Sandbox as a Service MCP server

sandbox-as-a-service-mcp

An MCP server that gives an agent a real Linux virtual machine it can break.

Eleven tools: create a sandbox, run shell commands in it, write and read files, list what a run produced, expose a port on a public preview URL, extend the lifetime, destroy it, and check what it all cost.

Each sandbox is a dedicated VM with its own kernel — not a container sharing a host with other people's code. It is never reused between accounts and is destroyed when it expires, whether or not anything remembered to ask.

Use it

Maintained by the operator of Sandbox as a Service.

Hosted MCP (no local package)

For a client that supports Streamable HTTP, connect to:

https://sandbox-as-a-service.com/v1/mcp

Send your own API key on each request as Authorization: Bearer or x-api-key: . Get it at Dashboard → API keys. Never put an API key in the URL or share one through a registry.

The hosted server exposes 12 tools: the eleven account/execution tools below plus getserviceinfo. Anonymous initialize, tools/list, and getserviceinfo work for free hosted discovery; account and execution calls still require your key. The local stdio server (including the current downloadable mcp.tgz v1.1.0) exposes the eleven account/execution tools. Use the hosted endpoint for keyless service information. A GET-only check is not a connection test: this endpoint uses MCP POST requests and SSE responses.

On Smithery, set apiKey to your own raw key; it maps to the x-api-key header. Connection documentation.

Local stdio (current hosted package)

AAS_API_KEY=aas_sk_... npx -y https://sandbox-as-a-service.com/mcp.tgz

Get a key at sandbox-as-a-service.com — new accounts start with free credit and no card.

Claude Desktop / Claude Code

{
  "mcpServers": {
    "sandbox": {
      "command": "npx",
      "args": ["-y", "https://sandbox-as-a-service.com/mcp.tgz"],
      "env": { "AAS_API_KEY": "aas_sk_..." }
    }
  }
}

The tools

Notes for agents

pip install --user --break-system-packages or npm install, both of which do.

• Code runs as an unprivileged user. There is no sudo, so apt-get will not work; use

open until the timeout.

• run_command waits for the command to finish. Start a server with & or it will hold the call

forgotten sandbox costs minutes, not money forever. Calling it anyway returns the minutes you were not going to use.

• A sandbox is destroyed when its timeout expires whether or not destroy_sandbox is called, so a

Environment

Shortened. The full README is on GitHub.