Windows Sandbox MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| sandbox_doctorA | Report host prerequisites; does not start Sandbox. |
| sandbox_startC | Create owned Sandbox. Networking opt-in also exposes guest to the host/LAN. |
| sandbox_statusA | Return session state and retained artifact metadata. |
| sandbox_stopA | Terminate owned Sandbox even after bridge failure; retain evidence on host. |
| sandbox_restartB | Destroy current guest and create fresh session. Guest disk is not recovered. |
| sandbox_execB | Run guest PowerShell; bounded stdout/stderr, exit code and timeout status. Children die on completion. |
| sandbox_uploadA | Upload at most 4 MiB to guest C:\work. Input is bytes, never a host path. |
| sandbox_downloadB | Copy a guest C:\work file to a host-owned opaque artifact, at most 4 MiB. |
| sandbox_screenshotA | Capture guest virtual desktop as PNG artifact; retrieve image with sandbox_artifact. |
| sandbox_artifactB | Return PNG as native MCP image or file as base64, with SHA-256 integrity metadata. |
| sandbox_windowsA | Discover visible guest windows and stable-for-current-state hwnd values. |
| sandbox_inspectC | Inspect via auto/uia3/uia2/ia2/win32 in a killable guest worker. Views: control/raw/content. |
| sandbox_launchC | Launch guest GUI with quoted arguments. Accessibility adds Chromium flag; CDP port opt-in is guest loopback. |
| sandbox_browserC | Opt-in guest CDP: snapshot DOM targets, click or fill a fresh reference. Requires launch with cdp_port. |
| sandbox_clickB | Click guest physical desktop coordinates from fresh inspection; verify state afterward. |
| sandbox_textB | Type Unicode via guest SendInput, at most 16384 UTF-16 characters; no host clipboard. |
| sandbox_keysC | Send guest shortcut such as CTRL+A, CTRL+S, ALT+F4, ENTER or TAB; verify afterward. |
| sandbox_collect_evidenceB | Save screenshot, window list, UI inspection, hashes and host-only observation record. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 18 tools
Most tools have clearly distinct roles, but some pairs (sandbox_screenshot vs sandbox_artifact, sandbox_windows vs sandbox_inspect, sandbox_collect_evidence vs individual capture tools) require careful reading of descriptions to avoid confusion.
All tools use a consistent sandbox_ prefix and snake_case, but suffixes mix verbs and nouns (e.g., sandbox_windows, sandbox_artifact) rather than following a strict verb_noun pattern throughout.
18 tools is slightly above the typical 3-15 range, but the set covers lifecycle, execution, file transfer, GUI automation, and evidence collection without obvious redundancy.
The surface covers core sandbox lifecycle, command execution, file upload/download, screenshot capture, UI inspection, GUI interaction, and evidence collection. Minor gaps like direct guest file management, clipboard access, or snapshot/restore can be worked around via sandbox_exec.