Code SandboxSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The Code Sandbox MCP Server is a lightweight, STDIO-based Model Context Protocol (MCP) Server, allowing AI assistants and LLM applications to safely execute code snippets using containerized environments. It is uses the llm-sandbox package to execute the code snippets.
How It Works:
- Starts a container session (podman, docker, etc.) and ensures the session is open.
- Writes the
codeto a temporary file on the host. - Copies this temporary file into the container at the configured
workdir. - Executes the language-specific commands to run the code, e.g. python
python3 -u code.pyor javascriptnode -u code.js - Captures the output and error streams from the container.
- Returns the output and error streams to the client.
- Stops and removes the container.
Available Tools:
- run_python_code - Executes a snippet of Python code in a secure, isolated sandbox.
code(string, required): The Python code to execute.- run_js_code - Executes a snippet of JavaScript (Node.js) code in a secure, isolated sandbox.
code(string, required): The JavaScript code to execute.
Installation
pip install git+https://github.com/philschmid/code-sandbox-mcp.git
Getting Started: Usage with an MCP Client
Examples:
- Local Client Python example for running python code
- Gemini SDK example for running python code with the Gemini SDK
- Calling Gemini from a client example for running python code that uses the Gemini SDK and passes through the Gemini API key
- Local Client Javascript example for running javascript code
To use the Code Sandbox MCP server, you need to add it to your MCP client's configuration file (e.g., in your AI assistant's settings). The server is
486f2e104019OBSERVED · 2026-10-06Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add code-sandbox-mcp --env GEMINI_API_KEY=${GEMINI_API_KEY} --env PASSTHROUGH_ENV=${PASSTHROUGH_ENV} -- uvx code-sandbox-mcp{
"mcpServers": {
"code-sandbox-mcp": {
"command": "uvx",
"args": [
"code-sandbox-mcp"
],
"env": {
"GEMINI_API_KEY": "${GEMINI_API_KEY}",
"PASSTHROUGH_ENV": "${PASSTHROUGH_ENV}"
}
}
}
}Exposed tools (2)
0 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
run_javascript_code | write | Execute JavaScript code in the sandbox environment and captures the standard output and error. |
run_python_code | write | Execute Python code in the sandbox environment and captures the standard output and error. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
486f2e104019full audit observations/trust-audit/mcp-server/philschmid__code-sandbox-3.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | 486f2e104019 | SAFE | B | 89 | first audit |
Questions
What tools does Code Sandbox expose?
2 in total: 0 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Code Sandbox safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Code Sandbox need?
It reads GEMINI_API_KEY and PASSTHROUGH_ENV from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Code Sandbox run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as code-sandbox-mcp.
How current is this page?
The grade is for one exact copy of the source (486f2e104019), read on 2026-10-06. The repository is watched and re-audited when it changes.