BoxliteSAFE
Powered by BoxLite - embeddable sandbox with hardware-level isolation and no daemon. The SQLite of sandbox, coming soon as open source.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
MCP server providing isolated sandbox environments for AI agents.
The Problem
Today's AI apps don't just generate text – they write and run code, call tools, read your files, and hit the network. Running all of this directly on your machine creates real risks:
- Security - Malicious or buggy code can damage your system
- Privacy - Sensitive files and credentials are exposed
- Reliability - Runaway processes can consume resources or crash your machine
BoxLite solves this by giving AI agents their own isolated VM – full freedom inside, complete safety outside.
Powered by BoxLite
BoxLite is an embeddable virtual machine runtime that follows the SQLite philosophy - simple, lightweight, and zero-configuration.
Why BoxLite?
- Hardware-level isolation - True VM security, not just containers. Your AI agent runs in a completely isolated environment.
- No daemon required - Unlike Docker, BoxLite doesn't need a background service. Just import and use.
- Embeddable - Designed to be embedded directly into your applications, like SQLite for compute.
- Fast startup - VMs boot in seconds, not minutes.
- Cross-platform - Works on macOS and Linux.
Use Cases
- AI Agent Sandboxing - Let AI agents execute code, browse the web, and use applications safely
- Secure Code Execution - Run untrusted code without risk to your host system
- Browser Automation - Headless browser with CDP for web scraping and testing
- Development Environments - Disposable, reproducible dev environments
Demo
https://github.com/user-attachments/assets/0685d428-64e4-4a68-adfe-c24dc0dc5ae8
Available Tools
f7d4e215a1cbOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add boxlite-mcp -- uvx boxlite-mcp
{
"mcpServers": {
"boxlite-mcp": {
"command": "uvx",
"args": [
"boxlite-mcp"
]
}
}
}Exposed tools (5)
5 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
box | read | |
browser | read | |
code_interpreter | read | |
computer | read | |
sandbox | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
f7d4e215a1cbfull audit observations/trust-audit/mcp-server/boxlite-labs__boxlite.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | f7d4e215a1cb | SAFE | B | 89 | first audit |
Questions
What is the Boxlite MCP server?
Powered by BoxLite - embeddable sandbox with hardware-level isolation and no daemon. The SQLite of sandbox, coming soon as open source.
What tools does Boxlite expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Boxlite safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Boxlite need?
No credential environment variables were found in its source, so it appears to need none.
How does Boxlite run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as boxlite-mcp.
How current is this page?
The grade is for one exact copy of the source (f7d4e215a1cb), read on 2026-10-08. The repository is watched and re-audited when it changes.