Skip to main content
Glama

execute_code

Run code in 30+ languages inside a sandbox with resource limits, network controls, and persistent sessions, returning stdout, stderr, exit code, timing, and memory usage.

Instructions

Execute code in language in a sandbox.

Returns stdout, stderr, exit_code, duration_ms, cpu_ms, peak_memory_kb, verdict (OK/TLE/MLE/OLE/RTE).

  • session_id: run inside a session workspace (see session_start); with a stateful session (python3/node) interpreter state persists across calls.

  • max_memory_mb / max_cpu: per-call resource ceilings.

  • max_output_kb: raise/lower the stdout cap (default 64 KiB).

  • no_net: block network egress. Linux: enforced in-kernel via a seccomp-bpf filter. macOS / no-seccomp kernel: best-effort symbol shim, disclosed in unenforced when that's the only guarantee that held. See SECURITY.md.

  • compact: drop the diagnostic fields (timings, workdir, platform). Never drops unenforced or output_error — if a guarantee you asked for was not applied, a compact result still says so.

With session_id set and max_output_kb left at its default, output that would otherwise be truncated is instead SPILLED: the inline stdout/stderr still carry the same truncated prefix as before, and stdout_spill/stderr_spill name a codecalc://session/{sid}/files/... resource carrying the fuller stream (session_read_file or the resource route reads it back) — capped at 4 MiB, ..._spill_capped: true if even that was not enough to hold everything. Passing an EXPLICIT max_output_kb is honoured as a literal ceiling with no spill, same as before. Session-LESS runs (no session_id) have no workspace to spill into and keep the old truncate-and-drop behaviour.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
codeYes
stdinNo
no_netNo
compactNo
max_cpuNo
timeoutNo
languageYes
providerNo
session_idNo
max_memory_mbNo
max_output_kbNo

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed14 schema fields changedv0.2.0
    • removedInput schema / additionalProperties
      Removed value: -false
    • addedInput schema / properties / code / title
      Added value: +"Code"
    • addedInput schema / properties / compact / title
      Added value: +"Compact"
    • addedInput schema / properties / language / title
      Added value: +"Language"
    • addedInput schema / properties / max_cpu / title
      Added value: +"Max Cpu"
    • addedInput schema / properties / max_memory_mb / title
      Added value: +"Max Memory Mb"
    • addedInput schema / properties / max_output_kb / title
      Added value: +"Max Output Kb"
    • addedInput schema / properties / no_net / title
      Added value: +"No Net"
    • addedInput schema / properties / provider
      Added value: +{
      +  "anyOf": [
      +    {
      +      "type": "string"
      +    },
      +    {
      +      "type": "null"
      +    }
      +  ],
      +  "default": null,
      +  "title": "Provider"
      +}
    • addedInput schema / properties / session_id / title
      Added value: +"Session Id"
    • addedInput schema / properties / stdin / title
      Added value: +"Stdin"
    • addedInput schema / properties / timeout / title
      Added value: +"Timeout"
    • addedInput schema / title
      Added value: +"execute_codeArguments"
    • changedOutput schema / (root)
      Previous value: -{
      -  "additionalProperties": true,
      -  "type": "object"
      -}New value: +null
  2. First observedv0.1.0

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description bears the full burden — and it carries it superbly. It discloses return payload, resource ceilings, verdict enum, security enforcement details (seccomp-bpf vs best-effort symbol shim, surfaced via `unenforced`), the 64 KiB/4 MiB caps, spill semantics, and trivially-important edge cases like 'compact never drops `unenforced`'. This goes far beyond a typical tool description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense paragraphs, well organized: return values front-loaded, then a bulleted parameter glossary, then the nuanced spill/session behavior. It is long, but the length is earned — every clause carries a behavioral fact and there is no filler or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complete for a tool this complex, with no annotations and no output_schema to lean on. It covers return format, verification verdicts, resource limits, network security guarantees and their fallbacks, spill truncation edge cases, session vs session-less differences, and a pointer to SECURITY.md. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate — and it does, explaining the subtle parameters in depth: session_id (workspace/state persistence), max_memory_mb/max_cpu (per-call ceilings), no_net (egress blocking + platform-specific enforcement), container leakage of default vs explicit max_output_kb, and compact (which fields drop vs never drop). Six of the trickiest params get real semantic meaning beyond the schema's title/default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line states a specific verb and resource — 'Execute `code` in `language` in a sandbox' — and immediately lists concrete return values (stdout, stderr, exit_code, duration_ms, CPU/memory stats, verdict). This is unmistakably distinct from siblings like execute_code_stream and session_run. The first sentence alone fully disambiguates it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit conditions for session-based use ('With `session_id` set and `max_output_kb` left at its default... output ... is instead SPILLED') and clarifies stateful interpreter persistence. It references alternatives (session_start, session_read_file, execute_code_stream) and explains the session-less fallback behavior. However, it never directly says 'use execute_code_stream instead when X', so the contrast with the closest sibling is left implicit. Clear context, no explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/The-40-Thieves/codecalc'

If you have feedback or need assistance with the MCP directory API, please join our Discord server