Exec Sandbox MCP server

mcp-exec

English | Русский

Public OSS MCP server (Go, MIT) exposing a single powerful tool — exec — that runs caller-supplied Python code in a network-isolated, locked-down sandbox and returns stdout / stderr / exit_code. It is the "code-execution mode" building block: instead of flooding an agent's context with hundreds of tool schemas, the agent writes code that orchestrates the work.

Works over three transports — stdio / HTTP / SSE — with an identical tool set everywhere (official modelcontextprotocol/go-sdk).

The exec tool

Input: { code: string (required), timeouts?: int, stdin?: string } Output: { stdout, stderr, exitcode, durationms, truncated, timedout }

input (empty code, oversized stdin) is a tool-call error.

• A non-zero exitcode or timedout=true is a normal result, not a tool error. Only invalid

• Sandbox v1: Python 3 with stdlib + PyYAML, Jinja2, Pillow, numpy, pandas, matplotlib.

Security model (invariants)

Per execution: no network, non-root, cap-drop=ALL, no-new-privileges, read-only rootfs, no CAPSYSADMIN, ephemeral tmpdir (cleaned up), wall-clock timeout (kills the whole process-group), memory/PID/CPU limits, capped output (1 MiB → truncated). Runs are serialized within an instance; scale out with replicas. Caller data (code/stdin/output) is never persisted and never logged in full — only metadata.

exec is the most powerful surface there is. When embedding it in an agent, gate it behind that

agent's tool-policy (trusted roles only).

Network note: --network none only applies to stdio. In HTTP/SSE the container needs networking to serve its port, so sandboxed code would inherit egress — deny it at the orchestrator. In k8s, a NetworkPolicy that allows ingress to the port and denies all egress:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: mcp-exec-lockdown }
spec:
  podSelector: { matchLabels: { app: mcp-exec } }
  policyTypes: [Ingress, Egress]
  ingress: [{ ports: [{ port: 8080 }] }]
  egress: []   # deny all egress → sandbox has no network

Run

go build -o mcp-exec ./cmd/mcp-exec
MCP_EXEC_TRANSPORT=stdio ./mcp-exec

Docker (recommended production posture):

Shortened. The full README is on GitHub.