Blaxel TypeScript SDKSAFE
Typescript SDK for Blaxel
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Blaxel is a perpetual sandbox platform that achieves near instant latency by keeping infinite secure sandboxes on automatic standby, while co-hosting your agent logic to cut network overhead.
This repository contains Blaxel's TypeScript SDK, which lets you create and manage sandboxes and other resources on Blaxel.
Installation
# npm npm install @blaxel/core # yarn yarn add @blaxel/core # bun bun add @blaxel/core
Authentication
The SDK authenticates with your Blaxel workspace using these sources (in priority order):
- Blaxel CLI, when logged in
- Environment variables in
.envfile (BL_WORKSPACE,BL_API_KEY) - System environment variables
- Blaxel configuration file (
~/.blaxel/config.yaml)
When developing locally, the recommended method is to just log in to your workspace with the Blaxel CLI:
bl login YOUR-WORKSPACE
This allows you to run Blaxel SDK functions that will automatically connect to your workspace without additional setup. When you deploy on Blaxel, this connection persists automatically.
When running Blaxel SDK from a remote server that is not Blaxel-hosted, we recommend using environment variables as described in the third option above.
API error types
@blaxel/core exports BlaxelErrorCode (gateway, auth and sandbox-creation code unions), BlaxelErrorCodeValue (also unknown string codes and numeric HTTP codes), and body types: BlaxelApiErrorBody, BlaxelActionErrorBody, BlaxelPlatformErrorBody, BlaxelSandboxApiErrorBody.
Errors are not wrapped or changed. The SDK still throws raw control-plane bodies, existing sandbox error classes, plain Error, or text/HTML bodies. isBlaxelError is true only for the shapes the SDK throws for API errors (BlaxelErrorLike): ResponseError (including SandboxGatewayError), SandboxCreationTimeoutError, and raw control-plane error bodies that carry a code and status. It is false for plain Errors
3e52f7efbc96OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add test-webpack --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env BL_API_KEY=${BL_API_KEY} --env BL_CLIENT_CREDENTIALS=${BL_CLIENT_CREDENTIALS} --env CALLBACK_SECRET=${CALLBACK_SECRET} -- npx -y [email protected]{
"mcpServers": {
"test-webpack": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"BL_API_KEY": "${BL_API_KEY}",
"BL_CLIENT_CREDENTIALS": "${BL_CLIENT_CREDENTIALS}",
"CALLBACK_SECRET": "${CALLBACK_SECRET}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
weather | read | Get the weather in a specific city |
Trust audit
SAFEgrade C · trust 78/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
.claude
archive.zip
CLAUDE.md
`create + exec (ls /) + exec (echo) - ${imageName}`,const r = await exec(sbx, `command -v curl >/dev/null || { command -v apk >/dev/null && apk add --no-cache curl || { apt-get update -qq && apt-get install -y -qq curl; }; } >/dev/null 2>&1; command -vconst gen = await exec(src, `
const put = await exec(src, `
const copy = await exec(src, curlRetryScript(
.createHash("sha1")import { Sandbox } from "../../client/types.gen.js";import { Sandbox } from "../../client/types.gen.js";import { retryOnTransientReset } from "../../common/transient-retry.js";import { settings } from "../../common/settings.js";import { Sandbox } from "../../client/types.gen.js";network: { proxy: { bypass: ["*.s3.amazonaws.com", "169.254.169.254"] } },expect(sandbox.spec.network?.proxy?.bypass).toEqual(["*.s3.amazonaws.com", "169.254.169.254"])
bypass: ["169.254.169.254"],
expect(proxy.bypass).toContain("169.254.169.254")client.setConfig({ baseUrl: `http://127.0.0.1:${address.port}`, fetch });return new SandboxProcess({ metadata: { name: "local" }, spec: {}, forceUrl: `http://127.0.0.1:${address.port}`, headers: {} } as Sandbox);const proxy = client(`http://127.0.0.1:${address.port}`);baseUrl = `http://127.0.0.1:${address.port}`url: `https://127.0.0.1:${addr.port}`,rejectUnauthorized: false,
rejectUnauthorized: false,
Gates applied: no_behavioural_pass.
3e52f7efbc96full audit observations/trust-audit/mcp-server/blaxel-ai__sdk-typescript.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 3e52f7efbc96 | SAFE | C | 78 | first audit |
Questions
What is the @blaxel/core MCP server?
Typescript SDK for Blaxel
What tools does @blaxel/core expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @blaxel/core safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it C (78/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does @blaxel/core need?
It reads ANTHROPIC_API_KEY, BL_API_KEY, BL_CLIENT_CREDENTIALS, CALLBACK_SECRET, GCSFUSE_SA_KEY_JSON, GOOGLE_API_KEY, KEY, MORPH_API_KEY, RELACE_API_KEY, SANDBOX_AUTHENTICATION, TEST_BL_API_KEY and TEST_BL_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @blaxel/core run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as test-webpack at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (3e52f7efbc96), read on 2026-10-12. The repository is watched and re-audited when it changes.