MCP server for Declaw — secure sandbox execution for AI agents with network policies, PII scanning, prompt injection defense, and audit logging.
Works with Claude Desktop, Claude Code, Cursor, Windsurf, and any MCP-compatible AI tool.
Add to your MCP config:
{
"mcpServers": {
"declaw": {
"command": "npx",
"args": ["-y", "@declaw/mcp-server"],
"env": {
"DECLAW_API_KEY": "your-api-key"
}
}
}
}claude mcp add declaw -- npx -y @declaw/mcp-serverSet DECLAW_API_KEY in your environment.
Related MCP server: agent-sandbox-mcp
Tool | Description |
| Create a secure sandbox with configurable security policies |
| Execute a shell command inside a sandbox |
| Read a file from a sandbox |
| Write a file to a sandbox |
| List directory contents in a sandbox |
| Destroy a sandbox |
| List all active sandboxes |
When creating a sandbox, choose a security preset:
none — No guardrails. Full internet access.
standard (default) — PII scanning + audit logging. Full internet access.
strict — PII scanning + prompt injection defense + audit logging + network deny-all.
You can also pass allowed_domains to restrict outbound traffic to specific domains:
create_sandbox with template="python", security_preset="strict", allowed_domains=["pypi.org", "github.com"]Declaw | Other Sandbox Providers | |
Sandbox execution | Yes | Yes |
Non-bypassable network controls | Yes | ?? |
PII scanning | Yes | No |
Injection defense | Yes | No |
Full audit trail | Yes | Basic |
Snapshots | Yes | Varies |
Multiple templates | 8 built-in | Varies |
Interactive stdio | Yes | Varies |
Variable | Required | Description |
| Yes | Your Declaw API key |
| No | Custom API domain (for on-prem deployments) |
For self-hosted Declaw deployments, set the domain:
{
"mcpServers": {
"declaw": {
"command": "npx",
"args": ["-y", "@declaw/mcp-server"],
"env": {
"DECLAW_API_KEY": "your-api-key",
"DECLAW_DOMAIN": "declaw.internal.company.com"
}
}
}
}Apache-2.0
Create a new secure sandbox environment. Returns a sandbox_id to use with other tools.
Inputs: envs, timeout, template, allowed_domains, +1 more.
Destroy a sandbox and release its resources.
Inputs: sandbox_id (required).
List files and directories at a given path in a sandbox.
Inputs: sandbox_id (required), path.
List all active sandboxes for the current API key.
Inputs: no named parameters.
Read a text file from a sandbox.
Inputs: path (required), sandbox_id (required).
Execute a shell command inside a sandbox. Returns stdout, stderr, and exit code.
Inputs: command (required), sandbox_id (required), timeout.
Write text content to a file in a sandbox. Creates parent directories automatically.
Inputs: path (required), content (required), sandbox_id (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 7 tools
Each tool has a clearly distinct purpose: sandbox lifecycle (create, kill, list) versus in-sandbox operations (run command, read/write file, list files). No overlapping functionality.
All tools follow a consistent verb_noun snake_case pattern (create_sandbox, kill_sandbox, run_command, read_file, etc.), with predictable alignment between verbs and actions.
Seven tools is well-scoped for a sandbox server, covering both lifecycle management and common file/command operations without redundancy or bloat.
Core lifecycle and file operations are covered, but there is no file delete or directory removal tool, which would be a natural expectation for file management in a sandbox.
Secure Linux sandboxes for AI agents, as MCP tools.
Execution platform for AI agents on Firecracker microVMs in the EU. Interactive Linux sandboxes with root, templates for Python, Node.js, Go, Rust and a headless browser, public HTTPS URLs. Background jobs that outlive the connection, batches of up to 1,000 jobs with dependencies, hard cost caps reserved up front, execution receipts with SHA-256, log digests that fit the context. IPv4, dual-stack or IPv6-only with its own public address, allowlists or no network. WASI runtime for small tasks. Idle sandboxes sleep and keep their files. Also REST API, Python SDK and LangChain.
Run AI agent tasks in isolated sandboxes with a cost cap, saved workflows and scoped connections.
Sandboxes, storage, secrets, queues, timers, locks, inboxes and run ledger for AI bots. One MCP.
