, such as pointing to check_sandbox_runtime for a lighter liveness check, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_job_resultGet Job ResultA

Fetch the completed result of a background command.

RETURNS the same shape as execute_experiment: exit code, stdout, stderr, duration. If the job is still running this waits for it, bounded by the job's own timeout.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesJob id to fetch.

Output Schema

ParametersJSON Schema
NameRequiredDescription
errorNo
job_idYes
statusYes
stderrNo
stdoutNo
commandYes
exit_codeNo
duration_msNo
experiment_idYes
stderr_truncatedNo
stdout_truncatedNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden and does meaningful work: it discloses that the call waits for a running job and is bounded by the job's timeout, and it specifies the returned fields (exit code, stdout, stderr, duration). It does not cover error/timeout outcomes, but for a simple retrieval-and-wait tool this is solid behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler: the first states the core purpose, and the second provides the key behavioral detail and return shape. All information is front-loaded and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with an output schema, the description is largely complete: it names the resource, explains blocking behavior, and references the return shape. It could note where job_id comes from or how timeout/failure behaves, but these are minor gaps given the simplicity and output schema coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, job_id, is fully documented in the schema with 'Job id to fetch.' and schema description coverage is 100%. The description does not add further parameter-level guidance, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb and resource: 'Fetch the completed result of a background command.' It also clarifies what it is not by noting it returns the same shape as execute_experiment, which differentiates it from status-only siblings like get_job_status. The purpose is immediately clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: call this to get a background command's result, and it will wait if the job is still running. However, it does not explicitly mention alternatives such as get_job_status for non-blocking status checks or say when not to use this tool. The context is clear but the boundary against siblings is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_job_statusGet Job StatusA

Check on a command started with background=true.

RETURNS status and elapsed milliseconds. Poll this, then call get_job_result once finished is true.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesJob id from execute_experiment.

Output Schema

ParametersJSON Schema
NameRequiredDescription
job_idYes
statusYes
commandYes
finishedNo
exit_codeNo
elapsed_msYes
experiment_idYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses that the tool returns status and elapsed milliseconds, that it is designed for polling, and that completion is signaled by the finished flag. This adequately conveys the non-terminal, read-only nature of the operation without contradicting anything.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core purpose, followed by return values and the next step. Every sentence earns its place, and there is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter status-polling tool with an output schema, the description fully covers purpose, usage, return values, and the subsequent call to get_job_result. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage with a clear description of job_id as coming from execute_experiment. The tool description adds minimal extra parameter context beyond implying the job is a background command, so it meets the baseline but does not exceed it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action — checking on a command started with background=true — and clearly identifies the target resource (a job). It also distinguishes itself from get_job_result by describing the polling-to-result handoff, so an agent can tell the two sibling tools apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear when-to-use guidance: use it for background commands, poll it, then call get_job_result once finished is true. It does not explicitly state exclusions or alternatives beyond the get_job_result handoff, but the context is strong enough for correct selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inspect_changesInspect ChangesA

Show what the experiment changed, against the project as it was copied in.

USE THIS before destroying a sandbox, and before telling the developer what you found. It is the evidence for your conclusion.

RETURNS created / modified / deleted file lists plus insertion and deletion counts, and optionally the unified diff. Build output and dependency directories are excluded, so a 30,000-file node_modules will not bury the two lines that matter.

ParametersJSON Schema
NameRequiredDescriptionDefault
include_diffNoInclude unified diff bodies, not just statistics.
experiment_idYesThe experiment to inspect.
max_files_with_diffNoCap on files given line-level detail.

Output Schema

ParametersJSON Schema
NameRequiredDescription
noteNo
changesNo
deletionsNo
truncatedNo
insertionsNo
experiment_idYes
files_createdNo
files_deletedNo
files_modifiedNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses return contents (created/modified/deleted files, counts, optional diff) and filtering behavior (build output and dependency directories excluded). It does not explicitly state that the tool is non-destructive, which would make this a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the core purpose, and every sentence earns its place: what it does, when to use it, and what it returns. The node_modules example efficiently justifies the exclusion behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description tells the agent why this matters, when to invoke it, what baseline is used, what outputs to expect, and how noise is filtered. The presence of an output schema covers the return structure, so nothing important is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description's mention of 'optionally the unified diff' aligns with include_diff but adds little beyond the schema. Baseline 3 is appropriate because the schema handles parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Show what the experiment changed, against the project as it was copied in.' It clearly distinguishes this from siblings like compare_experiments or get_experiment by defining the baseline and the evidence role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage timing: 'USE THIS before destroying a sandbox, and before telling the developer what you found.' It does not explicitly name alternatives or when-not-to-use, so it stops short of a 5, but the usage context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_experimentsList ExperimentsA

List experiments, most recent first.

USE THIS to find a sandbox you created earlier, or to check for ones you forgot to destroy before creating another.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum rows.
statusNoFilter by status, e.g. 'READY', 'FAILED', 'DESTROYED'.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden. 'List' clearly indicates a non-mutating read, and 'most recent first' plus the sandbox-lifecycle hint add useful context. It does not explicitly mention side effects or permissions, but for a simple read-only list the risk of ambiguity is low.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two compact sentences with no filler. The core behavior is front-loaded in the first sentence, and the second sentence adds practical usage context without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that both parameters are fully documented in the schema and an output schema exists, the description provides the missing decision context: when to use this tool and what ordering to expect. Nothing critical is missing for a list-only operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters fully, including defaults, ranges, and meaning, so the description does not need to repeat them. The description adds no parameter-specific detail, but the baseline 3 applies because schema coverage is 100%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('List'), the resource ('experiments'), and the ordering ('most recent first'). The plural resource and the sandbox-finding use case distinguish it from singular or CRUD siblings like get_experiment and create_experiment, though it does not explicitly name a competing tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells the agent when to use this tool: to find a sandbox created earlier or to check for undestroyed sandboxes before creating another. It lacks an explicit 'when not to use' or alternative-name mention, which keeps it from a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_sandbox_fileRead Sandbox FileA

Read a file from inside the sandbox as text.

USE THIS to investigate a failure -- read the source, the config, a log -- without guessing from stack traces. Paths are workspace-relative and cannot escape it; this tool cannot read the developer's machine.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesWorkspace-relative path, e.g. 'src/index.js'.
experiment_idYesThe experiment to read from.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses key behavioral traits: paths are workspace-relative, cannot escape the sandbox, and the tool returns text content. This goes beyond the schema and helps the agent understand safety boundaries, though it does not cover error behavior or binary file handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences with no filler. It front-loads the core action, then immediately provides the primary use case and critical constraints. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter read tool with an output schema available, the description is complete. It explains what the tool does, when to use it, and the key security boundary. No critical invocation details are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning to the 'path' parameter by specifying that paths are workspace-relative and cannot escape the sandbox, which is not fully apparent from the schema alone. The 'experiment_id' parameter is not elaborated beyond the schema, but the added path context is valuable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb and resource: 'Read a file from inside the sandbox as text.' It also distinguishes from siblings by stating that paths cannot escape the sandbox and that the tool cannot read the developer's machine, making its scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: 'USE THIS to investigate a failure' and suggests reading source, config, or logs rather than guessing from stack traces. It also notes a limitation (cannot read the developer's machine), but it does not explicitly name alternative tools or when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_testsRun TestsA

Run the project's test suite inside a sandbox and parse the results.

USE THIS instead of execute_experiment when you want to know whether the project still works -- it detects the runner (npm, pytest, cargo, go, make) by looking at what is actually in the sandbox, and parses counts out of the output.

RETURNS exit code, stdout/stderr, duration and, when parseable, a summary with passed/failed/total and the names of failing tests. If test_summary.detected is false, trust the exit code, not the zeros.

Pass command to override detection.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandNoExplicit test command. Omit to auto-detect.
timeoutNoSeconds before the run is killed.
experiment_idYesThe experiment to test in.

Output Schema

ParametersJSON Schema
NameRequiredDescription
errorNo
job_idYes
statusYes
stderrNo
stdoutNo
commandYes
exit_codeNo
frameworkNo
duration_msNo
test_summaryNo
experiment_idYes
stderr_truncatedNo
stdout_truncatedNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and does so thoroughly. It discloses the return contents (exit code, stdout/stderr, duration, parseable summary), and importantly warns that when test_summary.detected is false, the agent should trust the exit code rather than zero counts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose first, then usage guidance, then return behavior, then the override hint. Every sentence adds distinct value, and there is no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool operates in a sandbox, has an output schema, and the description explains the key caveat about detection reliability. It covers purpose, alternatives, return semantics, auto-detection, and command override, making it complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters well. The description adds minor reinforcement by saying 'Pass command to override detection,' but it does not substantially add meaning beyond the parameter descriptions already present.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Run the project's test suite inside a sandbox and parse the results') with a clear resource and outcome. It also distinguishes itself from execute_experiment by explicitly naming when this tool should be preferred, so an agent can tell them apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit usage rule: 'USE THIS instead of execute_experiment when you want to know whether the project still works.' It also explains the auto-detection behavior and how to override it with 'command', which gives the agent enough context to decide correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

write_sandbox_fileWrite Sandbox FileA

Write a file inside the sandbox, creating parent directories as needed.

USE THIS to apply a candidate fix. Prefer it over shell heredocs: no quoting to get wrong.

SAFETY: writes land in the sandbox copy only. There is no tool here that writes to the developer's project -- if a change is worth keeping, show them the diff from inspect_changes and let them apply it.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesWorkspace-relative path.
contentYesFull new contents of the file.
experiment_idYesThe experiment to write in.

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden and does well by stating writes land 'in the sandbox copy only' and that 'There is no tool here that writes to the developer's project.' It also discloses automatic parent directory creation. It does not explicitly state overwrite behavior, but the schema's 'Full new contents' parameter description implies replacement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short, purposeful sections: what it does, when to use it, and safety scope. Every sentence earns its place, and the core function is front-loaded before usage and safety notes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 3-parameter tool with fully described schema fields and an output schema, the description covers the action, side effects, use context, and safety boundary. Nothing essential for an agent to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all three parameters. The description adds minimal parameter-specific meaning beyond the schema, only noting parent directory creation for path and positioning content as a candidate fix. This meets the baseline but doesn't elevate it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with 'Write a file inside the sandbox' - a specific verb and resource that clearly distinguishes it from read_sandbox_file and other siblings. It adds meaningful scope with 'creating parent directories as needed' and ties the tool to applying candidate fixes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'USE THIS to apply a candidate fix' and instructs preferring it over shell heredocs because 'no quoting to get wrong.' It also clarifies when not to use it for permanent changes, directing the user to show the diff from inspect_changes instead, since no tool writes to the developer's project.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 15 tool updatesv0.1.0
    • First observedcancel_job
    • First observedcheck_sandbox_runtime
    • First observedcollect_artifacts
    • First observedcompare_experiments
    • First observedcreate_experiment
    • First observeddestroy_experiment
    • First observedexecute_experiment
    • First observedget_experiment
    • First observedget_job_result
    • First observedget_job_status
    • First observedinspect_changes
    • First observedlist_experiments
    • First observedread_sandbox_file
    • First observedrun_tests
    • First observedwrite_sandbox_file

TDQS

A4.4/5.0
Disambiguation5/5

Every tool has a clearly distinct purpose, and descriptions explicitly state when to use each one, such as run_tests versus execute_experiment for test-specific vs general commands. There is no meaningful overlap or ambiguity between tools.

Naming Consistency5/5

All tool names follow a consistent snake_case verb_noun pattern: create_experiment, read_sandbox_file, get_job_result, etc. While some verbs like 'run' and 'execute' are synonymous, they apply to different objects (tests vs experiments) and the overall pattern is uniform.

Tool Count5/5

With 15 tools, this server sits at the upper bound of the ideal 3-15 range, but each tool serves a distinct and necessary function in the sandbox lifecycle, from creation to destruction, file manipulation, job management, and comparison. No tool feels redundant or extraneous.

Completeness4/5

The tool surface covers the full experiment lifecycle and core workflows: create, inspect, execute, collect, compare, and destroy. The only minor gap is the lack of a directory-listing or file-discovery tool inside the sandbox, requiring agents to shell out via execute_experiment to explore the filesystem.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/AbhiteshPundir/sandbox-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server