vmware-sandbox-mcp

Overview Schema Source Related Servers Discussions Admin

sandbox_create

Creates an isolated, disposable Linux sandbox and waits until it is ready, so you can safely run untrusted code or install packages without affecting the host.

Instructions

Create a fresh, disposable Linux computer (a "sandbox") and wait until it is ready to use.

Use this before running untrusted code, installing packages, or trying anything you would not want to do on the user's real computer. Every sandbox starts from the same clean state and is completely separate from the user's machine and from other sandboxes.

network: "none" (default) gives the sandbox no network at all. Choose another mode only when the task needs to download something:

"web": internet for web downloads only (HTTP and HTTPS), and nothing else: the user's own computer and home network stay unreachable. Prefer this. Standard tools (curl, wget, pip, git over https) work as usual; with sudo use sudo -E, for example sudo -E apt-get -y install <package>. ping and non-web protocols do not work. It may not be set up on this computer; the error will say so.
"nat": full internet access. It can also reach the user's own computer and home network, so never use it for code you do not trust.

Takes up to a few minutes. Returns the sandbox_id to pass to the other sandbox tools. Destroy the sandbox with sandbox_destroy when you are finished.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "sandbox_create"
  }
}

Input Schema

Name	Required	Description	Default
`network`	No		none

Output Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 14, 2026

TDQS

A4.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses isolation properties ('completely separate from the user's machine and from other sandboxes'), freshness ('every sandbox starts from the same clean state'), latency ('takes up to a few minutes'), a failure mode ('It may not be set up on this computer; the error will say so'), and the returned handle. It stops short of disclosing lifetime/idle timeouts, quotas on concurrent sandboxes, or resource limits, which matter for a long-lived disposable VM.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action, then usage rationale, then a bulleted breakdown of the one parameter, then return value and cleanup. Every sentence carries information an agent needs; the length is justified by the 0% schema coverage and absent annotations, and no line is redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no annotations, the definition covers the full lifecycle: what it creates, how long it takes, what it returns (sandbox_id, despite an output schema existing), how to clean up, and the failure mode. Nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% – the enum values 'none', 'web', 'nat' have no schema descriptions – so the description must compensate, and it does thoroughly: per-mode semantics, default, reachability implications (including that "nat" can reach the user's home network), and even the workaround detail (`sudo -E apt-get -y install <package>`) plus what does not work (ping, non-web protocols).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource ('Create a fresh, disposable Linux computer (a "sandbox")') plus the readiness semantics ('wait until it is ready'). The reader can immediately distinguish this from sandbox_destroy, sandbox_start, and sandbox_stop in the sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use it ('before running untrusted code, installing packages, or trying anything you would not want to do on the user's real computer') and routes to the correct network mode with a clear preference rule ('Prefer this' for "web") and an explicit prohibition ('never use it for code you do not trust' for "nat"). It also names the follow-up tool, sandbox_destroy, for cleanup.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server