Create a new sandbox (isolated Ubuntu mini-computer with shell, Chrome + CDP, VNC, xfce4). IMPORTANT: Before creating, check if the user has saved snapshots by looking at the available_snapshots field in the response. If snapshots exist, ask the user whether they want to resume from a snapshot or start fresh. Set use_snapshot: true to resume. Backend is auto-detected: Firecracker microVM if KVM available, Docker otherwise. Returns the sandbox id used by all other tools, plus a noVNC URL the human can open to watch what the AI is doing. IMPORTANT: Always present vnc_url exactly as returned — never modify the URL path, filename, or query parameters.

List active sandboxes created in this MCP session.

Destroy a sandbox and free its ports. By default the VM filesystem is saved as a snapshot so recreating with the same label resumes where you left off. Set save_snapshot to false to destroy without saving (e.g. when the VM contains sensitive data the user does not want persisted). Use vm_reset to also delete any previously saved snapshot.

Reset a VM to a clean state. Destroys the current VM AND deletes its saved snapshot, so the next vm_create with the same label starts fresh from the base image.

Restart a sandbox. Stops and starts the container — all files, databases, and installed packages are preserved. Only processes are restarted.

Get resource usage (CPU, memory, disk, uptime, top processes) and port mappings for a sandbox. Use to diagnose OOM, high CPU, or check available disk space.

Rename a running VM by changing its label. The label is used for snapshot naming — renaming does NOT migrate existing snapshots (they stay under the old label).

List all saved snapshots. Each snapshot can be resumed by calling vm_create with the same label and use_snapshot=true.

Delete a saved snapshot by label. This frees disk space and means the next vm_create with this label will start fresh.

Run a shell command inside the sandbox. Returns combined stdout+stderr. Use for any CLI work: git, npm, pip, apt, curl, etc.

Write content to a file inside the sandbox (creates parent dirs as needed).

Read a file inside the sandbox.

Replace a string in a file. Fails if old_string is not found. Set replace_all=true to replace every occurrence.

List files in a directory (ls -la, or recursive find with depth 3).

grep -rn for a pattern in a directory.

Search codebase content using ripgrep. Much faster and smarter than fs_search — supports regex, file type filters, context lines, and higher result limits.

Take a JPEG screenshot of the sandbox desktop (xfce4) and return as image content.

Click at (x,y) on the sandbox desktop. button=1 left, 2 middle, 3 right.

Type text into the focused window via xdotool.

Press a key combo via xdotool, e.g. "Return", "ctrl+l", "alt+Tab".

Scroll at (x,y).

Drag from (from_x, from_y) to (to_x, to_y) on the sandbox desktop.

Open Chrome inside the sandbox (or navigate the existing tab) at the given URL, then return a JPEG screenshot.

Kill all Chrome processes inside the sandbox.

Navigate the sandbox Chrome to a URL via CDP (Playwright). Returns final URL and page title.

Inject numbered overlays on every visible interactive element (Set-of-Mark prompting), screenshot the page, return both the screenshot and element refs. Use browser_click_ref / browser_type_ref to interact.

Click an element by its ref number from the most recent browser_snapshot.

Focus an element by ref and type text into it. Set submit=true to press Enter after.

Read text content from the page. With selector: returns innerText of matching elements. Without: full page text.

Run a JavaScript expression in the page context and return the result.

Wait until a condition holds (selector visible, text appears, or network idle).

Return captured browser console logs (errors, warnings, info) from the current page.

Return captured network request failures (404s, CORS errors, etc.).

Run a Playwright test script against the browser inside a VM. Has page, browser, context, and chromium available.

Search Google and return up to 8 organic results as {title, url, snippet}.

Upload a file into a VM. Pass content as base64 string (max 50MB).