runtimeBLOCK
Sandboxes for AI agents: TypeScript, Python, Go, Java and Ruby SDKs, the runtime CLI, an MCP server, and agent integrations. Firecracker microVMs.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The SDKs, CLI, MCP server and agent integrations for Runtime: sandboxes for AI agents. Each sandbox is a Firecracker microVM with its own Linux kernel, started from one call.
npm install withruntime # TypeScript SDK, the `runtime` CLI and the MCP server pip install withruntime # Python SDK, sync and async
import { Sandbox } from "withruntime";
await using sbx = await Sandbox.create();
const result = await sbx.exec("python3 -c 'print(6 * 7)'");
console.log(result.exitCode, result.stdout);from withruntime import Sandbox
with Sandbox.create() as sbx:
result = sbx.exec("python3 -c 'print(6 * 7)'")
print(result.exit_code, result.stdout)The client reads RUNTIME_API_KEY, or the connection npx withruntime login saved on this machine. A new account starts on a free trial with no card. The quickstart takes it from there.
What is here
743a1817ec28OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add withruntime -- npx -y [email protected] mcp
Exposed tools (5)
3 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
runtime_connect | read | Connect Runtime on this machine with a browser approval. The first call returns a link and a code: show them to the person you work for and ask them to approve. Call again after they have; it waits up to 45 seconds for the approval, then Runtime |
runtime_exec | write | Run a shell command (bash) in the sandbox and return its exit code, stdout and stderr. |
runtime_list_files | read | List a directory in the sandbox: each entry |
runtime_read_file | read | Read a text file from the sandbox. |
runtime_write_file | write | Create or replace a text file in the sandbox, making parent directories. |
Trust audit
BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (11 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (9 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(command: string, options?: ExecOptions) {exec(
exec(
exec(command: string, options?: ExecOptions) {it to ~/.ssh/config
const path = join(dir, "id_ed25519");
: `Added Include "${file}" to ~/.ssh/config. Connect with: ssh <sandbox id or name>.runtime`,integrations/codex/skills
console.log(`note: a WebSocket with the token in its query: ${queryOutcome}`);print(token.token, token);
const first = new SandboxClient(world.native, { TOKEN: "private-session-secret" });apiKey: "fixture-process-write",
const runtime = new Runtime({ apiKey: "rk_product_alias_test" });apiKey: "rk_product_alias_test",
apiKey: "rk_create_request_fixture",
pages = importlib.import_module(prefix + '.core.client.pagination')
model = importlib.import_module(prefix + '.core.client.models.pagination_meta').PaginationMeta
module = importlib.import_module(f"withruntime.e2b.{path}"){ session_id: id, chars: "exec(open('invoice.py').read())\n", yield_time_ms: 1500 },accept = base64.b64encode(hashlib.sha1(
process.env.RUNTIME_ORACLE_RUNTIME_ROOT ?? fileURLToPath(new URL("../../../", import.meta.url)),import { type Runtime } from "../../src/index";import { ConflictError, InvalidRequestError, RuntimeError } from "../../src/errors";import { toBlaxelPath, toRuntimePath } from "../../src/blaxel/context";import type { ResponseError } from "../../src/blaxel/index";Gates applied: no_behavioural_pass.
743a1817ec28full audit observations/trust-audit/mcp-server/withruntime__runtime.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 743a1817ec28 | BLOCK | F | 44 | first audit |
Questions
What is the runtime MCP server?
Sandboxes for AI agents: TypeScript, Python, Go, Java and Ruby SDKs, the runtime CLI, an MCP server, and agent integrations. Firecracker microVMs.
What tools does runtime expose?
5 in total: 3 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is runtime safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (44/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does runtime need?
It reads BL_API_KEY, DAYTONA_API_KEY, E2B_API_KEY, RUNTIME_API_KEY, RUNTIME_AUTH_URL, RUNTIME_ID_TOKEN_REQUEST_TOKEN, RUNTIME_ID_TOKEN_REQUEST_URL, RUNTIME_WEBHOOK_SECRET and TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does runtime run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @runtime/typescript-config at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (743a1817ec28), read on 2026-10-11. The repository is watched and re-audited when it changes.