Claudebox MCP server

claudebox

A runtime harness for Claude Code — the agentic coding CLI from Anthropic — running in a fully isolated Docker container with every dev tool pre-installed, passwordless sudo, docker-in-docker support, and --permission-mode bypassPermissions enabled by default.

v2.0.0 — rebased on psyb0t/aicodebox. claudebox is now a thin child image of the shared aicodebox base (same pattern as psyb0t/pibox). Every mode surface (API / Telegram / Cron / MCP) is inherited from the base and stays in lockstep with future base fixes. See CHANGELOG.md for the full migration guide (endpoint shape changes, env-var namespace, path renames — all mitigated by aliases + symlinks so existing configs keep working).

Runtime hardening (recommended docker run flags):

The container drops from root to aicode (UID 1000) at boot via setpriv in the base entrypoint, so the process running your code is never root even without --user.

• --cap-drop=ALL --cap-add=NETBINDSERVICE — drop every Linux capability, add back only bind-below-1024 if you actually need it.
• --security-opt no-new-privileges:true — block setuid privilege escalation inside the container.
• --memory=2g --cpus=2 --pids-limit=512 — cap runtime resource use so a runaway process can't starve the host.
• --read-only --tmpfs /tmp:rw,noexec,nosuid (only if you don't use /workspace for writes — otherwise skip).

claudebox wraps Claude Code with several distinct interfaces:

• Interactive CLI — a drop-in replacement for the native claude command, with persistent containers and automatic session resumption across runs
• Programmatic CLI — non-interactive mode for scripts, CI/CD pipelines, and automation; pass a prompt, get structured output, pipe it wherever you need
• HTTP API server — a full REST API with workspace management, file operations, structured output formats, and workspace isolation for multi-tenant deployments
• OpenAI-compatible endpoint — a chat/completions adapter that lets LiteLLM, OpenAI SDKs, and any OpenAI-compatible client talk to Claude Code, complete with streaming SSE, multi-turn conversations, and multimodal image handling
• MCP server — a Model Context Protocol endpoint over streamable HTTP so other AI agents and tools (Claude Desktop, other Claude Code instances, etc.) can use Claude Code as a tool
• Telegram bot — a conversational interface with per-chat workspaces, configurable models and effort levels, file sharing, shell access, and group chat support
• Cron scheduler — yaml-defined Claude jobs running on cron schedules with per-job activity history, sub-minute resolution, and overlap protection

Beyond just running Claude Code in Docker, claudebox adds skill injection (auto-load SKILL.md files into every session), init hooks, custom script directories, structured JSON logging, and a workspace management layer that handles multi-tenant isolation with automatic busy/idle tracking.

Shortened. The full README is on GitHub.