LLM Sandbox MCP Server

Name: LLM Sandbox MCP Server
Author: io.github.vndee

io.github.vndee/llm-sandbox

Repository Registry

What is the LLM Sandbox MCP server?

Securely run LLM-generated code in isolated containers across 7 languages and 3 container backends.

How to install LLM Sandbox

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

Environment / auth

BACKEND
Container backend to use. Must match the installed extra: mcp-docker, mcp-podman, or mcp-k8s.
DOCKER_HOST
Docker or Podman socket URL, e.g. unix:///var/run/docker.sock
KUBECONFIG
Path to kubeconfig file when BACKEND=kubernetes.
NAMESPACE
Kubernetes namespace used for sandbox pods when BACKEND=kubernetes.
COMMIT_CONTAINER
Commit the container after a run so installed libraries persist between sessions.
KEEP_TEMPLATE
Keep the base image after the session ends to avoid re-pulling it on the next run.
SANDBOX_NETWORK_MODE
Network mode for the sandbox container. Set to 'none' for hardened isolation. Docker and Podman backends only.
SANDBOX_READ_ONLY
Mount the sandbox root filesystem read-only. Recommended: true. Docker and Podman backends only.
SANDBOX_CAP_DROP
Comma-separated Linux capabilities to drop. Recommended: ALL. Docker and Podman backends only.
SANDBOX_SECURITY_OPT
Comma-separated container security options, e.g. no-new-privileges. Docker and Podman backends only.
SANDBOX_MEMORY
Memory limit for the sandbox container, e.g. 4g. Docker and Podman backends only.
SANDBOX_CPUS
Fractional CPU allocation for the sandbox container, e.g. 1.5. Docker and Podman backends only.

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "llm-sandbox": {
      "command": "uvx",
      "args": [
        "llm-sandbox",
        "--from",
        "llm-sandbox[mcp-docker]"
      ],
      "env": {
        "BACKEND": "<YOUR_BACKEND>",
        "DOCKER_HOST": "<YOUR_DOCKER_HOST>",
        "KUBECONFIG": "<YOUR_KUBECONFIG>",
        "NAMESPACE": "<YOUR_NAMESPACE>",
        "COMMIT_CONTAINER": "<YOUR_COMMIT_CONTAINER>",
        "KEEP_TEMPLATE": "<YOUR_KEEP_TEMPLATE>",
        "SANDBOX_NETWORK_MODE": "<YOUR_SANDBOX_NETWORK_MODE>",
        "SANDBOX_READ_ONLY": "<YOUR_SANDBOX_READ_ONLY>",
        "SANDBOX_CAP_DROP": "<YOUR_SANDBOX_CAP_DROP>",
        "SANDBOX_SECURITY_OPT": "<YOUR_SANDBOX_SECURITY_OPT>",
        "SANDBOX_MEMORY": "<YOUR_SANDBOX_MEMORY>",
        "SANDBOX_CPUS": "<YOUR_SANDBOX_CPUS>"
      }
    }
  }
}

Cursor

~/.cursor/mcp.json

{
  "mcpServers": {
    "llm-sandbox": {
      "command": "uvx",
      "args": [
        "llm-sandbox",
        "--from",
        "llm-sandbox[mcp-docker]"
      ],
      "env": {
        "BACKEND": "<YOUR_BACKEND>",
        "DOCKER_HOST": "<YOUR_DOCKER_HOST>",
        "KUBECONFIG": "<YOUR_KUBECONFIG>",
        "NAMESPACE": "<YOUR_NAMESPACE>",
        "COMMIT_CONTAINER": "<YOUR_COMMIT_CONTAINER>",
        "KEEP_TEMPLATE": "<YOUR_KEEP_TEMPLATE>",
        "SANDBOX_NETWORK_MODE": "<YOUR_SANDBOX_NETWORK_MODE>",
        "SANDBOX_READ_ONLY": "<YOUR_SANDBOX_READ_ONLY>",
        "SANDBOX_CAP_DROP": "<YOUR_SANDBOX_CAP_DROP>",
        "SANDBOX_SECURITY_OPT": "<YOUR_SANDBOX_SECURITY_OPT>",
        "SANDBOX_MEMORY": "<YOUR_SANDBOX_MEMORY>",
        "SANDBOX_CPUS": "<YOUR_SANDBOX_CPUS>"
      }
    }
  }
}

Windsurf

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "llm-sandbox": {
      "command": "uvx",
      "args": [
        "llm-sandbox",
        "--from",
        "llm-sandbox[mcp-docker]"
      ],
      "env": {
        "BACKEND": "<YOUR_BACKEND>",
        "DOCKER_HOST": "<YOUR_DOCKER_HOST>",
        "KUBECONFIG": "<YOUR_KUBECONFIG>",
        "NAMESPACE": "<YOUR_NAMESPACE>",
        "COMMIT_CONTAINER": "<YOUR_COMMIT_CONTAINER>",
        "KEEP_TEMPLATE": "<YOUR_KEEP_TEMPLATE>",
        "SANDBOX_NETWORK_MODE": "<YOUR_SANDBOX_NETWORK_MODE>",
        "SANDBOX_READ_ONLY": "<YOUR_SANDBOX_READ_ONLY>",
        "SANDBOX_CAP_DROP": "<YOUR_SANDBOX_CAP_DROP>",
        "SANDBOX_SECURITY_OPT": "<YOUR_SANDBOX_SECURITY_OPT>",
        "SANDBOX_MEMORY": "<YOUR_SANDBOX_MEMORY>",
        "SANDBOX_CPUS": "<YOUR_SANDBOX_CPUS>"
      }
    }
  }
}

VS Code

.vscode/mcp.json

{
  "servers": {
    "llm-sandbox": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "llm-sandbox",
        "--from",
        "llm-sandbox[mcp-docker]"
      ],
      "env": {
        "BACKEND": "<YOUR_BACKEND>",
        "DOCKER_HOST": "<YOUR_DOCKER_HOST>",
        "KUBECONFIG": "<YOUR_KUBECONFIG>",
        "NAMESPACE": "<YOUR_NAMESPACE>",
        "COMMIT_CONTAINER": "<YOUR_COMMIT_CONTAINER>",
        "KEEP_TEMPLATE": "<YOUR_KEEP_TEMPLATE>",
        "SANDBOX_NETWORK_MODE": "<YOUR_SANDBOX_NETWORK_MODE>",
        "SANDBOX_READ_ONLY": "<YOUR_SANDBOX_READ_ONLY>",
        "SANDBOX_CAP_DROP": "<YOUR_SANDBOX_CAP_DROP>",
        "SANDBOX_SECURITY_OPT": "<YOUR_SANDBOX_SECURITY_OPT>",
        "SANDBOX_MEMORY": "<YOUR_SANDBOX_MEMORY>",
        "SANDBOX_CPUS": "<YOUR_SANDBOX_CPUS>"
      }
    }
  }
}

Claude Code

claude mcp add llm-sandbox --env BACKEND=<YOUR_BACKEND> --env DOCKER_HOST=<YOUR_DOCKER_HOST> --env KUBECONFIG=<YOUR_KUBECONFIG> --env NAMESPACE=<YOUR_NAMESPACE> --env COMMIT_CONTAINER=<YOUR_COMMIT_CONTAINER> --env KEEP_TEMPLATE=<YOUR_KEEP_TEMPLATE> --env SANDBOX_NETWORK_MODE=<YOUR_SANDBOX_NETWORK_MODE> --env SANDBOX_READ_ONLY=<YOUR_SANDBOX_READ_ONLY> --env SANDBOX_CAP_DROP=<YOUR_SANDBOX_CAP_DROP> --env SANDBOX_SECURITY_OPT=<YOUR_SANDBOX_SECURITY_OPT> --env SANDBOX_MEMORY=<YOUR_SANDBOX_MEMORY> --env SANDBOX_CPUS=<YOUR_SANDBOX_CPUS> -- uvx llm-sandbox --from llm-sandbox[mcp-docker]