Atlas / MCP servers / johanli233 / Python Sandbox

Python SandboxSAFE

Name: Python Sandbox
Author: johanli233

mcp/johanli233/python-sandbox

MCP server by johanli233 · llm · mcp · mcp server · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Python sandboxes for llms

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

1 1r · 0w · 0d

Transport

—

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Feel free to try on mcp sandbox

[](https://www.python.org/downloads/release/python-3120/) [](https://opensource.org/licenses/Apache-2.0) [](https://github.com/astral-sh/uv) [](https://github.com/estitesc/mission-control-link)

中文文档 | English

Demo

Python MCP Sandbox is an interactive Python code execution tool that allows users and LLMs to safely execute Python code and install packages in isolated Docker containers.

Viby

Viby works with mcp sandbox

Features

🐳 Docker Isolation: Securely run Python code in isolated Docker containers
📦 Package Management: Easily install and manage Python packages with support for custom PyPI mirrors
📊 File Generation: Support for generating files and accessing them via web links
🔐 Authentication: Optional API key-based authentication for multi-user environments
🎨 Web UI: Built-in web interface for managing sandboxes and viewing execution results
🌐 SSE Support: Real-time communication via Server-Sent Events for MCP integration

Installation

# Clone the repository
git clone https://github.com/JohanLi233/python-mcp-sandbox.git
cd python-mcp-sandbox

# Install dependencies using uv
uv venv
uv sync

# Start the server
uv run main.py

The default SSE endpoint is http://127.0.0.1:8181/sse, and you can interact with it via the MCP Inspector through SSE or any other client that supports SSE connections.

Configuration

The server

Read from source at commit 0dcfff2bde7dOBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add ui -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "ui": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (1)

1 read · 0 write · 0 destructive.

Tool	Risk	Description
`list_sandboxes`	read	# Get user ID

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (2 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (8)

LOWInventory / provenance · inv.hidden_file · CWE-1104

.docker_build_info

.docker_build_info

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose