Sandbox MCP
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Sandbox MCPRun the test suite in a sandbox and show me the results"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Sandbox MCP
AI coding agents are powerful because they can execute code. That is also their biggest risk: experimentation can modify the developer's environment.
An agent that is genuinely useful has to be able to run npm install, apply a
migration, try a build, or run code it has not read. Every one of those actions,
performed on your machine, can install something you did not want, overwrite
work in progress, burn your CPU, read your credentials, or leave behind an
environment that no longer builds.
The usual answers are both bad. Deny the agent those tools and it can only guess. Allow them and you are trusting a probabilistic system with your laptop.
Sandbox MCP is the third answer: give the agent somewhere real to work that is not your machine.
"Experiment with this project, but don't touch my actual environment."
Without a sandbox
flowchart TD
CC["Claude Code"] --> HOST["Your machine"]
HOST --> A["npm install"]
HOST --> B["scripts"]
HOST --> C["migrations"]
HOST --> D["file modifications"]
HOST --> E["arbitrary execution"]
classDef danger fill:#fdeceb,stroke:#d1453b,color:#7a1f18
classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
class HOST,A,B,C,D,E danger
class CC actorRelated MCP server: Advanced MCP Server
With Sandbox MCP
flowchart TD
CC["Claude Code"] --> MCP["FastMCP"]
MCP --> POL["Experiment policy"]
POL --> SBX["Docker sandbox"]
SBX --> WORK["execute · modify · test<br/>build · experiment"]
WORK --> RES["Results"]
RES --> CC
classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
class SBX,WORK safe
class CC,MCP,POL,RES actorWhat makes this different from a Docker MCP server
Existing Docker MCP implementations expose Docker operations to AI agents. Sandbox MCP exposes an experimentation abstraction.
That is not a wording preference; it changes what the agent can do.
A Docker MCP server | Sandbox MCP | |
Tools |
|
|
The agent decides | flags, mounts, network mode, privileges | what it wants to find out |
Isolation | whatever the agent passed | enforced by policy before Docker is called |
Host filesystem | reachable via | not reachable; the project is snapshot-copied |
"What changed?" | ask the agent to diff it |
|
Failure mode | an agent that mounts | a request the policy engine rejects |
The agent never receives Docker API access. It states an intent; the server decides how that intent is realised.
flowchart TB
CC["Claude Code"] -- "MCP tool call" --> SERVER
subgraph SERVER["Sandbox MCP · the only component holding the socket"]
direction LR
POL["Policy / Security<br/><i>validates · clamps · refuses</i>"]
EXP["Experiment Manager<br/><i>lifecycle · state machine</i>"]
JOB["Job Manager<br/><i>async · timeouts · cancellation</i>"]
COL["Result Collector<br/><i>diffs · artifacts · reports</i>"]
POL --> EXP --> JOB --> COL
end
SERVER --> API["Docker Engine API<br/><i>/var/run/docker.sock — SDK only, no docker CLI</i>"]
API --> SBX["Disposable sandbox<br/><i>no socket · no host filesystem · no network</i>"]
SBX --> OUT["Structured result<br/><i>back to Claude Code</i>"]
classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
classDef infra fill:#eaf1fb,stroke:#3a6ea8,color:#173352
classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
class CC,POL,EXP,JOB,COL,OUT actor
class API infra
class SBX safe
style SERVER fill:#fbfcfd,stroke:#9aa7b4,color:#22303fDocker is the isolation mechanism. MCP is the agent interface. Sandbox MCP is the experimentation layer.
There is deliberately no orchestrator here. The agent already is one: Claude Code plans, reads output, forms a hypothesis and retries better than any loop this server could ship. Putting a second, dumber loop underneath it would only compete with the caller. This project's job is the surface the agent drives — and making that surface one it cannot hurt you with.
The central abstraction: an experiment
Experiment: exp_2859b8eb8656
Project: payments-service
Base image: node:22-slim
Network: disabled
CPU: 2 cores
Memory: 1GB
Timeout: 300s
Status: READY
Commands: 1. npm install --no-audit --no-fund (exit 1, EBADENGINE)
2. npm install --no-audit --no-fund (exit 0)
3. npm test (37 passed, 3 failed)
4. npm test (40 passed, 0 failed)
Changes: 3 files modified, +9 -4Experiments move through an explicit, validated state machine. An illegal
transition is an error, not a silently corrupted record — which matters,
because DESTROYED is what tells the server a container no longer exists.
stateDiagram-v2
direction TB
[*] --> CREATING
CREATING --> READY: sandbox provisioned
READY --> RUNNING: command submitted
RUNNING --> READY: exit 0
state "terminal, but the sandbox is still alive" as OUTCOME {
direction LR
COMPLETED
FAILED
TIMEOUT
CANCELLED
}
CREATING --> FAILED: could not start
RUNNING --> OUTCOME
OUTCOME --> RUNNING: more work
OUTCOME --> DESTROYED: destroy_experiment
READY --> DESTROYED: destroy_experiment
DESTROYED --> [*]Security model
The Docker socket is a highly privileged interface — access to it is effectively root on the host. It is held by the server and by nothing else. The agent talks to the server; the server talks to Docker.
Filesystem
The project is copied, not mounted:
flowchart LR
HOST["HOST PROJECT<br/><i>read once, never written</i>"]
SNAP["SANDBOX COPY<br/><i>also the baseline every diff uses</i>"]
CON["DOCKER CONTAINER"]
HOST -- "snapshot: filtered, read-only pass" --> SNAP
SNAP -- "put_archive" --> CON
CON -. "no path back" .-x HOST
classDef host fill:#fdeceb,stroke:#d1453b,color:#7a1f18
classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
class HOST host
class SNAP,CON safeDefault strategy is
COPY_TO_SANDBOX.READ_ONLY_BIND_MOUNTexists for large repositories you only need to read. Writable host bind mounts are not implemented — there is no configuration that produces one..envfiles,*.pem,*.key,id_rsa*,.netrc,.ssh/,.aws/,.gnupg/,.kube/and similar are never copied, regardless of configuration. Build output (node_modules,dist,target, …) is skipped by default and that list is configurable.Project paths are resolved before they are checked, so a symlink cannot launder a denied location. The home directory and filesystem root are refused outright.
Paths inside the sandbox are confined to the workspace:
../../etc/passwdand/etc/shadoware rejected by every tool that takes a path.
One deliberate exception worth knowing: .npmrc is copied, because the
real behaviour of npm install often depends on it. If yours holds an
_authToken, add it to SANDBOX_MCP_SNAPSHOT_EXCLUDES.
Network
Disabled by default. network_mode is an explicit decision at creation time:
Mode | Behaviour |
| No interfaces at all. The default. |
| A private bridge network of its own — egress works, no reach to other sandboxes |
| The daemon's default bridge. Full egress. |
restricted prevents lateral movement between sandboxes. It does not firewall
egress; per-experiment network allowlists are listed under future extensions.
Environment variables
The host environment is never inherited. Variables cross the boundary only when
named: "CI" forwards the host's value, "NODE_ENV=test" injects a literal.
Credential-shaped names (*_TOKEN, *_SECRET, *API_KEY*, AWS_*,
DATABASE_URL, …) are refused even when explicitly allowlisted, because an
agent asking for AWS_SECRET_ACCESS_KEY inside a throwaway container is never
right. Set SANDBOX_MCP_STRICT_ENV_DENYLIST=false if you disagree.
Values are never written to the database or the logs — only names.
Container privileges
privileged=False, always. There is no setting that changes it.cap_drop: ALL, then a small set added back:CHOWN,DAC_OVERRIDE,FOWNER,FSETID,SETUID,SETGID,KILL. That is what package managers actually need (they chown caches and drop privileges for lifecycle scripts). It excludesNET_RAW,MKNOD,SYS_ADMIN,SYS_CHROOT,SETPCAPandSETFCAP— the ones that matter for escape.no-new-privileges:true.The Docker socket is never mounted into a sandbox. There is no code path that does it, and an integration test asserts its absence.
SANDBOX_MCP_SANDBOX_USERruns containers as a non-root user where the toolchain tolerates it.
Resource limits
Every sandbox is capped, and a request may only ask for less than the configured ceiling. Asking for more is clamped, and the clamp is returned to the agent as a warning rather than failing silently.
Limit | Default | Ceiling | Enforced by |
CPU | 2 cores | 4 cores |
|
Memory | 2GB | 8GB |
|
Processes | 512 | 2048 |
|
Wall clock | 120s | 1800s | the job manager, which kills the process |
| 512MB | — |
|
Captured output | 1MB/stream | — | truncated, and flagged as truncated |
Installation
Requires Python 3.12+ and a running Docker engine (Docker Desktop, OrbStack, Colima or Rancher Desktop).
git clone https://github.com/riyasaxena32/sandbox-mcp.git
cd sandbox-mcp
uv sync # exact versions from uv.lockConfirm the server can reach Docker before wiring it to anything:
uv run sandbox-mcp --check{
"docker_host": "unix:///var/run/docker.sock",
"state_dir": "/Users/you/.sandbox-mcp",
"defaults": { "base_image": "debian:bookworm-slim", "network_mode": "none", ... },
"docker": { "server_version": "29.4.0", "api_version": "1.54" },
"ok": true
}ok: false with DOCKER_UNAVAILABLE means the daemon is not running or the
socket is somewhere unusual. The server probes /var/run/docker.sock,
~/.docker/run/docker.sock, ~/.orbstack/run/docker.sock,
~/.colima/default/docker.sock and ~/.rd/docker.sock in that order — the
Docker CLI's context is not consulted, so set DOCKER_HOST explicitly if
yours is elsewhere.
Optional extras:
uv sync --extra dev # pytest, ruff, mypyConnecting Claude Code
Local (stdio) — recommended
claude mcp add sandbox -- uv --directory /absolute/path/to/sandbox-mcp run sandbox-mcpOr, if you installed it into an environment already on your PATH:
claude mcp add sandbox -- sandbox-mcpThen, inside Claude Code:
/mcp # should list "sandbox" as connectedEquivalent .mcp.json, if you prefer to commit the configuration:
{
"mcpServers": {
"sandbox": {
"command": "uv",
"args": ["--directory", "/absolute/path/to/sandbox-mcp", "run", "sandbox-mcp"],
"env": {
"SANDBOX_MCP_LOG_LEVEL": "INFO"
}
}
}
}Remote (Streamable HTTP)
uv run sandbox-mcp --transport http --host 127.0.0.1 --port 8000
claude mcp add --transport http sandbox http://127.0.0.1:8000/mcpOr run the server itself in a container:
docker compose up -d
claude mcp add --transport http sandbox http://127.0.0.1:8000/mcpThe compose file mounts the Docker socket into the server — read the warning at the top of it first, and do not expose port 8000 beyond localhost without authentication in front of it.
flowchart TD
CC["Claude Code"] --> SRV["Sandbox MCP<br/><i>holds the socket</i>"]
SRV --> ENG["Docker Desktop / OrbStack"]
ENG --> SBX["Sandbox<br/><i>no socket · no host filesystem · no network</i>"]
classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
classDef infra fill:#eaf1fb,stroke:#3a6ea8,color:#173352
classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
class CC,SRV actor
class ENG infra
class SBX safeTools
Tool | Purpose |
| Create a disposable environment and copy a project into it |
| Run a command inside the sandbox (sync or background) |
| Detect the test runner, run it, parse the results |
| Read a file from the sandbox to investigate a failure |
| Apply a candidate fix without shell-quoting hazards |
| What changed, against the pre-container baseline |
| Lift build output, reports or logs out before teardown |
| Full state and a summary of what happened |
| Find earlier experiments, including ones left running |
| Poll a background command |
| Fetch a completed background result |
| Stop a running command and kill its process |
| Tear down; idempotent; returns the final report |
| Rank several approaches and recommend one |
| Confirm Docker is reachable and show the active policy |
Notably absent: docker_run, docker_exec, docker_ps, docker_build,
docker_pull. A test asserts that no tool name begins with docker_.
Resources
sandbox://experiments all experiments
sandbox://experiments/{experiment_id} metadata + state history
sandbox://experiments/{experiment_id}/logs every command, with output
sandbox://experiments/{experiment_id}/diff unified diff
sandbox://experiments/{experiment_id}/artifacts collected filesThe primary demo: Node 20 → Node 22
examples/node-upgrade/ is a real, dependency-free Node library pinned to
Node 20. It fails on Node 22 for two independent and entirely realistic
reasons:
package.jsondeclaresengines.node: ">=18 <21"and.npmrcsetsengine-strict=true, sonpm installfails withEBADENGINEbefore a single test runs.src/crypto.jscallscrypto.createCipher, deprecated since Node 10 and removed in Node 22.0.0.
Ask Claude Code:
Determine whether
examples/node-upgradecan be upgraded from Node 20 to Node 22. You may install dependencies, modify files, run tests and experiment freely, but do not modify my actual working tree.
What happens — every figure below is from an actual run, and the whole thing works with the network disabled:
sequenceDiagram
autonumber
participant CC as Claude Code
participant S as Sandbox MCP
participant D as Disposable sandbox
CC->>S: create_experiment(node:22-slim, network none)
S->>D: snapshot 13 files, start container
S-->>CC: exp_2859b8eb8656 · READY
CC->>S: execute_experiment("npm install")
S-->>CC: exit 1 · EBADENGINE
CC->>S: read_sandbox_file("package.json")
S-->>CC: engines.node ">=18 <21"
CC->>S: write_sandbox_file("package.json", ">=18")
CC->>S: execute_experiment("npm install")
S-->>CC: exit 0
CC->>S: run_tests()
S-->>CC: 37 passed · 3 failed<br/>seal produces hex output<br/>seal and open round-trip<br/>seal round-trips unicode
CC->>S: read_sandbox_file("src/crypto.js")
S-->>CC: crypto.createCipher(...)
CC->>S: write_sandbox_file("src/crypto.js", createCipheriv + scrypt key + IV)
CC->>S: run_tests()
S-->>CC: 40 passed · 0 failed
CC->>S: inspect_changes()
S-->>CC: 3 modified · +9 -4
CC->>S: collect_artifacts(["src/crypto.js"])
S-->>CC: kept for the developer
CC->>S: destroy_experiment()
S->>D: remove container and snapshot
S-->>CC: report · host working tree UNCHANGEDExperiment: Node 20 → Node 22
Result: COMPATIBLE (with 2 source changes)
Tests: 40 passed, 0 failed
Changes: 3 files modified (+9 -4)
Host working tree: UNCHANGED
Sandbox: DESTROYEDThat last pair of lines is the product. This exact sequence runs as a test:
uv run pytest tests/integration/test_node_upgrade_demo.py -m integrationOther things this makes possible
Dependency upgrade — "try upgrading React to the latest compatible version; don't modify my working tree." Needs
network_mode="restricted"to reach the registry.Database migration — create an experiment on
postgres:16, run the migration, report whether it applied, destroy it.Build debugging — "work out why this build fails; experiment freely."
Multi-approach debugging —
examples/failing-project/is a Python project whose money arithmetic is done in floats; 3 of its 14 tests fail. Three fixes are plausible (round(),Decimal, truncation) and they are not equivalent. Run each in its own experiment, then callcompare_experiments, which ranks them on failures, exit code, change size and duration, and recommends one.
Why there is no orchestration layer
An earlier cut of this server shipped a LangGraph loop — plan, test, diagnose,
fix, retest — behind a run_autonomous_experiment tool. It was removed, on
purpose.
The caller is already an agent. Claude Code reads a failing test, forms a hypothesis, edits a file and retries; it does that better than a graph of hardcoded repair strategies ever will, because it has judgement and the strategies had a lookup table. Shipping a second, weaker loop underneath a strong one does not add a capability — it competes with the caller for the same decision, and it is the one more likely to be wrong.
What is left is the part the agent genuinely cannot do for itself: the isolation boundary, the policy that enforces it, the state machine, the baseline diff, and the audit trail. Those are the product.
Concretely, the loop lives in the transcript instead of inside the server:
flowchart LR
DEC["Decide the next step<br/><i>Claude Code — the loop lives here</i>"]
ACT["Call a tool"]
SRV["Sandbox MCP<br/><i>enforces · refuses · records</i>"]
OBS["Read the full output"]
DEC --> ACT --> SRV --> OBS --> DEC
classDef actor fill:#eef2f7,stroke:#5b6b7f,color:#22303f
classDef safe fill:#e7f4ea,stroke:#2f7d4f,color:#14432a
class DEC,ACT,OBS actor
class SRV safeThat is the primary demo, and it is what the integration suite runs.
Observability
Every operation emits a structured JSON event to stderr (stdout carries the MCP protocol under stdio transport):
{"event": "command_completed", "experiment_id": "exp_2859b8eb8656",
"job_id": "job_4f1c8a2b90de", "operation": "job.run", "status": "COMPLETED",
"exit_code": 0, "duration_ms": 1432, "timestamp": "2026-09-07T10:29:41Z"}Credential-shaped keys are scrubbed at the processor level, so no individual call site can leak by forgetting.
Everything needed to answer "what exactly did the agent do?" is persisted in
SQLite (~/.sandbox-mcp/sandbox.db): experiments, jobs with their commands,
exit codes and captured output, state transitions with timestamps and reasons,
artifacts with checksums, the pre-container baseline, and the change statistics
— which are written before teardown, so a destroyed experiment is still
comparable against a live one.
The database stores no secrets: environment variable names, never values.
Project layout
src/sandbox_mcp/
├── server.py MCP tools and resources — the agent-facing surface
├── app.py composition root; the only place the graph is wired
├── config.py every tunable, in one auditable place
├── models.py domain models (experiments, jobs, changes, reports)
├── errors.py structured errors; no traceback ever reaches a client
├── logging.py structured logging to stderr, with redaction
├── sandbox/
│ ├── interface.py SandboxBackend — the seam other runtimes target
│ └── docker.py Docker Engine API via the SDK; all hardening lives here
├── experiments/
│ ├── manager.py the domain core
│ ├── state.py the validated state machine
│ ├── repository.py ExperimentRepository + the SQLite implementation
│ ├── changes.py diffing the sandbox against its baseline
│ └── testing.py test-runner detection and output parsing
├── execution/
│ ├── manager.py job lifecycle: timeouts, cancellation, persistence
│ ├── jobs.py live task registry and concurrency limits
│ └── executor.py JobExecutor interface + the sandbox implementation
├── artifacts/manager.py pulling files out before teardown
└── security/
├── policy.py validates and clamps every request
├── filesystem.py path confinement and snapshotting
└── resources.py limit parsingSandboxBackend, ExperimentRepository and JobExecutor are abstract. Docker
implements the first; the MCP tool surface does not know it exists. Supporting
Firecracker, Kubernetes Jobs or remote workers means one new implementation and
no change to the agent-facing API — the in-memory FakeSandboxBackend the unit
tests run against is the proof that the seam is real.
Three deviations from a literal reading of the brief, all deliberate:
experiments/changes.py and experiments/testing.py exist as focused modules
rather than being folded into manager.py; commands/results are columns on
the jobs table rather than separate tables, since a job is a command and its
result; and there is no orchestration/ package, for the reason given above.
Development
uv sync --extra dev
uv run pytest -m "not integration" # 225 unit tests, no Docker needed
uv run pytest -m integration # 23 tests against a live daemon
uv run pytest # everything
uv run ruff check . && uv run ruff format --check .
uv run mypyThe unit suite runs against FakeSandboxBackend and needs no daemon. The
integration suite is the one that proves the product claim: the nine-step
isolation checklist, the host tree unchanged byte-for-byte, the network
genuinely off, secrets genuinely absent, the memory cap actually biting,
timeouts killing the process, cancellation killing the process, hardening flags
present on the real container, orphan containers swept at startup, and the full
Node 20 → 22 demo.
MVP boundaries
Not built, on purpose: a web dashboard, authentication, cloud infrastructure, Kubernetes support, distributed scheduling, billing, multi-tenant production infrastructure. This is a polished local-first MVP.
Known limits, stated plainly:
Killing a timed-out command signals the command's own process. Descendants it spawned may survive until the sandbox is destroyed;
pids_limitbounds the damage in the meantime.restrictednetworking isolates sandboxes from each other but does not filter egress.Change detection covers regular files. Symlinks are copied but not tracked in diffs.
Per-sandbox disk quotas need a storage driver that supports them (overlay2 on XFS with
pquota);/tmpis capped via tmpfs, the workspace is not.
Future extensions
Remote sandbox execution
Firecracker isolation
Kubernetes sandbox workers
Persistent base-image cache
Snapshot / restore
Parallel experiments
Experiment replay
Resource usage analytics
Network allowlists
Human approval before applying changes
Agent experiment benchmarking
Licence
MIT.
Available Tools
15 toolscancel_jobCancel JobA
Stop a running command and kill its process inside the sandbox.
USE THIS when a command is clearly stuck or no longer needed. Safe on a job that already finished -- it returns the final state untouched.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | Job id to cancel. |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | |
| job_id | Yes | |
| status | Yes | |
| stderr | No | |
| stdout | No | |
| command | Yes | |
| exit_code | No | |
| duration_ms | No | |
| experiment_id | Yes | |
| stderr_truncated | No | |
| stdout_truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses the destructive action (kill process) and adds safety: 'Safe on a job that already finished -- it returns the final state untouched.' This gives an idempotency guarantee. Could mention side effects on logs or output, but for a simple kill action this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words. The core purpose is front-loaded, and usage guidance is compact. Each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values are covered. The description covers purpose, usage, and safety for a simple one-parameter cancellation tool. Could specify synchronous/asynchronous behavior, but not essential. Completeness is good for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and job_id is described as 'Job id to cancel.' The description adds no additional semantics beyond the schema (e.g., format, where to find it). Since coverage is high, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Stop a running command and kill its process inside the sandbox.' This clearly differentiates from siblings like get_job_status or get_job_result, which are read-only. The purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use context: 'USE THIS when a command is clearly stuck or no longer needed.' Also notes safety on already-finished jobs, giving practical guidance. Does not name alternatives explicitly but the context is sufficient to select this tool over read-only siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_sandbox_runtimeCheck Sandbox RuntimeA
Confirm the sandbox runtime is available and report the active defaults.
USE THIS first if create_experiment fails, to tell a stopped Docker daemon apart from a rejected request. Returns the Docker version the server is talking to and the isolation defaults every experiment starts from.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It states it returns Docker version and isolation defaults, implying a read-only diagnostic operation, and does not contradict any annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with purpose, and includes usage guidance without any redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists (though not shown) and the tool has no parameters, the description provides sufficient context: when to use it and what it returns. It does not cover potential error scenarios, but they are likely minor for a diagnostic tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description adds no parameter details, but this is unnecessary. The baseline for no parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool confirms sandbox runtime availability and reports active defaults, with a specific verb and resource. It distinguishes itself from siblings by explicitly tying its use to diagnosing create_experiment failures.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance ('USE THIS first if create_experiment fails') and the diagnostic purpose, but does not mention when not to use it or name specific alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
collect_artifactsCollect ArtifactsA
Copy selected files out of a sandbox before it is destroyed.
USE THIS for build output, test reports, coverage, benchmark results or logs you want to keep or quote.
Patterns are workspace-relative shell globs ('dist/*.js'), or '/name' for a recursive search ('/junit.xml'). Files land in the server's own state directory; this tool cannot write anywhere on the developer's machine.
| Name | Required | Description | Default |
|---|---|---|---|
| patterns | Yes | Workspace-relative globs, e.g. ['dist/*.js']. | |
| experiment_id | Yes | The experiment to collect from. |
Output Schema
| Name | Required | Description |
|---|---|---|
| skipped | No | |
| artifacts | Yes | |
| total_bytes | No | |
| experiment_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing side effects. It clearly states that the tool copies files out of a sandbox (non-destructive on the source) and explicitly notes that it writes to the server's own state directory and cannot write to the developer's machine. It does not, however, describe the return value or any potential side effects like deleting the sandbox, so it is transparent but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise and well-structured. Three short sentences cover purpose, usage context, and pattern/limitation details without any redundancy or filler. Every sentence adds distinct value, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides sufficient context for an agent to invoke the tool correctly: what it does, when to use it, what parameters to pass (with format), and a key side-effect limitation. It does not describe the output format (though an output schema exists in the context), and it omits edge cases like no-matching-files behavior, so it is not fully complete but is adequate for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides 100% coverage with descriptions for both parameters, and the tool description supplements these with additional explanation of how patterns work ('Workspace-relative shell globs, e.g. ['dist/*.js'], or '**/name' for a recursive search'). This goes beyond the schema, offering practical clarification, so it earns a 4 rather than the baseline 3 for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Copy selected files out of a sandbox before it is destroyed') and specifies the resource (files) and scope (selected, via globs). It also provides a usage context ('USE THIS for build output, test reports, coverage, benchmark results or logs you want to keep or quote') that distinguishes its intent from pure file reading or writing. However, it does not explicitly name any sibling tool as an alternative, unlike the high-reference example, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool ('USE THIS for build output, test reports, coverage, benchmark results or logs you want to keep or quote'), which gives clear guidance. It also clarifies the pattern format and a key limitation ('this tool cannot write anywhere on the developer's machine'). However, it does not explicitly state when not to use it or name alternative tools, so it is not fully explicit on all usage boundaries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compare_experimentsCompare ExperimentsA
Compare two or more experiments side by side.
USE THIS when you tried several approaches -- three candidate fixes, two runtime versions, a couple of dependency upgrades -- and have to recommend one. Run each approach in its own experiment, then compare.
RETURNS per-experiment test results, failing test names, exit codes, change size, duration and artifact counts, plus a recommendation when the evidence supports one. Destroyed experiments are still comparable: their findings were recorded before teardown.
| Name | Required | Description | Default |
|---|---|---|---|
| labels | No | Optional experiment_id -> human label, e.g. {'exp_a': 'Node 22'}. | |
| experiment_ids | Yes | Two or more experiment ids. |
Output Schema
| Name | Required | Description |
|---|---|---|
| notes | No | |
| dimensions | No | Per-dimension map of experiment_id -> value. |
| experiments | Yes | |
| recommendation | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden — and it delivers. It discloses the exact return payload (test results, failing test names, exit codes, change size, duration, artifact counts, recommendation) and a non-obvious trait: destroyed experiments remain comparable because findings were recorded before teardown. This adds real value beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-organized with clear lead-in markers (USE THIS, RETURNS). The purpose is front-loaded, followed by usage guidance and return/behavioral notes. Every sentence earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the return-value summary is a bonus rather than a necessity. The destroyed-experiments note covers a likely edge case, and the minItems constraint is echoed. Slightly more on comparison criteria between experiments could push this to 5, but nothing needed to call the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters fully documented including the labels example. The description adds no new parameter-level detail beyond echoing the 'two or more' minItems constraint, so the baseline of 3 applies — the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Compare two or more experiments side by side') with a clear distinct scope from siblings. It is clearly a comparison/analysis tool, not a creation or execution one, so an agent can separate it from create_experiment, execute_experiment, and get_experiment without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use scenarios ('three candidate fixes, two runtime versions... recommend one') and instructs to run each approach in its own experiment first. It lacks an explicit when-not-to-use clause or named alternatives, but the use-case is unambiguous enough that the agent can route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_experimentCreate ExperimentA
Create a disposable, isolated environment and copy a project into it.
USE THIS when you are about to do something you should not do on the developer's machine: install dependencies, run a build or a migration, try an upgrade, run unfamiliar code, or explore a fix you are not sure about. Reach for it before the risky step, not after.
The project is SNAPSHOT-COPIED into the sandbox. Files you change inside never propagate back; the developer's working tree is untouched by construction. Secrets (.env files, keys, credential directories) are withheld from the copy, as are node_modules and other build output.
RETURNS an experiment_id plus the isolation actually applied -- read the warnings field, which tells you where your request was clamped.
SAFETY: network is disabled unless you ask for it; no host environment variable is passed unless you name it, and credential-shaped names are refused even then; CPU, memory, PIDs and wall-clock are capped.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | Default per-command wall-clock limit in seconds. | |
| cpu_limit | No | CPU cores. Clamped. | |
| objective | No | What you are trying to find out. Shows up in the report. | |
| base_image | No | Docker image to run in, e.g. 'node:22-slim', 'python:3.12-slim'. Choose the runtime the experiment is actually about. | |
| memory_limit | No | Memory, e.g. '2GB'. Clamped. | |
| network_mode | No | 'none' (default, no network at all), 'restricted' (egress on a private bridge, no reach to other sandboxes), or 'enabled'. Use 'restricted' when you must install packages. | |
| project_path | No | Absolute path to the project to copy in. Omit for an empty sandbox. Must not be a home or system directory. | |
| mount_strategy | No | 'COPY_TO_SANDBOX' (default, safest) or 'READ_ONLY_BIND_MOUNT' for a large repo you only need to read. Writable host mounts do not exist. | |
| setup_commands | No | Commands to run once the sandbox is ready, in order. Stops at the first failure and reports it. | |
| environment_allowlist | No | Environment variables to expose. 'NAME' forwards the host's value; 'NAME=value' injects a literal. Nothing else crosses the boundary. |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| warnings | No | |
| base_image | Yes | |
| setup_jobs | No | |
| files_copied | No | |
| network_mode | Yes | How much of the network the sandbox can see. ``NONE`` -- no interfaces at all. The default. ``RESTRICTED`` -- an isolated bridge network shared by nothing else; egress works, but the sandbox cannot reach other sandboxes or the host's service ports. ``ENABLED`` -- the daemon's default bridge. Full egress. |
| project_name | Yes | |
| experiment_id | Yes | |
| mount_strategy | Yes | How the project reaches the sandbox. ``COPY_TO_SANDBOX`` -- snapshot the tree, hand the copy to the container. The host tree is unreachable. ``READ_ONLY_BIND_MOUNT`` -- bind the real tree read-only. Faster on large repos; writes to it fail by construction. |
| workspace_path | Yes | |
| resource_limits | Yes | |
| environment_passed | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully carries the transparency burden. It explains snapshot copying, lack of propagation, secret handling, network defaults, resource caps, mount strategies, and failure behavior in detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear, front-loaded opening sentences and purposeful paragraph breaks. It is detailed but every sentence adds meaningful information about behavior, safety, or usage, with no filler or tautology.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description is remarkably complete. It covers the full lifecycle of creating an experiment, input parameter implications, safety mechanisms, return information, and failure behavior. The presence of an output schema means return values do not need to be exhaustively restated, but the description still usefully mentions experiment_id, warnings, and applied isolation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes every parameter with 100% coverage, so the baseline is 3. The description adds useful contextual semantics beyond the schema, such as recommending 'restricted' network for package installation, warning that writable host mounts do not exist, and noting that credential-shaped environment names are refused.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: create a disposable, isolated environment and copy a project into it. This distinguishes it from sibling tools like list_experiments, execute_experiment, and get_experiment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance on when to use this tool, such as 'USE THIS when you are about to do something you should not do on the developer's machine' and provides concrete examples like installing dependencies or running builds. It also clarifies safe defaults and opt-in behaviors.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
destroy_experimentDestroy ExperimentA
Destroy a sandbox and everything in it, returning a final report.
USE THIS as soon as an experiment has told you what you needed. Always call it -- a sandbox left running keeps consuming the developer's CPU and memory.
IDEMPOTENT: calling it on an already-destroyed experiment is safe and returns the stored report rather than an error.
RETURNS the final report, including what changed inside the sandbox, so you can summarise the experiment after it is gone.
| Name | Required | Description | Default |
|---|---|---|---|
| experiment_id | Yes | The experiment to destroy. |
Output Schema
| Name | Required | Description |
|---|---|---|
| report | No | |
| status | Yes | |
| experiment_id | Yes | |
| jobs_cancelled | No | |
| snapshot_removed | No | |
| already_destroyed | No | |
| container_removed | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the destructive nature ('destroy everything'), idempotency (safe on already-destroyed), and return behavior (final report). This adequately informs an agent of side effects and safety, though it does not mention reversibility or permissions, which are implied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the primary action, then a clear usage directive, idempotency note, and return info. Each sentence adds value with no fluff, and the capitalized section labels make it easily scannable for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return format details are covered. The description provides purpose, usage trigger, idempotency, and return contents, which is fully sufficient for an agent to decide when and how to call the tool correctly. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes the single parameter (experiment_id) at 100% coverage. The description adds no additional parameter-specific semantics beyond what the schema provides—only idempotency context that is behavioral, not parameter-related. Thus, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action (destroy), the resource (a sandbox/experiment), and the effect ('everything in it'). It distinguishes from siblings like cancel_job and get_experiment by emphasizing final cleanup and returning a report, making its unique purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs 'USE THIS as soon as an experiment has told you what you needed' and emphasizes 'Always call it' to free CPU/memory, giving a clear trigger condition. It does not mention specific alternatives or when not to use it, but the context is clear execution is for final cleanup.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_experimentExecute ExperimentA
Run a shell command inside a sandbox.
USE THIS for anything you would otherwise run in the developer's terminal: installs, builds, scripts, migrations, one-off exploration. The command runs in the container, never on the host.
RETURNS exit code, stdout, stderr and duration. A non-zero exit is a normal result, not an error -- read it and decide what to try next.
Set background=true for something long-running, then poll get_job_status and fetch get_job_result when it finishes. Otherwise this waits, bounded by the timeout, so it cannot hang your session.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Shell command. Runs via /bin/sh in the workspace. | |
| timeout | No | Seconds before the command is killed. Defaults to the experiment's. | |
| workdir | No | Working directory. Must be inside the workspace. | |
| background | No | Return a job id immediately instead of waiting. | |
| experiment_id | Yes | The experiment to run in. |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | |
| job_id | Yes | |
| status | Yes | |
| stderr | No | |
| stdout | No | |
| command | Yes | |
| exit_code | No | |
| duration_ms | No | |
| experiment_id | Yes | |
| stderr_truncated | No | |
| stdout_truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden of disclosing behavior. It clearly states that a non-zero exit code is normal (not an error), returns stdout/stderr/duration, and explains that background mode returns a job id. It does not explicitly mention potential filesystem side effects, but that is inherent to running a shell command in a sandbox; the description is otherwise transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: one sentence states the core function, followed by usage guidance, return semantics, and background handling. It avoids redundant details and every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's relative simplicity and the presence of an output schema (implied by the return description), the description provides sufficient context: it explains what happens on execution, how to handle background vs. foreground, and how to retrieve results using sibling tools. No critical information is missing for correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides descriptions for all five parameters (100% coverage), so the baseline is 3. The description adds value by clarifying the intent of background (for long-running tasks) and tying timeout to the sandbox's default, which goes beyond the schema's factual description. No parameter is left unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a shell command inside a sandbox, which is specific and distinct from sibling tools that manage experiments or files. It also explicitly mentions the return values (exit code, stdout, stderr, duration) and background execution, leaving no ambiguity about its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to use this for terminal-like tasks (installs, builds, scripts, migrations, exploration) and contrasts it with host execution. It also provides clear guidance on when to set background=true and how to poll via get_job_status/get_job_result, plus timeout behavior.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_experimentGet ExperimentA
Fetch an experiment's full state and a summary of what happened in it.
USE THIS to re-orient -- after a long gap, or to check whether a sandbox is still alive before sending more commands.
RETURNS status, base image, isolation settings, resource limits, how many commands ran and how many failed, the last test summary, change statistics and artifact count.
| Name | Required | Description | Default |
|---|---|---|---|
| experiment_id | Yes | The experiment to describe. |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| changes | No | |
| sandbox | No | |
| artifacts | No | |
| objective | Yes | |
| resources | Yes | |
| base_image | Yes | |
| duration_ms | No | |
| commands_run | Yes | |
| network_mode | Yes | How much of the network the sandbox can see. ``NONE`` -- no interfaces at all. The default. ``RESTRICTED`` -- an isolated bridge network shared by nothing else; egress works, but the sandbox cannot reach other sandboxes or the host's service ports. ``ENABLED`` -- the daemon's default bridge. Full egress. |
| project_name | Yes | |
| test_summary | No | |
| experiment_id | Yes | |
| failed_commands | Yes | |
| host_working_tree | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full disclosure burden and meets it by enumerating the returned contents: status, base image, isolation settings, resource limits, command counts, last test summary, change statistics and artifact count. This is unusually transparent for a read tool, effectively previewing the output schema, though it does not address error or edge-case behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is organized into three scannable sections — a one-line purpose statement, a 'USE THIS' directive, and a 'RETURNS' list — with the most decision-relevant guidance front-loaded. No sentence is wasted, though the RETURN enumeration is slightly verbose for a tool that already declares an output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter read tool, the description covers purpose, usage triggers, and return contents comprehensively, and an output schema is declared so return values are further specified structurally. Nothing an agent needs in order to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter experiment_id is 100% covered by the schema description ('The experiment to describe.'), so the schema already carries the meaning. The description adds nothing parameter-specific beyond the schema, holding it at the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Fetch') and resource ('an experiment's full state and a summary of what happened in it'), clearly scoping the tool's function. It is distinguishable from siblings like get_job_status and check_sandbox_runtime by the breadth of state described, though it does not explicitly name a sibling to differentiate against, so it misses full marks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes an explicit 'USE THIS to re-orient' directive with concrete trigger conditions: after a long gap, or to check sandbox liveness before sending more commands. This gives clear when-to-use context, though it stops short of naming alternatives or stating when NOT to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_job_resultGet Job ResultA
Fetch the completed result of a background command.
RETURNS the same shape as execute_experiment: exit code, stdout, stderr, duration. If the job is still running this waits for it, bounded by the job's own timeout.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | Job id to fetch. |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | |
| job_id | Yes | |
| status | Yes | |
| stderr | No | |
| stdout | No | |
| command | Yes | |
| exit_code | No | |
| duration_ms | No | |
| experiment_id | Yes | |
| stderr_truncated | No | |
| stdout_truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the important blocking wait behavior and timeout bound, plus the exact return shape. It doesn't cover failure/timeout outcomes, but the core behavioral trait is clearly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste. The primary purpose is front-loaded, and the return shape and blocking behavior are compactly conveyed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given one parameter, full schema coverage, and the presence of an output schema, the description covers the essential behavioral context: what it returns and when it returns. Nothing critical is missing for a straightforward fetch tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single parameter job_id is described as 'Job id to fetch.' The description adds no additional meaning beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Fetch') and resource ('completed result of a background command'). It also references execute_experiment's return shape, which precisely defines what 'result' means and distinguishes it from the sibling get_job_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: this fetches results and waits for completion, bounded by the job's timeout. It doesn't explicitly name alternatives or say when not to use it, but the waiting behavior implies get_job_status is for non-blocking status checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_job_statusGet Job StatusA
Check on a command started with background=true.
RETURNS status and elapsed milliseconds. Poll this, then call get_job_result once finished is true.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | Job id from execute_experiment. |
Output Schema
| Name | Required | Description |
|---|---|---|
| job_id | Yes | |
| status | Yes | |
| command | Yes | |
| finished | No | |
| exit_code | No | |
| elapsed_ms | Yes | |
| experiment_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It implies a non-mutating status check and mentions returned values, but it does not explicitly state side effects, idempotency, or authorization requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, with two short sentences that communicate purpose, output, and the follow-up action without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple polling status tool, the description is nearly complete: it defines what is returned, the completion condition, and the next step. It lacks an explicit output schema or status value enumeration, but these are not critical given the simple use case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single param job_id is described in the schema as 'Job id from execute_experiment,' which is clear. The tool description adds no further parameter detail, but schema coverage is complete for the only input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: checking on a background command started with background=true, and it explicitly distinguishes its output (status and elapsed milliseconds) from the later retrieval step (get_job_result).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives direct usage guidance: poll this tool until 'finished' is true, then call get_job_result. This explicitly names the companion tool and the correct sequencing, leaving little ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inspect_changesInspect ChangesA
Show what the experiment changed, against the project as it was copied in.
USE THIS before destroying a sandbox, and before telling the developer what you found. It is the evidence for your conclusion.
RETURNS created / modified / deleted file lists plus insertion and deletion counts, and optionally the unified diff. Build output and dependency directories are excluded, so a 30,000-file node_modules will not bury the two lines that matter.
| Name | Required | Description | Default |
|---|---|---|---|
| include_diff | No | Include unified diff bodies, not just statistics. | |
| experiment_id | Yes | The experiment to inspect. | |
| max_files_with_diff | No | Cap on files given line-level detail. |
Output Schema
| Name | Required | Description |
|---|---|---|
| note | No | |
| changes | No | |
| deletions | No | |
| truncated | No | |
| insertions | No | |
| experiment_id | Yes | |
| files_created | No | |
| files_deleted | No | |
| files_modified | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that build output and dependency directories are excluded, preventing noise. While it does not explicitly say the tool is read-only, the phrasing 'inspect' and 'before destroying a sandbox' strongly implies no side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections for purpose, usage, and return values. It is concise yet complete, using formatting like bold headings to highlight key points.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the output (file lists, counts, optional diff) and mentions exclusions, which is essential for an inspection tool. It lacks details on error handling, but the context and schema provide sufficient information for typical usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions for all three parameters are clear and adequate. The description only adds minimal context about the optional diff, which is already implied by the schema's 'include_diff' field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool shows what the experiment changed relative to the original project. It distinguishes itself from siblings by focusing on inspecting changes rather than listing, running, or destroying experiments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance is given to use this tool before destroying a sandbox and before reporting findings to the developer. It also states what the tool returns, helping the agent know when to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_experimentsList ExperimentsA
List experiments, most recent first.
USE THIS to find a sandbox you created earlier, or to check for ones you forgot to destroy before creating another.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum rows. | |
| status | No | Filter by status, e.g. 'READY', 'FAILED', 'DESTROYED'. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden. It reveals ordering and implies that destroyed experiments are still listed, but it does not explicitly state that this is a read-only operation or describe default filter behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two crisp sentences with no filler. The core action and ordering are front-loaded, and the use-case guidance earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete schema coverage, no required parameters, and an output schema make this nearly complete. The description adds practical selection context, though it could explicitly note that listing is side-effect-free.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description adds no parameter-specific meaning beyond the schema. Since the schema fully documents limit and status, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('experiments'), with an ordering guarantee ('most recent first'). It clearly differentiates from singular get_experiment by plural scope, but does not explicitly name sibling alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides concrete use cases: finding a previously created sandbox and checking for undeleted sandboxes before creating another. This gives clear context for when to use the tool, though it does not mention exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_sandbox_fileRead Sandbox FileA
Read a file from inside the sandbox as text.
USE THIS to investigate a failure -- read the source, the config, a log -- without guessing from stack traces. Paths are workspace-relative and cannot escape it; this tool cannot read the developer's machine.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Workspace-relative path, e.g. 'src/index.js'. | |
| experiment_id | Yes | The experiment to read from. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that paths are workspace-relative and cannot escape the sandbox, and that it reads as text. However, it does not mention behavior for missing files, binary files, or permission errors. It provides some behavioral context but not exhaustive detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, then the usage context, then the key constraint. Every sentence earns its place; there is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with an output schema present, the description covers the essential context: what it reads, when to use it, and a critical limitation. It doesn't explain error handling, but that's minor given the tool's simplicity and the existence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already described. The description adds the note that paths are workspace-relative, which reinforces the path parameter's meaning, but it does not add new semantics beyond what the schema provides. Baseline 3 applies given high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads a file from inside the sandbox as text, using a specific verb and resource. It distinguishes itself from sibling tools like write_sandbox_file by focusing on reading, and explicitly notes the sandbox confinement, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit use case: 'USE THIS to investigate a failure -- read the source, the config, a log'. It does not explicitly mention when not to use it or name alternatives, but the guidance is clear enough for an agent to select it for file inspection. It also clarifies it cannot read the developer's machine, which sets expectations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_testsRun TestsA
Run the project's test suite inside a sandbox and parse the results.
USE THIS instead of execute_experiment when you want to know whether the project still works -- it detects the runner (npm, pytest, cargo, go, make) by looking at what is actually in the sandbox, and parses counts out of the output.
RETURNS exit code, stdout/stderr, duration and, when parseable, a summary with passed/failed/total and the names of failing tests. If test_summary.detected is false, trust the exit code, not the zeros.
Pass command to override detection.
| Name | Required | Description | Default |
|---|---|---|---|
| command | No | Explicit test command. Omit to auto-detect. | |
| timeout | No | Seconds before the run is killed. | |
| experiment_id | Yes | The experiment to test in. |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | |
| job_id | Yes | |
| status | Yes | |
| stderr | No | |
| stdout | No | |
| command | Yes | |
| exit_code | No | |
| framework | No | |
| duration_ms | No | |
| test_summary | No | |
| experiment_id | Yes | |
| stderr_truncated | No | |
| stdout_truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though no annotations are provided, the description is highly transparent about what the tool does: it detects the runner by inspecting the sandbox, runs the suite, parses test counts, and returns exit code, stdout/stderr, duration, and a summary. It also adds a important caveat about trusting the exit code when test_summary.detected is false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections: the core action, usage guidance, return values, and parameter override note. It is concise yet information-dense, with no redundant or vague phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for a tool of this scope: it explains what runs, how detection works, what the output contains, and how to interpret edge cases. It also fits well alongside sibling tools like execute_experiment, making the tool's niche clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters are described in the schema, and the description adds useful semantic context beyond the schema. It explains the command parameter's role ('Pass command to override detection'), clarifies timeout as 'Seconds before the run is killed', and identifies experiment_id as the test target.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Run the project's test suite') and the context ('inside a sandbox'), with the explicit goal of parsing results. It also distinguishes this tool from execute_experiment by specifying that it is for checking whether the project still works.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance on when to use this tool ('USE THIS instead of execute_experiment when you want to know whether the project still works') and explains the auto-detection behavior. It also tells the user how to override detection with the command parameter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_sandbox_fileWrite Sandbox FileA
Write a file inside the sandbox, creating parent directories as needed.
USE THIS to apply a candidate fix. Prefer it over shell heredocs: no quoting to get wrong.
SAFETY: writes land in the sandbox copy only. There is no tool here that writes to the developer's project -- if a change is worth keeping, show them the diff from inspect_changes and let them apply it.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Workspace-relative path. | |
| content | Yes | Full new contents of the file. | |
| experiment_id | Yes | The experiment to write in. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the behavioral burden. It discloses that writes only land in the sandbox copy, that parent directories are created automatically, and that no tool writes to the developer's project. It could also mention overwriting behavior or error conditions, but the most critical safety and side-effect information is covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short paragraphs, each with a distinct purpose: core action, usage guidance, and safety note. The primary action is front-loaded, and every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a write tool with three required parameters and an existing output schema, the description covers the key use case, the safety boundary, and the recommended workflow. It tells the agent exactly when to use it and how to handle changes that should persist, leaving no critical gaps for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so each parameter is already documented. The description adds no parameter-specific semantics beyond what the schema provides, except implicitly through the behavior of creating parent directories. Per guidelines, a high-coverage schema warrants a baseline score of 3, and the description does not go beyond that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the exact action (write a file inside the sandbox), the resource (sandbox), and the key behavior (creating parent directories). It also contrasts with the absence of any tool that writes to the developer's project, distinguishing it from the sibling set where no other write tool exists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs when to use this tool ('USE THIS to apply a candidate fix') and when not to ('if a change is worth keeping, show them the diff from inspect_changes and let them apply it'). Also recommends it over shell heredocs, providing concrete selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
15 tool updates
v0.1.0- First observed
cancel_job - First observed
check_sandbox_runtime - First observed
collect_artifacts - First observed
compare_experiments - First observed
create_experiment - First observed
destroy_experiment - First observed
execute_experiment - First observed
get_experiment - First observed
get_job_result - First observed
get_job_status - First observed
inspect_changes - First observed
list_experiments - First observed
read_sandbox_file - First observed
run_tests - First observed
write_sandbox_file
TDQS
Most tools have distinct purposes, but get_job_status and get_job_result could be confused from names alone, and execute_experiment vs run_tests require careful reading. Descriptions do clarify the boundaries.
All names follow verb_noun with underscores, but the set mixes 'job' for command execution and 'experiment' for sandbox lifecycle, creating slight inconsistency. Overall pattern is still predictable.
15 tools is on the higher end but each covers a distinct sandbox operation: lifecycle, execution, file access, change tracking, artifacts, and comparison. No obvious redundancy, though a few could be consolidated.
The tool surface covers the full experiment workflow: create, execute, test, read/write files, inspect changes, collect artifacts, compare, and destroy. It deliberately omits host modification, which fits the sandbox safety model.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Production-readiness for your AI coding agents.
- mcp-serverOAuthai.cdbx
Build Apps and run code in 30 languages — sandboxed, with persistent sessions for agent loops.
Build, validate, and deploy multi-agent AI solutions from any AI environment.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceA secure Docker-based environment that allows AI assistants to safely execute code without direct access to the host system by running all code within isolated containers.4-
- FlicenseNot gradedqualityCmaintenanceProvides AI coding agents with a secure, sandboxed environment for executing coding tasks including file operations, command execution, and testing. Features session management, policy enforcement, and Docker-based sandboxing for safe code execution and development workflows.-
- AlicenseNot gradedqualityBmaintenanceA throwaway Docker sandbox for agents to run code and shell commands safely.24MIT
- FlicenseNot gradedqualityCmaintenanceEnables AI agents to safely execute Python, JavaScript, and Bash code in an isolated Docker sandbox with strict security constraints.1-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/riyasaxena32/sandbox-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server