instabox-mcp

Run a command in a machine

instabox_exec

Destructive

Execute shell commands or argv programs inside a running cloud Linux machine and return stdout, stderr, and exit code after completion. Use for remote command execution with a 600-second limit.

Instructions

Run a command inside a RUNNING machine and return stdout, stderr and the exit code once it exits (a non-zero exit is still a normal result). Output is collected, not streamed, and each stream is cut at 1 MiB. Give cmd (a shell string, run with bash -lc) OR argv (program + arguments, no shell, no expansion). Runs as the machine's user in /data/home by default. Max 600 s per call: for long jobs start them in the background (e.g. nohup … > /data/home/job.log 2>&1 &) and poll the log. Not idempotent: a retry runs the command again. A machine paused for idleness is woken first; a machine you stopped returns 409 machine_not_running. This executes arbitrary code with root-capable access in the machine.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>"
    },
    "name": "instabox_exec"
  }
}

Input Schema

Name	Required	Description
`id`	Yes	Machine ID (m_...) or its unique name
`cmd`	No	Shell command (bash -lc). Set this or argv
`cwd`	No	Working directory (default /data/home)
`argv`	No	Program and arguments, run without a shell. Set this or cmd
`envs`	No	Environment variables to set. Names match [A-Za-z_][A-Za-z0-9_]*
`stdin`	No	Text fed to the command, then EOF (max 1 MiB)
`timeoutSeconds`	No	Kill after this long (exit code 124). Default 60, max 600

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Nov 1, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond annotations: output is buffered not streamed, each stream truncates at 1 MiB, non-zero exit is a normal result, runs as the machine's user in /data/home, 600 s hard cap, idle-paused machines are woken first, and stopped machines return 409. The non-idempotency and root-capable risk are restated consistently with destructiveHint/idempotentHint rather than contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what the tool does and what it returns, then layers constraints in descending priority. Dense but every clause carries an operational fact; nothing is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still specifies the return shape (stdout, stderr, exit code), the truncation limit, the exit-code-124 timeout convention, and environment defaults. For a 7-parameter destructive exec tool this is complete enough to call correctly on the first attempt.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents every parameter including the cmd/argv exclusivity and cwd default. The description reinforces the OR relationship and the /data/home default but adds no format, size, or syntax detail not already present in the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Run a command inside a RUNNING machine') plus what it returns (stdout, stderr, exit code). The RUNNING qualifier and the 'arbitrary code with root-capable access' note separate it cleanly from siblings like instabox_write_file or instabox_list_files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use direction: cmd vs argv alternatives, backgrounding with nohup + polling for jobs over 600 s, and the 409 machine_not_running outcome for stopped machines. It stops short of naming sibling tools to route to for non-execution tasks, which keeps it at a 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.