Skip to main content
Glama
flujo-app

mcp-sandbox-computer-vm-for-ai

by flujo-app
OverviewSchemaRelated ServersScoreDiscussions
Python
Hybrid

MCP Sandbox Computer VM for AI is a lifecycle-focused fork of Kilntainers. It gives agents isolated Linux computers, stable IDs, temporary or persistent lifecycles, an interactive MCP App dashboard, and first-class Docker and Fly Machines backends.

  • 🖥️ MCP App dashboard: List computers, run commands, restart, factory reset, and delete from FLUJO or another stable MCP Apps host.

  • 🏷️ Named computers: Reconnect with a stable computer_id, or omit it to receive a readable random slug.

  • 💾 Explicit lifecycle: Temporary computers are removed with their MCP session; permanent computers survive and can be reattached later.

  • 🧰 Multiple backends: Docker/Podman, native Fly Machines, Modal, E2B, and WebAssembly.

  • 🏝️ Isolated per agent: Every agent gets its own dedicated sandbox — no shared state, no cross-contamination.

  • 🔒 Secure by design: The agent communicates with the sandbox over MCP — it doesn’t run inside it. No agent API keys, code, or prompts are exposed to the sandbox.

  • 🔌 Tool and UI access: sandbox_exec stays simple, while provider-neutral lifecycle tools power both models and the dashboard.

  • 📈 Scalable: Scale from a few agents on your laptop to thousands running in parallel in the cloud.

Why sandbox computers?

Agents are already excellent at using terminals and can save thousands of tokens with common Linux utilities like grep, find, jq, and awk. Giving an agent access to the host OS is dangerous, while provisioning large numbers of isolated environments is operationally painful. MCP Sandbox Computer VM for AI gives every agent a dedicated sandbox with an explicit lifecycle.

Related MCP server: open-computer-use

Quick Start

Run the released package directly from PyPI. Docker and stdio are the defaults:

uvx mcp-sandbox-computer-vm-for-ai

Add it to Claude Code:

claude mcp add --scope user sandbox-computer -- uvx mcp-sandbox-computer-vm-for-ai

Or add it to a JSON-based MCP client such as Claude Desktop:

{
  "mcpServers": {
    "sandbox-computer": {
      "command": "uvx",
      "args": ["mcp-sandbox-computer-vm-for-ai"]
    }
  }
}

Call computer_dashboard to open the MCP App. The dashboard has no external browser dependencies. Its internal resource URI remains ui://kilntainers/computers for compatibility with the upstream implementation.

Named computer lifecycle

sandbox_exec accepts two additional optional inputs:

  • computer_id: a 1–63 character lowercase slug. The first call without one creates a readable random ID and reuses it as that MCP session's default.

  • temporary: defaults to true. Temporary computers are removed when the owning MCP session closes. Set it to false for a computer that survives server/session shutdown and can be reattached later by ID.

Every execution result includes computer_id and temporary next to stdout, stderr, exit code, and duration:

{
  "computer_id": "steady-otter-a31f",
  "temporary": false,
  "stdout": "persistent\n",
  "stderr": "",
  "exit_code": 0,
  "exec_duration_ms": 84
}

Lifecycle tools are provider-neutral:

Tool

Purpose

computer_dashboard

Open the MCP App and return the current inventory

computer_list

List state, backend, image, provider ID, and lifecycle mode

computer_create

Create/attach by ID; omission always generates a new slug

computer_restart

Restart while preserving writable state

computer_factory_reset

Erase writable state and recreate from the base image

computer_delete

Permanently remove the computer

How It Works

┌─────────────┐   MCP   ┌──────────────┐      ┌─────────────────────────┐
│  LLM Agent  │◄───────►│  Sandbox MCP │◄────►│  Sandboxes              │
│  (client)   │         │  MCP Server  │      │  - Docker/Podman        │
│             │         │              │      │  - Cloud VM (Modal,E2B) │
│             │         │              │      │  - WASM Sandbox         │
└─────────────┘         └──────────────┘      └─────────────────────────┘

  1. An MCP client starts MCP Sandbox Computer VM for AI over stdio or connects over HTTP

  2. On the first sandbox_exec call, the server creates a named isolated computer. Each connection gets its own random default unless it explicitly attaches by ID.

  3. Commands run inside the sandbox; stdout, stderr, and exit code are returned

  4. When the session ends, temporary computers are destroyed; permanent computers remain provider-side.

Security: The agent communicates with the sandbox over MCP — it doesn't run inside it. This is intentional: agents often need secrets (API keys, system prompts, code), and those should never be exposed inside a sandbox where a prompt injection could exfiltrate them.

Agent Isolation & Sandbox Lifecycle: An omitted ID gives each MCP connection an isolated default computer. Explicit IDs make reconnection intentional. Docker labels and Fly Machine metadata make permanent computers discoverable after the MCP server itself restarts.

Backend Examples

See the CLI Reference for all arguments.

Docker and Podman (default)

Local containers via Docker or Podman. Any OCI image works.

uvx mcp-sandbox-computer-vm-for-ai                                # Docker + Debian (defaults)
uvx mcp-sandbox-computer-vm-for-ai --image alpine --engine podman # Podman + Alpine
uvx mcp-sandbox-computer-vm-for-ai --image node:22                # Node.js with networking
uvx mcp-sandbox-computer-vm-for-ai --no-network                   # Disable networking

Docker Compose dashboard server

The included image contains the Docker CLI and talks to the host daemon through its socket:

docker compose up --build
# Streamable HTTP MCP endpoint: http://127.0.0.1:8080/mcp

compose.yaml binds only to loopback. For a remote listener, set KILNTAINERS_AUTH_TOKEN and send it as an Authorization: Bearer … header. Mounting the Docker socket grants the service control of the host Docker daemon; use a dedicated host or a restricted remote daemon in production.

Fly Machines

Fly.io deploys a Docker image as a VM root filesystem and does not run a nested Docker daemon. The fly backend therefore provisions real Fly Machines through flyctl: temporary Machines use disposable root filesystems, while permanent Machines use persist_rootfs=always.

fly apps create mcp-sandbox-computer-vm-for-ai

# Use an app-scoped token for Machine list/create/exec/destroy operations.
fly secrets set -a mcp-sandbox-computer-vm-for-ai \
  FLY_API_TOKEN="$(fly tokens create deploy -a mcp-sandbox-computer-vm-for-ai)" \
  KILNTAINERS_AUTH_TOKEN="$(openssl rand -hex 32)"

fly deploy

The MCP endpoint is https://mcp-sandbox-computer-vm-for-ai.fly.dev/mcp. Configure the same KILNTAINERS_AUTH_TOKEN as a bearer header in the MCP client. fly.toml keeps the controller Machine running because it owns MCP sessions and cleanup; sandbox Machines are standalone Machines distinguished by project metadata and are not part of the controller process group.

The included fly.toml defaults to Fly's São Paulo region (gru). Change primary_region and, when needed, FLY_REGION if you want the controller and newly created sandbox Machines in another supported region.

Cloud Containers & VMs

Modal.com

Hosted containers with sub-second startup via Modal.com. Scales to thousands of parallel sandboxes. Supports GPUs.

uvx mcp-sandbox-computer-vm-for-ai --backend modal
uvx mcp-sandbox-computer-vm-for-ai --backend modal --gpu A10G --region us-east

Authenticate via modal setup CLI or --modal-token-id / --modal-token-secret flags.

E2B

Cloud hosted micro-VM sandboxes from E2B.

uvx mcp-sandbox-computer-vm-for-ai --backend e2b
uvx mcp-sandbox-computer-vm-for-ai --backend e2b --e2b-api-key ABCD --e2b-template my-custom-alpine

Authenticate with --e2b-api-key CLI arg, or E2B_API_KEY environment variable.

WASM Go BusyBox (Experimental)

Runs go-busybox in a WebAssembly sandbox. Not a full Linux environment, but provides common utilities (grep, awk, sed, ls, wc, sort, etc.) in a very lightweight and secure sandbox.

uvx --from "mcp-sandbox-computer-vm-for-ai[wasm]" mcp-sandbox-computer-vm-for-ai --backend go_busybox

WASM Runner

Run a custom WASM module as the sandbox backend. Provides agents a set tools compiled to WebAssembly, and an isolated filesystem.

uvx --from "mcp-sandbox-computer-vm-for-ai[wasm]" mcp-sandbox-computer-vm-for-ai --backend wasm --wasm-path ./my_tool.wasm

Installation

uvx mcp-sandbox-computer-vm-for-ai                    # run without installing
uv tool install mcp-sandbox-computer-vm-for-ai        # recommended
uv tool install mcp-sandbox-computer-vm-for-ai[wasm]  # include WASM backends (+15MB)
pip install mcp-sandbox-computer-vm-for-ai            # also works with pip

Requires Python 3.13+. Docker backend requires Docker or Podman. The Modal and E2B backends require accounts to those services.

Releasing

Node is used only as the cross-platform release task runner; the published package remains Python. The release command synchronizes all package and registry metadata.

npm run release:check                 # credential-free command self-check
npm run check                         # lint, types, tests, and package build
npm run release -- --dry-run          # full main-branch preflight, no changes
npm run release                       # patch version; GitHub publishes PyPI via OIDC
npm run release -- minor              # minor version release
npm run release -- 1.0.0              # exact version release

PyPI publication uses Trusted Publishing, so no PyPI token is stored locally or in GitHub. Configure the PyPI publisher once with owner flujo-app, repository mcp-sandbox-computer-vm-for-ai, workflow release.yml, and environment pypi. The release command pushes the version commit and tag, dispatches .github/workflows/release.yml, and waits for PyPI and the GitHub Release.

After the PyPI version is visible, validate and publish its immutable metadata to the official MCP Registry:

npm run registry:validate             # downloads pinned publisher; publishes nothing
npm run registry:release              # GitHub login, then publish server.json

The registry command verifies the published PyPI README ownership marker before authenticating. mcp:validate and mcp:publish are retained as aliases matching the sibling MCP App repositories.

CLI Reference

usage: mcp-sandbox-computer-vm-for-ai [-h] [--backend {docker,e2b,fly,go_busybox,modal,wasm}] [--transport {stdio,http}] [...]

MCP server providing isolated Linux sandboxes for LLM agent shell execution.

options:
  -h, --help            show this help message and exit

core options:
  --backend {docker,e2b,fly,go_busybox,modal,wasm}
                        Backend to use (default: docker)
  --transport {stdio,http}
                        MCP transport (default: stdio)
  --host HOST           HTTP bind address (default: 127.0.0.1, HTTP mode only)
  --port PORT           HTTP listen port (default: 8435, HTTP mode only)
  --timeout TIMEOUT     Default exec timeout in seconds (default: 120)
  --output-limit OUTPUT_LIMIT
                        Max combined stdout+stderr bytes per exec (default: 2097152 = 2 MiB)
  --session-timeout SESSION_TIMEOUT
                        Idle session timeout in seconds (default: 300, HTTP mode only)
  --auth-token AUTH_TOKEN
                        Bearer token for /mcp (default: KILNTAINERS_AUTH_TOKEN)
  --allow-unauthenticated-http
                        Explicitly allow a non-loopback listener without built-in auth
  --shell SHELL         Shell binary for command mode (e.g., /bin/bash, ash). Default: /bin/bash.
  --network, --no-network
                        Enable network access in sandboxes (default: enabled)

tool description:
  --tool-instruction-override TOOL_INSTRUCTION_OVERRIDE
                        Replace the entire sandbox_exec tool description
  --extended-tool-instruction EXTENDED_TOOL_INSTRUCTION
                        Append to the backend's default tool description

docker backend options:
  --engine ENGINE       Container CLI binary (default: docker). Supports podman.
  --docker-host DOCKER_HOST
                        Docker daemon socket/address, passed as -H to the Docker CLI (e.g., "ssh://user@remote-host", "tcp://host:2375")
  --image IMAGE         Docker image (default: debian:bookworm-slim)
  --cpu CPU             Docker CPU limit (e.g., "1.5")
  --memory MEMORY       Docker memory limit (e.g., "512m")
  --docker-run-flag DOCKER_RUN_FLAGS
                        Additional flag passed to docker run. Repeatable. (e.g., --docker-run-flag "--pids-limit=256")

fly backend options:
  --fly-cli FLY_CLI     flyctl/fly executable (default: fly)
  --fly-app FLY_APP     Fly App that owns sandbox Machines (default: FLY_APP_NAME)
  --fly-token FLY_TOKEN Fly API token (default: FLY_API_TOKEN or FLY_TOKEN)
  --fly-image FLY_IMAGE Base OCI image for sandbox Machines
  --fly-region FLY_REGION
                        Region for newly created Machines
  --fly-cpu-kind {shared,performance}
  --fly-cpus FLY_CPUS
  --fly-memory FLY_MEMORY
                        Memory per Machine in MB
  --fly-rootfs-size FLY_ROOTFS_SIZE
                        Optional root filesystem size in GB

e2b backend options:
  --e2b-api-key E2B_API_KEY
                        E2B API key (overrides E2B_API_KEY environment variable)
  --e2b-template E2B_TEMPLATE
                        E2B template name or ID (default: base)
  --e2b-sandbox-timeout E2B_SANDBOX_TIMEOUT
                        Sandbox lifetime timeout in seconds (default: 3600)
  --e2b-metadata E2B_METADATA
                        Metadata key=value pairs (can be used multiple times)
  --e2b-env E2B_ENV     Environment variable key=value pairs (can be used multiple times)

modal backend options:
  --modal-token-id MODAL_TOKEN_ID
                        Modal token ID (overrides environment/default auth)
  --modal-token-secret MODAL_TOKEN_SECRET
                        Modal token secret (overrides environment/default auth)
  --modal-app-name MODAL_APP_NAME
                        Modal app name
  --modal-cpu MODAL_CPU
                        CPU cores (fractional, default: 1.0)
  --modal-memory MODAL_MEMORY
                        Memory in MiB (default: 512)
  --gpu GPU             GPU type (e.g., "A10G", "H100")
  --region REGION       Geographic region (e.g., "us-east")
  --sandbox-timeout SANDBOX_TIMEOUT
                        Sandbox lifetime timeout in seconds (default: 3600, max 86400)

wasm backend options:
  --wasm-path WASM_PATH
                        Path to the .wasm file to execute (required for wasm backend)
  --wasm-max-memory WASM_MAX_MEMORY
                        Max WASM memory in MiB (default: 256)
  --wasm-fuel WASM_FUEL
                        WASM instruction fuel limit (default: unlimited)

Available Tools

7 tools
computer_createA

Create a temporary or permanent sandbox computer. If computer_id is omitted, a readable random slug is returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
temporaryNoRemove on MCP session shutdown when true; persist and allow reattachment by ID when false.
computer_idNoOptional lowercase slug. Omit to generate a readable random ID.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It conveys the temporary/permanent distinction and the ID generation behavior, but it does not explain other important aspects such as required permissions, what a 'sandbox computer' entails, or the return format beyond the slug. It adds some context but leaves significant gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the main purpose, and contains no filler or repetition. Every clause adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple create tool with two optional parameters and no output schema, the description covers the core purpose and the key ID behavior. However, it does not state the exact return value beyond the slug, and it lacks details about side effects, so it is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents both parameters. The description's mention of 'readable random slug' is redundant with the schema's description of computer_id. The description adds no new parameter semantics beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Create') and the resource ('temporary or permanent sandbox computer'), and it distinguishes itself from the sibling tools (exec, list, restart, etc.) by specifying the creation action. No ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool (to create a sandbox computer) and hints at the temporary/permanent choice. It does not explicitly mention alternatives or exclusions, but the purpose is self-evident given the sibling tool names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_dashboardSandbox Computer DashboardA

Open the interactive MCP App dashboard for listing computers, running terminal commands, restarting, factory-resetting, and deleting.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It lists dashboard capabilities but fails to disclose what opening the dashboard entails (e.g., launches a UI, returns a URL, blocks execution) or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that clearly states the action and resource, then efficiently enumerates the dashboard's capabilities. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema or annotations, the description should clarify what the tool returns or how it behaves. It lists capabilities but omits details about the dashboard interface, output format, or any prerequisites, leaving gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description is not expected to explain parameters. The baseline of 4 applies, and the description correctly focuses on the tool's purpose instead of parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool opens an interactive dashboard for managing computers, listing concrete capabilities (listing, running commands, restarting, deleting). This clearly distinguishes it from sibling tools that perform individual actions, as it is the aggregator dashboard.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use the dashboard versus individual sibling tools like computer_list or sandbox_exec. The description implies a general use case but lacks explicit context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_deleteA

Permanently delete a computer and all of its writable state.

ParametersJSON Schema
NameRequiredDescriptionDefault
computer_idYesComputer slug to permanently delete

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of disclosing behavior. It does state 'permanently delete' and 'all of its writable state,' which are critical. However, it lacks details about side effects, reversibility beyond 'permanently,' or any prerequisites/permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is front-loaded with the key fact (permanent deletion) and scoping ('writable state'). Every word earns its place; no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple destructive tool with one parameter and no output schema, the description adequately covers the operation's impact. It could mention that the action is irreversible or that it removes the computer from management, but 'permanently' and 'all writable state' largely cover the essentials.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of the single parameter, including its description. The tool description doesn't add extra meaning beyond what the schema already provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (permanently delete), the resource (a computer), and the scope (all of its writable state). It distinguishes this from sibling tools like computer_restart and computer_factory_reset by emphasizing permanence and deletion of state.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. It does not mention scenarios where this tool is appropriate (e.g., removing a computer entirely) or when other tools like computer_factory_reset should be used instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_factory_resetA

Erase a computer's writable filesystem and recreate it from the base image.

ParametersJSON Schema
NameRequiredDescriptionDefault
computer_idYesComputer slug whose writable state will be erased

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It clearly states the destructive action ('erase') and the restoration process, which informs the agent of the irreversible nature. However, it omits details like downtime or that all data will be lost beyond 'writable filesystem', which is slightly implicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that directly states the action and object. Every word is meaningful, with no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has a simple parameter set and no output schema, so the description is sufficient for basic understanding. However, it lacks additional context such as the irreversibility of the operation, potential downtime, or any prerequisites, which would be valuable for a destructive action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides a complete description for the single parameter (computer_id), and schema coverage is 100%. The tool description adds no additional parameter details, which is acceptable given the high coverage baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('erase') and resource ('computer's writable filesystem'), clearly distinguishing this from siblings like computer_restart (which restarts) and computer_delete (which removes the computer). It precisely states the factory reset action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use it (to reset a computer to its base state), but it does not explicitly specify exclusions or alternatives. Sibling tool names suggest context, but the description itself offers no direct 'use this instead of' guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_listA

List all sandbox computers managed by the selected backend.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears the full burden of behavioral disclosure. It only states the action and scope, omitting details about return format, pagination, authentication, or side effects. For a list tool, this is minimally acceptable but adds little beyond the name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence stating the exact action, resource, and scope, with no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter list tool, the description is mostly complete. It could mention what fields are returned or the need to select a backend, but the core use case is clearly covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description cannot add parameter-specific meaning. The baseline of 4 is appropriate since there are no parameter semantics to clarify.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' with a clear resource ('sandbox computers') and scope ('managed by the selected backend'). It distinguishes itself well from sibling tools like create, delete, restart, and dashboard by focusing on inventory listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies a read-only list action but does not explicitly state when to prefer this over computer_dashboard or when to use sandbox_exec. No exclusions or alternative tool references are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_restartA

Restart a computer without erasing its writable filesystem.

ParametersJSON Schema
NameRequiredDescriptionDefault
computer_idYesComputer slug to restart

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the transparency burden. It proactively discloses that the operation does not erase the writable filesystem, which is a key behavioral guarantee. It does not mention other behavioral aspects like graceful vs. forced restart, but for this simple operation, the main concern (data loss) is addressed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that immediately states the action and the key qualifier. It has zero fluff and is perfectly front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity (1 parameter, no annotations, no output schema), the description sufficiently covers the tool's purpose and the most important behavioral characteristic (non-destructive restart). It could have elaborated on prerequisites or effects on running processes, but the provided information is adequate for a simple restart tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides 100% coverage for the single parameter 'computer_id' with a clear description ('Computer slug to restart'). The tool description adds no additional parameter context, so a baseline score of 3 is appropriate per the schema coverage guideline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Restart') and resource ('computer'), and explicitly distinguishes from the sibling 'computer_factory_reset' by stating 'without erasing its writable filesystem'. This makes the tool's purpose clear and differentiates it from similar operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context that this tool is for restarting while preserving the filesystem, which implies it should be used over factory reset when data retention is desired. However, it doesn't explicitly name alternatives or state when not to use it, so it just misses a top score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_execA

Execute a shell command in an isolated Debian Linux sandbox. Commands run in bash. Each call is independent — no state (shell variables, working directory) persists between calls (however filesystem does persist). Use the working_directory parameter or chain commands with && to control execution context.

To write files or pass data without shell escaping, use the stdin parameter (e.g., command="cat > file.txt" with content in stdin). Commands time out after 120 seconds by default (override with the timeout parameter for long-running operations).

ParametersJSON Schema
NameRequiredDescriptionDefault
argsNoList of arguments for direct execution (mutually exclusive with command).
stdinNoContent to pipe to stdin.
commandNoShell command string (mutually exclusive with args).
timeoutNoTimeout in seconds (defaults to server config).
temporaryNoRemove the computer when its MCP session shuts down. Set false to keep it provider-side and reconnect by computer_id.
computer_idNoStable computer slug. Omit to create and select a readable random ID for this MCP session.
working_directoryNoWorking directory for the command (must be absolute).

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for behavioral disclosure. It reveals key traits: isolation, bash execution, statelessness between calls (but filesystem persistence), and a 120-second default timeout. It does not mention the temporary/computer_id lifecycle behavior or how output is returned, hence a 4 rather than 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with two focused paragraphs. Every sentence adds valuable information: purpose, execution environment, state persistence, usage tips, stdin, and timeout. There is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description covers execution context well, there is no output schema and the description does not mention return values, exit codes, or output capture. Additionally, the temporary and computer_id parameters are not explained in the description, leaving these lifecycle aspects under-specified. This is a clear gap for a command-execution tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, giving a baseline of 3. The description adds meaningful context beyond the schema by explaining the default timeout (120 seconds), how to use 'stdin' for escaping issues, and how working_directory can be used to control execution context. This lifts it to a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Execute a shell command in an isolated Debian Linux sandbox,' which clearly states a specific action and resource. It further clarifies that commands run in bash, distinguishing it from the sibling computer-management tools that do not execute commands.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage instructions, such as using 'working_directory' or chaining commands with '&&' to control execution context, and using 'stdin' to safely pass data. It also notes the default timeout and how to override it. However, it does not mention alternatives among sibling tools or explicitly state when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.6/5.0
Disambiguation4/5

Most computer_* tools have clearly distinct lifecycle actions (list, create, restart, reset, delete), and sandbox_exec is distinct as the only command-execution tool. However, computer_dashboard overlaps in purpose by offering an interactive UI for the same operations, and the relationship between sandbox_exec and the managed computers is ambiguous.

Naming Consistency3/5

The computer_* tools follow a consistent verb pattern (list, create, restart, factory_reset, delete), but sandbox_exec uses a different prefix and computer_dashboard is a noun, breaking the verb_noun consistency. The mixed prefixes and one non-verb make the naming only moderately predictable.

Tool Count5/5

7 tools is well within the ideal 3-15 range for a server focused on sandbox/computer VM management. Each tool addresses a core lifecycle or execution need without unnecessary bloat.

Completeness2/5

The lifecycle coverage is decent (create, list, restart, reset, delete), but there is no way to programmatically execute commands on a specific computer; sandbox_exec appears to target a generic sandbox rather than the managed computers. Missing get/status for individual computers also creates a dead end for inspection.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/flujo-app/mcp-sandbox-computer-vm-for-ai'

If you have feedback or need assistance with the MCP directory API, please join our Discord server