sandbox-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@sandbox-mcprun uname -a"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
sandbox-mcp 
Local AI agent sandbox. Run isolated Linux VMs on your Mac in ~60ms. No cloud costs. VM-level isolation via Virtualization.framework. Works with MCP clients that support local stdio servers (Claude Code, Claude Desktop, Cursor).
What this is
An MCP server that gives AI agents a sandboxed Linux environment using Apple Containerization (Virtualization.framework). Each sandbox is a real VM — not a container sharing your kernel — that boots in ~700ms and executes commands in ~60ms via a persistent shell over vsock.
Compared to cloud sandboxes (as of early 2025):
Exec latency | Cost | Isolation | |
This (local) | ~60ms | Local hardware | VM (Virtualization.framework) |
E2B | ~150ms + network | $0.18/hr | Firecracker microVM |
Daytona | ~90ms + network | Usage-based | Docker container |
Related MCP server: Containarium-Cloud
Quick demo
Once registered, your MCP client can use the sandbox tools directly:
Agent: exec(command="uname -a")
→ Linux mcp-sb-abc123 6.12.6 #1 SMP aarch64 Linux
Agent: install(packages="python3 py3-pip")
→ Installed python3 py3-pip (1230ms)
Agent: exec(command="python3 -c 'print(sum(range(1000)))'")
→ 499500
Agent: bg(command="python3 -m http.server 8000")
→ Started [bg-a1b2c3] PID 42
Agent: expose(port=8000)
→ Forwarding localhost:8000 → 'default':8000
Open http://localhost:8000Cold boot is ~700ms, subsequent commands ~60ms each.
Requirements
Apple Silicon Mac (M1+)
macOS 15 Sequoia+
Python 3.11+
uv (for packaging)
Setup
1. Install Apple Containers
# Download and install the container CLI
curl -LO https://github.com/apple/containerization/releases/download/v0.9.0/container-v0.9.0.pkg
sudo installer -pkg container-v0.9.0.pkg -target /
# Start the container system (downloads kernel on first run)
container system start
# Verify it works
time container run --rm alpine echo "hello" # ~700ms cold boot2. Build the dev image
The included Containerfile.mcp-dev builds an Alpine image pre-loaded with Python, Node.js, Go, Rust, and standard build tools:
cd sandbox-mcp
container build -t mcp-dev -f Containerfile.mcp-dev .3. Install the MCP server
uv sync4. Register with your MCP client
Claude Code:
claude mcp add sandbox -- uv --directory /path/to/sandbox-mcp run sandbox-mcpManual (~/.claude.json):
{
"mcpServers": {
"sandbox": {
"type": "stdio",
"command": "/path/to/uv",
"args": ["--directory", "/path/to/sandbox-mcp", "run", "sandbox-mcp"]
}
}
}5. Building the optimized kernel (optional)
Apple's containerization repo includes a stripped-down Linux kernel config. Compiling it yourself doesn't meaningfully improve exec latency — the ~700ms floor is VM lifecycle overhead (Virtualization.framework + EXT4 + network + vminitd), not kernel boot. The real win is keeping VMs warm and using persistent shell exec (~60ms).
That said, if you want a smaller kernel:
git clone https://github.com/apple/containerization.git
cd containerization/kernel
make # ~3 min on M-series
container system kernel set --binary ./vmlinux
container system stop && container system startHow it works
Agent ──MCP/stdio──▶ sandbox_mcp_server.py (FastMCP)
│
├── SandboxManager
│ ├── _sandboxes: dict[name, Sandbox]
│ ├── _port_forwards: dict[port, PortForward]
│ ├── _sync_jobs: dict[id, SyncJob]
│ └── _cleanup_loop (idle TTL + child TTL)
│
├── SandboxCtlServer (per-parent UDS listener)
│ └── NDJSON over /run/sandbox-ctl.sock
│ → spawn, list, exec, destroy, run
│
└── Sandbox (per-VM)
├── PersistentShell (container exec -i <name> sh)
├── _bg_processes: dict[id, Process]
└── _audit_log: dequeLatency breakdown:
Cold boot: ~700ms (Virtualization.framework + EXT4 + network + vminitd)
Warm exec: ~60ms (command piped to persistent shell via vsock)
Why warm is fast: Each sandbox holds open a
container exec -i <name> shprocess. Commands are written to stdin with a unique end-marker, output is read until the marker appears. No process spawn overhead per command.
Port forwarding
Apple Containers v0.9.0 -p port publishing is broken (TCP connects but data never flows), and VM IPs are not routable from the host. Port forwarding works via asyncio TCP proxy:
exposestarts a local TCP server on127.0.0.1:<host_port>Each incoming connection spawns
container exec -i <name> nc 127.0.0.1 <container_port>Data is piped bidirectionally between the client and the nc process via vsock
Multi-sandbox
Sandboxes are named (default: "default"). Each gets isolated volumes for /workspace and package caches (apk, pip, npm). Caches persist across resets for fast reinstalls. Sandboxes can reach each other by name via /etc/hosts entries auto-injected when networking is available.
Profiles
Configure per-sandbox-name resources in SANDBOX_PROFILES at the top of the server:
SANDBOX_PROFILES = {
"ml": {"cpus": 4, "memory": "2G"},
"build": {"cpus": 4, "memory": "1G"},
"nested": {"cpus": 2, "memory": "1G", "virtualization": True},
}The virtualization flag enables nested virtualization (--virtualization). GPU/Metal passthrough is not supported by Apple Containers — the kernel has CONFIG_DRM_VIRTIO_GPU disabled and the Swift framework doesn't use VZVirtioGraphicsDeviceConfiguration.
Child sandboxes
Sandboxes can spawn child sandboxes, controlled by SPAWN_POLICIES at the top of the server. Policies define per-parent limits: max concurrent children, lifetime spawn count, CPU/memory budgets, allowed images, and TTL. Unlisted sandbox names cannot spawn.
Children are lightweight — they skip cache volumes and get their own isolated workspace. They're auto-destroyed when their TTL expires or their parent is reset/destroyed.
Setting child_can_spawn: True in a policy allows children to spawn their own children (grandchildren), up to a depth of _MAX_SPAWN_GENERATION (default 2). Grandchild policies are derived automatically — halved concurrency/budget limits, no further sub-spawning. A tree-wide budget check ensures the root sandbox's CPU/memory envelope is never exceeded regardless of spawn depth. This is off by default and not recommended for most use cases.
In-container API (sandbox-ctl)
When a sandbox has a spawn policy with inject_ctl: True (the default), the server mounts a UDS socket and the sandbox-ctl binary into the VM. Set inject_ctl: False to skip injection for sandboxes that don't need in-VM sub-launching. Code running inside the VM can then spawn/manage sibling containers:
sandbox-ctl ping # verify connection
sandbox-ctl spawn --image mcp-dev --cpus 1 --memory 256M # create child
sandbox-ctl list # show children
sandbox-ctl exec <child> -- echo hello # run in child
sandbox-ctl destroy <child> # tear down
sandbox-ctl run -- echo test # ephemeral: spawn + exec + destroyCommunication uses NDJSON over the mounted socket (/run/sandbox-ctl.sock). The host-side SandboxCtlServer handles requests and delegates to SandboxManager.
State persistence
Sandbox-to-container mappings are saved to ~/.local/state/sandbox-mcp/state.json (schema v2). On restart, the server reconnects to any still-running containers from the previous session. Expired children are cleaned up on reconnect.
Tools (35)
Core
Tool | Description |
| Run a shell command (~60ms) |
| Execute Python code |
| Write a file to the sandbox |
| Read a file from the sandbox |
| Write multiple files in one transfer |
| Install packages via apk |
| Manage persistent environment variables |
Process management
Tool | Description |
| Run a command in the background |
| Read output from a background process |
| Kill a background process |
Sandbox lifecycle
Tool | Description |
| Show pool and sandbox info |
| Quick liveness/disk/memory check across all sandboxes |
| Show CPU/memory/disk usage for one sandbox |
| Destroy and recreate (clean state) |
| List all active sandboxes |
| Permanently kill a sandbox |
| Clone a running sandbox to a new name |
| Show recent command audit log |
File transfer
Tool | Description |
| Copy files from host into sandbox |
| Copy files from sandbox to host |
| Clone a git repo (with optional auth token) |
| Watch and live-sync a host directory |
| Stop a running sync job |
Snapshots & images
Tool | Description |
| Save sandbox state as a reusable image |
| Boot from a saved snapshot |
| List available snapshots |
| Delete a saved snapshot image |
| Build a container image from a Containerfile |
| List all available container images |
Networking
Tool | Description |
| Forward a sandbox port to localhost (TCP proxy) |
| Stop a port forward |
| Show IPs and connectivity between sandboxes |
Child sandboxes
Tool | Description |
| Spawn a child sandbox under a parent |
| List child sandboxes of a parent |
| Destroy a child sandbox |
Files
File | Description |
| Sandbox class, SandboxManager, MCP tool definitions |
| In-container CLI for spawning sibling sandboxes (Go) |
| uv/hatchling packaging, entry point |
| Alpine 3.23 dev image with Python, Node, Go, Rust |
| pytest test suite |
Customization
Edit constants at the top of sandbox_mcp_server.py:
Constant | Default | Description |
|
| Container image for new sandboxes |
|
| Default CPU cores per sandbox |
|
| Default memory per sandbox |
|
| Seconds before auto-destroying idle sandboxes |
|
| Default command timeout in seconds |
|
| Max output bytes per command |
|
| Per-sandbox child spawn limits and permissions |
|
| Maximum spawn depth (root → child → grandchild) |
Testing
uv run pytest tests/ -vCI
Tests run on Python 3.11, 3.12, and 3.13 via GitHub Actions. Pre-push:
uv run pytest tests/ -q && python3 -m compileall sandbox_mcp_server.py testsAvailable Tools
35 toolsbatch_writeA
Write multiple files to the sandbox in a single operation. Much faster than multiple write_file calls for scaffolding projects.
Args: files: JSON object mapping absolute paths to file contents. Example: {"/workspace/main.py": "print('hi')", "/workspace/config.yml": "port: 8080"} sandbox: Named sandbox (default "default")
Returns: Confirmation with file count and timing.
| Name | Required | Description | Default |
|---|---|---|---|
| files | Yes | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits. It mentions writing files and returning confirmation with count and timing, but does not state whether it overwrites existing files or what happens on error. This is adequate but lacks explicit overwrite and error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise: one sentence for purpose, one sentence for benefit, then structured arguments and returns. No unnecessary information, every part serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity with two parameters, the description covers purpose, benefit, parameter details with example, and return value. It is complete for the tool's complexity, especially with no output schema but a clear description of returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description compensates well. It explains the 'files' parameter as a JSON object mapping paths to contents, with an example, and clarifies the 'sandbox' parameter with its default value. This adds significant meaning beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool writes multiple files to the sandbox in a single operation, with a specific verb and resource. It is distinct from the sibling tool write_file which handles single files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says it is faster than multiple write_file calls for scaffolding projects, providing clear guidance on when to use it. However, it does not explicitly state when not to use it or mention the alternative for single-file writes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
bgA
Start a background process in the sandbox (e.g., a dev server).
Args: command: Command to run in background (e.g., "python3 -m http.server 8000") name: Optional friendly name for the process (auto-generated if empty) workdir: Working directory (default: /workspace) sandbox: Named sandbox to use (default "default")
Returns: Process ID and name for use with logs/kill.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| name | No | ||
| workdir | No | /workspace | |
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It informs that it starts a background process and returns a PID/name, but does not disclose lifecycles, resource usage, or persistence behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph with clear 'Args' and 'Returns' sections, front-loaded with purpose, and contains no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool with 4 parameters (1 required) and an output schema, the description covers all necessary information about inputs and outputs, making it fully adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, but the description explains all four parameters (command, name, workdir, sandbox) with clear examples and defaults, adding significant value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Start a background process in the sandbox', providing a clear verb and resource. This distinguishes it from sibling tools like 'exec' (foreground command) and 'spawn'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an example (e.g., a dev server) and implies background use, but does not explicitly state when not to use it or mention alternatives like 'exec' for foreground tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
build_imageA
Build a container image from a Containerfile (Dockerfile syntax). The image can then be used with restore or as the default image.
Args: name: Name/tag for the built image (e.g., "my-ml-env", "node-app"). containerfile: Containerfile content (Dockerfile syntax). Example: "FROM alpine:3.23\nRUN apk add --no-cache python3"
Returns: Confirmation with build time.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| containerfile | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description reveals the tool creates an image and returns a confirmation with build time. Does not discuss potential side effects like overwriting existing images or required permissions, but provides sufficient behavioral context for a build action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very concise: two brief paragraphs. Purpose stated first, then parameter descriptions with examples, and return value. No extraneous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, parameters, and return value. With an output schema implied by 'Returns: Confirmation with build time', the description is fairly complete. Lacks error handling or prerequisites, but acceptable for a straightforward build tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description explains both parameters (name and containerfile) with examples and usage details, adding significant meaning beyond the schema's type-only definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool builds a container image from a Containerfile, specifies Dockerfile syntax, and mentions downstream usage with restore or as default image. Distinguishes from siblings like 'images' and 'restore'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides context on when to use (to create custom images for restore) but does not explicitly state when not to use or contrast with alternatives like 'clone' or 'snapshot'. Lacks explicit exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
childrenC
List all child sandboxes of a parent.
Args: parent: Name of the parent sandbox.
Returns: List of children with status, or indication that none exist.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states the function and return type, but does not disclose any behavioral traits such as side effects, authentication needs, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a front-loaded main sentence. The Args and Returns sections add minimal value but are not overly verbose. Could be slightly tighter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and an output schema (not shown). The description provides basic functionality and return type, but lacks examples or elaboration on what constitutes a 'child sandbox' context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds 'Name of the parent sandbox' for the 'parent' parameter, which provides context beyond the schema's default and title. However, schema coverage is 0% and the description does not clarify the optional nature or default value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List all child sandboxes of a parent.' It uses a specific verb ('List') and resource ('child sandboxes'), and the context of 'parent' distinguishes it from siblings like list_all or status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. It does not specify prerequisites, exclusions, or scenarios where another tool would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloneA
Clone a running sandbox to a new name. Copies the full filesystem (except /workspace) to a fresh sandbox. Faster than snapshot+restore since it skips image build.
Args: source: Name of the sandbox to clone from. target: Name for the new cloned sandbox.
Returns: Confirmation with timing.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | ||
| target | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full burden. It reveals that filesystem (except /workspace) is copied and that it is faster than snapshot+restore, but it does not disclose if the original sandbox remains running, resource implications, or synchrony of the operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise, with two short sentences covering purpose, scope, and a performance note, plus an Args section. Every sentence adds value with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two string parameters and no nested objects, the description covers the function, key behavior (filesystem copy except /workspace), and return type (confirmation with timing). It is adequately complete but could detail synchronization or state of the source sandbox.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains that source is the sandbox to clone from and target is the new name, but adds no constraints or format details beyond the schema. This is minimal added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool clones a running sandbox to a new name, specifies it copies the full filesystem except /workspace, and distinguishes it from snapshot+restore by noting it's faster. This provides a specific verb and resource with scope and differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions it is faster than snapshot+restore because it skips image build, offering comparative guidance. However, it does not explicitly state when not to use it or mention alternative tools like spawn or restore directly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_snapshotA
Delete a saved snapshot image. Frees disk space.
Args: snapshot_name: Name of the snapshot to delete (from list_snapshots).
Returns: Confirmation or error.
| Name | Required | Description | Default |
|---|---|---|---|
| snapshot_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It mentions freeing disk space but does not disclose irreversibility, required permissions, or consequences of deleting a snapshot in use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: two lines for purpose, one line for argument, one for return. Front-loaded with key information, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description is largely complete: states purpose, effect, argument source, and return type. Could add irreversibility note.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds valuable context for the single parameter by specifying that the name comes from list_snapshots, which aids correct invocation. Schema has 0% coverage, so description compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the action (delete) and resource (saved snapshot image), and mentions the effect (frees disk space). Distinguishes from sibling destructive tools by specifying snapshot-specific deletion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a hint to use list_snapshots for the snapshot name, but does not explicitly state when to use this tool vs alternatives like destroy or destroy_child, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
destroyA
Permanently destroy a named sandbox without recreating it. Unlike reset (which destroys and reboots), this just kills it. Workspace volume is preserved and will be reattached if the sandbox is recreated.
Args: sandbox: Name of the sandbox to destroy.
Returns: Confirmation or error.
| Name | Required | Description | Default |
|---|---|---|---|
| sandbox | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that destruction is permanent, that the sandbox is not recreated, and that workspace volume is preserved and reattachable. However, it does not mention preconditions (e.g., must be running) or specific error cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with 4 sentences, including a clear purpose statement, contrast with reset, parameter definition, and return value note. No unnecessary words, well-structured, and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple destroy tool with one parameter and no annotations, the description is complete. It covers purpose, usage context, parameter, and a key behavioral note about volume. An output schema exists for return details, so the description does not need to elaborate further.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It states: 'sandbox: Name of the sandbox to destroy.', which adds basic semantic meaning beyond the schema. For a single parameter, this is adequate but minimal; no format or constraints are provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Permanently destroy a named sandbox without recreating it.' It distinguishes itself from the sibling 'reset' by noting that reset destroys and reboots, while this just kills. Specific verb and resource with clear differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit contrast with reset ('Unlike reset (which destroys and reboots), this just kills it.'), indicating when to use this tool instead of reset. It also mentions workspace volume preservation, but lacks explicit when-not-to-use or other alternative tools beyond reset.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
destroy_childB
Destroy a child sandbox. The child's parent must have a spawn policy.
Args: name: Name of the child sandbox to destroy.
Returns: Confirmation or error.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It only states the action and a prerequisite, but fails to mention side effects (e.g., destruction is irreversible, what happens to the child's resources), required permissions, or potential errors beyond a generic 'error'. This is insufficient for a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two main sentences plus an args/returns section. It front-loads the primary purpose and includes a precondition. No unnecessary repetition, though the structure could be more organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists and there is only one parameter, the description covers the basic functionality. However, it lacks behavioral context (irreversibility, permissions) and does not explain what the confirmation or error entails, leaving gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'name' is described as 'Name of the child sandbox to destroy', which adds context beyond the schema's minimal 'Name' field. However, the description lacks details on validation (e.g., must correspond to an existing child) or format, limiting its helpfulness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Destroy' and the resource 'child sandbox'. It specifies the prerequisite about spawn policy. However, it does not explicitly differentiate from sibling tools like 'destroy' or 'delete_snapshot', which weakens clarity for an agent selecting among them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a prerequisite ('parent must have a spawn policy') which guides when to use the tool. But it does not include when not to use it or mention alternatives, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
downloadB
Copy a file or directory from the sandbox to the host.
Args: sandbox_path: Path inside the sandbox to download. local_path: Absolute destination path on the host. sandbox: Named sandbox to use (default "default")
Returns: Confirmation with transferred size.
| Name | Required | Description | Default |
|---|---|---|---|
| sandbox_path | Yes | ||
| local_path | Yes | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description should disclose behavioral traits like overwrite policies, size limits, or error handling. It only mentions copying and returning confirmation with size.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loading the purpose, and lists arguments and return value without extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers basic usage and return type, but for a file transfer tool, it misses details like overwrite behavior, directory transfer semantics, and error cases. Output schema exists but doesn't compensate for these gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage; the tool description adds brief parameter explanations (e.g., sandbox_path as path inside sandbox). This is helpful but minimal, lacking details like allowed formats or path requirements.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool copies a file or directory from sandbox to host. This distinguishes it from siblings like upload (opposite direction), but it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as when downloading vs reading files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
envA
Manage persistent environment variables in a sandbox. Variables persist across all commands (sourced from /etc/profile.d/mcp-env.sh).
Args: action: "set", "unset", or "list" (default: "list") key: Variable name (required for set/unset) value: Variable value (required for set) sandbox: Named sandbox (default "default")
Returns: Current env vars or confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | list | |
| key | No | ||
| value | No | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose potential side effects (e.g., overwriting variables, validation errors), error conditions, or authorization requirements. It lacks transparency beyond the basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, uses a clear header sentence, and efficiently outlines parameters and return value. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with 4 optional parameters and no nested objects. The description covers the purpose, parameter roles, persistence behavior, and return value, which is sufficient for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains the meaning of action, key, value, and sandbox, but only minimally. It clarifies that key is required for set/unset and value for set, which adds some value over the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it manages persistent environment variables in a sandbox and lists specific actions (set, unset, list). This distinguishes it from sibling tools like exec or spawn.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions that variables persist across commands and are sourced from a specific file, but does not provide explicit guidance on when to use this tool versus alternatives or specify prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execA
Execute a shell command in the sandbox.
Args: command: Shell command to run (e.g., "ls -la", "echo hello", "cat /etc/os-release") timeout: Max seconds to wait (default 30) workdir: Working directory inside the sandbox (default /workspace) stdin: Optional input to pipe into the command's stdin sandbox: Named sandbox to use (default "default")
Returns: Command output with stdout, stderr, exit code, and execution time.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| timeout | No | ||
| workdir | No | /workspace | |
| stdin | No | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It explains the sandbox context, parameters, and return values (stdout, stderr, exit code, time). However, it omits potential risks like destructive commands or permission details, leaving transparency incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise, using a clear bulleted list. Every sentence provides necessary information without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, output with multiple fields), the description covers all essential aspects: parameters, defaults, return info, and sandbox usage. It is self-contained and sufficient for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds significant value by explaining each parameter: command with examples, timeout default, workdir default, stdin optional, sandbox default. This goes beyond the schema's minimal titles and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Execute a shell command in the sandbox' with examples, making the verb and resource explicit. It distinguishes from siblings like 'python' or 'read_file' by focusing on arbitrary shell commands.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly provide when to use or avoid this tool versus alternatives. It implies usage by showing examples, but lacks guidance on when not to use it or mentions of sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
exposeA
Forward a sandbox port to localhost via TCP proxy.
Creates a local listener that proxies connections into the sandbox via container exec.
Args: port: Port number inside the sandbox (e.g., 8000, 3000, 5432). host_port: Port to listen on locally (default: same as sandbox port). sandbox: Named sandbox to expose (default "default").
Returns: Connection URL if successful, or error message.
| Name | Required | Description | Default |
|---|---|---|---|
| port | Yes | ||
| host_port | No | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose all behavioral traits. It explains the mechanism (creates a local listener via container exec) but does not detail side effects like port conflicts, reversibility (use unexpose), or security implications. Adequate but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, with a one-line purpose statement, a brief mechanism explanation, and a clear Args section listing parameters. Every sentence adds value with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (3 parameters, simple return value), the description is largely complete. It mentions the return type (connection URL or error). However, it lacks details on error scenarios or prerequisites (e.g., running sandbox). Slight gap but still effective.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the JSON schema provides no parameter descriptions. The tool's description compensates fully by explaining each parameter: port (required, integer), host_port (default same as port), and sandbox (default 'default'). This adds essential meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Forward a sandbox port to localhost via TCP proxy.' It specifies the verb (forward), resource (sandbox port), and mechanism (TCP proxy via container exec). This distinguishes it from siblings like 'unexpose' which reverses the operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (to expose a sandbox port locally) but does not explicitly state when not to use it or mention alternatives. The sibling 'unexpose' implies a complementary use, but no exclusions are given. Still, context is clear enough for most agents.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_cloneA
Clone a git repository into the sandbox.
Args: repo: Repository URL (e.g., "https://github.com/user/repo.git") branch: Branch to clone (default: repo's default branch) token: Optional auth token for private repos (injected securely, not in URL or history) path: Parent directory for clone (default: /workspace) shallow: If True, clone with --depth 1 for speed (default: True) sandbox: Named sandbox to use (default "default")
Returns: Clone result with repo info.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | ||
| branch | No | ||
| token | No | ||
| path | No | /workspace | |
| shallow | No | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description covers key behaviors: cloning into sandbox, token security, shallow clone default, and return value. However, it omits potential side effects like overwriting existing directories.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear Args and Returns sections, front-loaded with the action sentence. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core functionality and parameter details adequately. With an output schema present, the return value summary is sufficient. However, error handling or sandbox prerequisites could be mentioned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant meaning beyond the input schema (0% coverage) by explaining each parameter's purpose, defaults, and examples (e.g., repo URL format, token injection note).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Clone a git repository into the sandbox.' It uses a specific verb and resource, distinguishing it from siblings like the generic 'clone' tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for git repos and mentions optional features (branch, token, shallow), but does not explicitly state when to use this tool over alternatives or what prerequisites exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
healthA
Quick health check across all sandboxes: shell liveness, disk/memory pressure, uptime. Useful for diagnosing issues when commands fail or sandboxes become unresponsive.
Returns: Per-sandbox health summary with warnings for any issues detected.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes the tool's behavior as a read-only health check across all sandboxes, and mentions the return format (per-sandbox summary with warnings). Given no annotations, it adequately discloses its non-destructive nature and scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: two sentences and a return description, with no wasted words. Purpose is immediately clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with zero parameters and an output schema, the description fully covers the purpose, use case, and return value. It is complete and sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist; schema coverage is 100%. The description does not need to add parameter details. Baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly defines a health check across all sandboxes, specifying exact metrics (shell liveness, disk/memory pressure, uptime). Distinguishes from sibling tools like 'stats' or 'status' by being a global diagnostic.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the tool is useful for diagnosing issues when commands fail or sandboxes become unresponsive, giving clear context for when to invoke. However, does not mention when not to use or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
historyA
Show recent command history for a sandbox. Tracks the last 100 commands with exit codes and timing.
Args: limit: Number of recent commands to show (default: 20) sandbox: Named sandbox (default "default")
Returns: Command history with timing and exit codes.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes that it tracks last 100 commands with exit codes and timing, which is transparent. No annotations are provided, so the description carries the burden; it does not mention side effects, but none are expected for a history tool. Could explicitly state it is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: four short lines covering purpose, behavior, parameters, and returns. No unnecessary text, front-loaded with main purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 parameters, no required) and presence of an output schema, the description adequately covers what the tool does and what it returns. Could mention that it is read-only for extra safety clarity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description explains both parameters: limit (number of recent commands, default 20) and sandbox (named sandbox, default 'default'). This adds meaning beyond the schema's type/default only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it shows recent command history for a sandbox, and mentions tracking last 100 commands with exit codes and timing. It is specific and distinct from sibling tools like 'logs' or 'stats'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like 'logs' or 'stats'. Usage is implied for checking command history, but no when-not-to-use or comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
imagesA
List all available container images (base images + snapshots + custom builds).
Returns: Image listing with names and sizes.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description adequately describes the read-only operation and return format (names and sizes). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no fluff; front-loaded purpose and returns information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and presence of an output schema, the description is complete enough for this simple listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; schema coverage is 100%, so description adds no additional parameter meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it lists all available container images, specifying types (base, snapshots, custom builds). It distinguishes from sibling tools like list_snapshots by including all image types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implicit guidance by listing image types, but no explicit when-to-use or when-not-to-use compared to siblings like list_snapshots or list_all.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
installA
Install packages in the sandbox using apk (Alpine package manager).
Args: packages: Space-separated package names (e.g., "python3 nodejs git curl") sandbox: Named sandbox to use (default "default")
Returns: Installation result.
| Name | Required | Description | Default |
|---|---|---|---|
| packages | Yes | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It mentions using apk but does not disclose side effects (e.g., system changes), permissions required, or failure behavior. Important behavioral traits are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the main purpose. It covers args and returns without unnecessary words, but could be slightly more structured (e.g., separate sections).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (2 params, output schema exists), the description covers basics. However, for a mutation tool, it lacks behavioral details like permissions or side effects, making it adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description adds meaning: explains 'packages' as space-separated names and 'sandbox' as named with default. This compensates well for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: install packages using apk in a sandbox. It specifies the resource (packages) and context (sandbox), distinguishing it from sibling tools like spawn or exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for installing packages but does not provide explicit when-to-use or alternatives. It lacks guidance on prerequisites or scenarios where other tools might be better.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
killA
Kill a background process.
Args: name: Process name/ID from bg. sandbox: Named sandbox to use (default "default")
Returns: Confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It states 'kill' (a destructive action) and returns confirmation, but does not describe side effects (e.g., what happens if process doesn't exist), reversibility, or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using two short sentences plus a parameter list. Every sentence is necessary and front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple kill command with an output schema (confirmation), the description is minimally adequate. However, it lacks details on error handling, idempotency, and behavioral edge cases that would be expected given no annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning beyond the input schema: 'name' is clarified as 'Process name/ID from bg', and 'sandbox' includes a default value and context ('Named sandbox to use'). This compensates for the 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Kill a background process' with a specific verb and resource. It distinguishes from sibling tools like 'bg' (which starts background processes) and 'destroy' (which destroys sandboxes), making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., when to use 'kill' vs 'destroy' or 'bg'). The description does not mention prerequisites, exclusions, or context-specific advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_allB
List all active sandboxes with their status.
Returns: Table of sandbox names, containers, shell status, and idle time.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must disclose behavioral traits. It does not mention idempotency, safety, or side effects, though the operation is likely read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no fluff. The first sentence immediately states the purpose, and the second details the output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool with an output schema, the description is adequate. It names the return fields, though it could clarify 'active' status criteria.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the baseline is 4. The description adds value by specifying the return format (table of fields), supplementing the output schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List all active sandboxes with their status' which uses a specific verb and resource, distinguishing it from sibling tools like 'status' which likely targets a single sandbox.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like 'status' or 'health'. The agent is left to infer from the description alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_snapshotsA
List all available sandbox snapshots.
Returns: List of snapshot names, or "none" if no snapshots exist.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must carry full burden. It discloses return format ('list of names or 'none''), but does not explicitly state read-only nature or any other behavioral traits (e.g., side effects, auth needs). Adequate but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: one sentence for purpose and one for return description. No wasted words. Front-loaded with core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (no params, clear purpose), the description covers the essentials. Output schema exists, so return value detail is sufficient. Lacks explicit scope (e.g., 'for current sandbox') but is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters, and schema coverage is 100%. Description adds no parameter info beyond schema, which is expected. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'snapshots', specifying scope as 'all available sandbox'. This distinguishes it from sibling tools like 'snapshot' (create) and 'delete_snapshot'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use vs. alternatives. No mention of siblings or conditions for use. The description simply states what the tool does without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
logsA
Read output from a background process.
Args: name: Process name/ID from bg. tail: Number of lines to show from end (default: 50, use 0 for all). sandbox: Named sandbox to use (default "default")
Returns: Process output (stdout + stderr combined).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| tail | No | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries full burden. It discloses that the tool reads output, returns combined stdout+stderr, and does not mention destructive side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is extremely concise: one-line summary, clear parameter list, return description. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main functionality and parameters, but lacks error handling notes (e.g., if process not found) and context about scope (only background processes from bg).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description adds full meaning: name as process ID from bg, tail as line count with default and special value 0, sandbox with default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Read output from a background process', specifying the verb and resource. It distinguishes from siblings like 'bg' which starts processes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use after starting a background process but does not explicitly state when not to use it or mention alternatives for foreground processes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_infoA
Show network information for all sandboxes including IP addresses and pairwise connectivity. Useful for multi-sandbox workflows where services need to communicate.
Returns: Network info with IPs and connectivity status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It describes a read-only operation (showing information) but does not mention potential side effects, whether sandboxes must be running, latency implications, or any permissions required. The description is minimal and leaves many behavioral aspects unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: two short sentences for purpose and context, plus a brief return description. Every sentence adds value with no redundancies. It is front-loaded with the key action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that the tool has an output schema (not shown but indicated), the description does not need to fully explain return values. It states 'Network info with IPs and connectivity status,' which is sufficient. However, it omits any mention of authentication, rate limits, or scope (e.g., does it return info for all sandboxes or only those the user can access?). Still, for a simple informational tool, it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, and schema description coverage is 100% (no parameters to document). Therefore, the baseline is 4. The description does not need to add parameter details since there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Show network information for all sandboxes including IP addresses and pairwise connectivity.' It specifies a concrete verb ('show') and a specific resource ('network information for all sandboxes'). This distinctly sets it apart from sibling tools like 'health', 'status', or 'stats', which do not focus on network details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides usage context: 'Useful for multi-sandbox workflows where services need to communicate.' This implies when to use it (when checking inter-sandbox connectivity). It does not explicitly state when not to use it or offer alternatives, but among the sibling tools, none directly overlap with this network-specific functionality.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pythonA
Execute Python code in the sandbox (python3 is pre-installed in the default mcp-dev image).
Args: code: Python code to execute. timeout: Max seconds to wait (default 30). sandbox: Named sandbox to use (default "default")
Returns: Script output with stdout, stderr, exit code, and execution time.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | ||
| timeout | No | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the full burden. It mentions sandbox isolation and python3, but does not disclose potential side effects, resource limits, or security boundaries, leaving gaps in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a logical structure: purpose statement followed by an Args list and Returns summary. Every word adds value, with no unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, the description covers core aspects: purpose, parameters, and return values. It could elaborate on sandbox semantics or execution environment, but overall it is sufficient for basic use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description compensates by providing clear explanations for each parameter, including defaults for timeout and sandbox. Additional details like valid sandbox names or timeout behavior could improve it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it executes Python code in a sandbox, specifying python3 pre-installation. It distinguishes from siblings like 'exec' by focusing on Python, but could more explicitly contrast with alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as 'exec' or 'install'. The description does not mention scenarios or preconditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileA
Read a file from the sandbox.
Args: path: Absolute path to read (e.g., /workspace/output.txt) sandbox: Named sandbox to use (default "default")
Returns: File contents.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It does not disclose error behavior (e.g., missing file), side effects (none expected), or permissions. Only states it returns file contents.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: states purpose, then args, then returns. No unnecessary words. Front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with an output schema, the description covers basic behavior but lacks details on encoding, file size limits, or sandbox connectivity. Adequate but could be more robust.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description adds meaning: path is an absolute path with an example, sandbox has a default. While not exhaustive, it compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Read a file from the sandbox' with a specific verb and resource. Sibling tools like write_file and batch_write are distinct in action, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides basic usage (absolute path, default sandbox) but does not include guidance on when to use this tool versus alternatives like exec or batch_write. No exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resetA
Destroy the current sandbox and create a fresh one. Use this when you want a clean environment.
Args: wipe_workspace: If True, also delete all files in /workspace. If False (default), /workspace files persist across resets. sandbox: Named sandbox to reset (default "default")
Returns: Confirmation of the new sandbox.
| Name | Required | Description | Default |
|---|---|---|---|
| wipe_workspace | No | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description fully discloses behavior: it destroys and recreates sandbox, explains workspace persistence with wipe_workspace parameter, and mentions return confirmation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (3 sentences) and front-loaded with purpose. Could be slightly more structured (e.g., bullet list for args), but remains efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 optional params, output schema present), the description covers purpose, usage, and parameters. The return value is mentioned but not detailed, which is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description explains both parameters: wipe_workspace (bool, default false, effect on files) and sandbox (string, default 'default'), adding significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Destroy the current sandbox and create a fresh one,' which distinguishes it from sibling tools like destroy (only destroys) and spawn (creates new without destroying current).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It advises 'Use this when you want a clean environment,' providing clear context. However, it does not explicitly mention when not to use it or suggest alternatives like restore for preserving state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
restoreA
Destroy the current sandbox and boot from a saved snapshot. Workspace files are preserved (they live on a separate volume).
Args: snapshot_name: Name of the snapshot to restore (from list_snapshots) sandbox: Named sandbox to restore into (default "default")
Returns: Confirmation or error.
| Name | Required | Description | Default |
|---|---|---|---|
| snapshot_name | Yes | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses destructive behavior (destroy current sandbox) and file preservation. However, with no annotations, it lacks details on side effects (e.g., unsaved data loss), required permissions, or behavior on errors. It adds value beyond schema but is not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a clear purpose statement up front, followed by structured args and returns. The returns section is vague ('Confirmation or error.'), slightly reducing clarity, but overall it is well-organized and not verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive operation with no annotations and 0% schema coverage, the description covers core behavior and parameters. However, it lacks details on error scenarios, preconditions (e.g., snapshot must exist), and output format. The output schema exists but is not utilized in description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage, so the description adds essential meaning: snapshot_name references list_snapshots, sandbox mentions default value. This compensates for the schema gap and provides clear context for parameter selection.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool destroys the current sandbox and boots from a saved snapshot. It specifies that workspace files are preserved, which helps distinguish from related operations like destroy or clone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use after listing snapshots (referencing list_snapshots in the args) but does not explicitly state when to use this tool versus alternatives like clone or destroy. No guidance on when not to use or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
snapshotA
Save the current sandbox state as a reusable snapshot image. The snapshot captures installed packages and system state (not /workspace files, which live on a separate persistent volume).
Args: snapshot_name: Name for the snapshot (e.g., "with-pytorch", "ml-env") sandbox: Named sandbox to snapshot (default "default")
Returns: Confirmation or error.
| Name | Required | Description | Default |
|---|---|---|---|
| snapshot_name | Yes | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It explains that the tool saves state (non-destructive), captures only packages and system state (not /workspace), and returns a confirmation or error. It lacks details on auth or rate limits but is sufficient for a save operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the purpose. It uses a structured Args/Returns format, includes examples, and every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (though not shown), the description need not detail return values. It covers the core behavior, parameters, and key constraints. It could mention idempotency or overwrite behavior, but is otherwise complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It explains snapshot_name as a name for the snapshot with examples, and sandbox as the named sandbox with a default of 'default'. This adds meaning beyond the schema's plain field titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a clear verb+resource: 'Save the current sandbox state as a reusable snapshot image.' It specifies what is captured (installed packages and system state) and what is not (/workspace files), distinguishing it from sibling tools like restore, delete_snapshot, and list_snapshots.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (creating reusable snapshots) and provides example names ('with-pytorch', 'ml-env'). It does not explicitly state when not to use or compare with alternatives, but the sibling context covers related operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
spawnA
Spawn a child sandbox under a parent sandbox. The parent must have a spawn policy configured in SPAWN_POLICIES. Children have restricted capabilities (no clone/snapshot/restore/reset).
Args: image: Container image for child (default: first allowed image from parent's policy). parent: Name of the parent sandbox (must have spawn policy). name: Name for the child sandbox (auto-generated if empty). cpus: CPU cores for child (0 = use policy default, clamped to policy ceiling). memory: Memory for child e.g. "512M" (empty = use policy default, clamped to ceiling).
Returns: Child sandbox info or error.
| Name | Required | Description | Default |
|---|---|---|---|
| image | No | ||
| parent | No | default | |
| name | No | ||
| cpus | No | ||
| memory | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description discloses key behaviors: parent policy requirement, child capability restrictions, default image selection, auto-naming, and CPU/memory clamping. It does not discuss side effects on parent sandbox.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with purpose, and structured with bullet-pointed arguments. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no annotations, and an output schema (returns child sandbox info or error), the description fully covers parameter semantics, behavioral caveats, and return type, making it complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description compensates fully by explaining each parameter's default behavior, policy enforcement, and clamping logic, adding significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool spawns a child sandbox under a parent, uses specific verbs ('spawn a child sandbox'), and distinguishes from siblings like 'clone' and 'destroy_child' by mentioning restricted capabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies prerequisites (parent must have spawn policy) and child restrictions (no clone/snapshot/restore/reset), providing clear context, but does not explicitly compare to alternatives or state when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
statsB
Show resource usage (CPU, memory, disk) of the active sandbox.
Args: sandbox: Named sandbox to check (default "default")
Returns: Current resource usage statistics.
| Name | Required | Description | Default |
|---|---|---|---|
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so description carries the burden. It states it shows resource usage (read-only), but doesn't disclose error behavior, auth needs, or limitations beyond the sandbox parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Short and front-loaded with the main purpose. Args and Returns sections provide structure without unnecessary text. Only essential information is included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool is simple with one optional parameter. The description covers the resource types and argument. Output schema exists, so return details aren't needed. Adequate for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the Args section adds meaning: 'sandbox: Named sandbox to check (default "default")'. This explains the parameter's purpose beyond type and default, though no valid values or constraints are given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool shows resource usage (CPU, memory, disk) of the active sandbox. It uses a specific verb and resource, distinguishing it from siblings like 'health' or 'status', though not explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., 'health', 'status') is provided. The description only explains what it does, not the context or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
statusA
Show current sandbox and pool status.
Returns: Status information including active sandboxes, pool size, image, and network.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description mentions returns include active sandboxes, pool size, image, and network, but does not elaborate on side effects or permissions. No annotations provided, so transparency is moderate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise with two sentences that front-load the purpose. Every sentence is meaningful and no unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless tool with an output schema, the description fully covers the purpose and expected return values. No gaps given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters, so baseline is 4. The description adds value by explaining the output contents, which helps the agent understand what information will be returned.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool shows sandbox and pool status, using a specific verb and resource. It distinguishes from sibling tools like health or stats that may have different focuses.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'health' or 'stats'. Does not mention scenarios where it is inappropriate or when other tools should be preferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sync_startA
Start watching a local host directory and live-syncing changes into the sandbox. Does an initial full sync, then polls for changes every second. Ignores .git, node_modules, pycache, .venv, .DS_Store.
Args: local_dir: Absolute path on the host to watch. sandbox_dir: Destination directory in the sandbox (default: /workspace). sandbox: Named sandbox to sync to (default "default")
Returns: Sync job ID and initial sync stats.
| Name | Required | Description | Default |
|---|---|---|---|
| local_dir | Yes | ||
| sandbox_dir | No | /workspace | |
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully covers behavioral traits: initial full sync, polling frequency, ignored files. It does not mention blocking behavior or resource implications, but is otherwise transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: one sentence for purpose, then bullet-pointed technical details and args. Front-loaded with the main action, no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (sync tool with output schema), the description covers key aspects: initial sync, polling, ignores files, parameters, and return values. Could mention error handling or prerequisites, but is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description compensates fully by explaining all three parameters with types, defaults, and roles (local_dir absolute path, sandbox_dir destination, sandbox name). This adds essential meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Start watching' and 'live-syncing', and specifies the resources: local host directory and sandbox. It distinguishes from siblings like sync_stop and upload/download by describing its live-syncing behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on usage (initial sync, polling every second) but does not explicitly mention when not to use it or alternatives. It implies use for continuous syncing, which is adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sync_stopA
Stop a running file sync job.
Args: job_id: The sync job ID from sync_start.
Returns: Confirmation with total files synced.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses return value (confirmation with total files synced) but does not detail side effects or failure modes. With no annotations, more behavioral context would be beneficial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Highly concise: one sentence for purpose, standard docstring format for args/returns, no extraneous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple stop operation with one parameter and specified return. Could mention that the job must be running, but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains job_id as 'The sync job ID from sync_start', adding critical meaning beyond the schema's type-only definition. Compensates for 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'stop' and specific resource 'running file sync job'. Differentiates from sibling sync_start by implying the job was started earlier.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit context: job_id comes from sync_start. Implicitly indicates when to use (when a sync job is running) but no exclusionary guidance or alternatives beyond the sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unexposeA
Stop a port forward previously created by expose.
Args: port: The localhost port to stop forwarding.
Returns: Confirmation with connection stats.
| Name | Required | Description | Default |
|---|---|---|---|
| port | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the action and return value but does not disclose potential side effects, error conditions (e.g., if the port forward doesn't exist), or authorization requirements. Basic transparency, but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: one line for purpose, then clear Args and Returns sections. Every word is necessary and well-structured. No redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with an output schema (though not detailed), the description is largely complete. It explains the parameter and the return value. Missing details about error handling or behavior when the port is invalid, but overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage. The description adds meaningful semantics for the single parameter 'port' by explaining it is 'The localhost port to stop forwarding.' This compensates for the schema's lack of documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Stop a port forward previously created by expose.' It uses a specific verb ('stop') and resource ('port forward'), and distinguishes from sibling tools by referencing the 'expose' counterpart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context ('previously created by expose') but does not provide explicit when-to-use or when-not-to-use guidance. No alternatives are mentioned, though the pairing with 'expose' is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
uploadA
Copy a file or directory from the host into the sandbox.
Args: local_path: Absolute path on the host (file or directory). sandbox_path: Destination path inside the sandbox (default: /workspace). sandbox: Named sandbox to use (default "default")
Returns: Confirmation with transferred file count and size.
| Name | Required | Description | Default |
|---|---|---|---|
| local_path | Yes | ||
| sandbox_path | No | /workspace | |
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the copy direction and return value (confirmation with file count and size) but does not mention overwrite behavior, permissions, error handling, or limitations. More behavioral detail would improve transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, using an Args/Returns format. It front-loads the purpose and contains no unnecessary words. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of an output schema, the description covers input parameters and return value adequately. Missing details like overwrite behavior or error cases, but overall sufficient for a basic copy operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description fully compensates by explaining each parameter: local_path (absolute path), sandbox_path (destination, default /workspace), sandbox (name, default 'default'). This adds critical meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Copy a file or directory from the host into the sandbox,' which is a specific verb and resource. It clearly distinguishes from siblings like download (reverse direction) and write_file (writing content).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains parameters but does not provide explicit when-to-use guidance, exclusions, or alternatives. It implies usage for copying files into the sandbox but lacks context on when not to use it or how it differs from similar tools like write_file.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_fileA
Write content to a file in the sandbox.
Args: path: Absolute path in the sandbox (e.g., /workspace/script.py) content: File content to write. sandbox: Named sandbox to use (default "default")
Returns: Confirmation with file path and size.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| content | Yes | ||
| sandbox | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but the description is transparent: it's a write operation with confirmation return. It could mention overwrite behavior explicitly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args and Returns sections, clear and relatively concise. Could be slightly more compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, description covers return (file path and size). Adequate for a write tool, but could mention error handling or overwriting behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description explains each parameter with examples and defaults. Missing details like allowed characters or size limits.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Write' and resource 'file in the sandbox', clearly distinguishing it from siblings like read_file or batch_write.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states the tool's purpose (write content to a file) but does not explicitly mention when not to use it or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct purpose, from file operations to process management, sandbox lifecycle, networking, and snapshots. There is no ambiguity between tools like exec, python, bg, or between destroy and reset.
All tool names follow a consistent lowercase snake_case convention, with verbs typically preceding nouns (e.g., git_clone, batch_write, sync_start). Exceptions like 'expose' and 'kill' are still clear and fit the verb-first pattern.
With 35 tools, the server is comprehensive but slightly large. It covers many aspects of sandbox management, but a few tools like 'sync_start' and 'sync_stop' or 'expose' and 'unexpose' could be combined, reducing count without loss of clarity.
The tool set covers core sandbox operations well, but notable gaps exist: no explicit sandbox creation tool (only reset or spawn), no tool for listing directory contents or deleting files, and no detailed configuration retrieval. Users may need to rely on exec for basic file management.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Your AI Agent's Infrastructure Layer. Connect Claude, Copilot, Codex, or ChatGPT to 200+ managed open source services. Start databases, pipelines, and applications through natural language.
The cloud for agents. Tools for AI agents to register, build, and deploy other agents. Zero human required.
Deploy and manage your apps, databases, storage, and scheduled jobs from your AI agent
Related MCP Servers
- AlicenseAqualityBmaintenanceRun AI agents in VM-isolated sandboxes on your Mac.151MIT
- AlicenseNot gradedqualityAmaintenancePersistent, secure LXC sandbox environments for AI agents with native MCP support.276Apache 2.0
- AlicenseAqualityCmaintenanceEphemeral MicroVM-isolated code execution for AI agents. Run Python, Node, or bash — fresh hardware-isolated VM per call, hard-purged after. No state persists between calls.1317MIT
- AlicenseNot gradedqualityBmaintenanceProvides a restricted Docker-based sandbox for LLM agents, enabling file operations, command execution, and local Git within an isolated runtime.724MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/bird/sandbox-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server