MCP.Market

Cinch MCP server

by yusufkadry·io.github.yusufkadry/cinch·v0.1.1

Run AI-generated code safely. gVisor-isolated Python/JS sandboxes for any MCP client. Pay per run.

B75/100grade B
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
New

0 stars22 downloads/wk

Reviews

Write one

Nobody has reviewed Cinch yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Cinch tools (1, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • execute_codewrite action

    Execute Python or JavaScript in a secure, isolated, disposable sandbox and return its output.

Public scan report

scanner v0.1.9 · 2026-09-25 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 64 days ago12/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Cinch compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
75/100
higher than 45% of 48,255 servers
Tools
1
the typical server has 7
Tools that change things
100%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
22
more than 8% of 12,191 servers with a package

What its tools let an agent do: 1 run or deploy

Install Cinch in Claude Code, Cursor or VS Code

Runs npx -y @cinch-codes/mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add cinch -- npx -y @cinch-codes/mcp
Add to Cursor

What the publisher says

From the Cinch repository's README, as published. We do not edit it. Read it on GitHub

@cinch-codes/mcp

MCP server for Cinch. Gives your AI assistant a real sandbox to run code in.

Without it, an assistant writes code and you run it yourself. With it, the assistant runs the code and reads the actual output — inside a gVisor-isolated container on Cinch's infrastructure, with no access to your machine, filesystem, or local network.

Pay per execution. No subscription floor.

Setup

Get an API key at cinch.codes, then add the server to your MCP client.

Claude Desktop — claudedesktopconfig.json:

{
  "mcpServers": {
    "cinch": {
      "command": "npx",
      "args": ["-y", "@cinch-codes/mcp"],
      "env": {
        "CINCH_API_KEY": "cinch_live_..."
      }
    }
  }
}

Claude Desktop on Windows — same file, but Windows can't spawn npx directly, so wrap it with cmd /c:

{
  "mcpServers": {
    "cinch": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "@cinch-codes/mcp"],
      "env": {
        "CINCH_API_KEY": "cinch_live_..."
      }
    }
  }
}

Claude Code (macOS/Linux):

claude mcp add --scope user cinch -e CINCH_API_KEY=cinch_live_... -- npx -y @cinch-codes/mcp

Claude Code (Windows):

claude mcp add --scope user cinch -e CINCH_API_KEY=cinch_live_... -- cmd /c npx -y @cinch-codes/mcp

Cursor — .cursor/mcp.json, same shape as the Claude Desktop config above.

Restart the client. That's it — no install step, npx fetches it on first run.

What it exposes

execute_code

Runs a self-contained Python or JavaScript program and returns stdout, stderr, exit code, and duration.

Each call gets a clean sandbox. State does not persist between calls, so every snippet needs to stand on its own.

The sandbox environment

Deliberately minimal. Worth knowing before you wonder why an import failed:

The tool description tells the model all of this up front, so it writes stdlib-only code instead of reaching for numpy and failing on the first call.

Configuration

Troubleshooting

Windows: "Failed to connect" in claude mcp list — you're missing the cmd /c wrapper. Windows resolves npx to a batch script that can't be spawned directly; re-add the server using the Windows command above.

Windows: npm error ENOENT ... AppData\Roaming\npm — some Node installs never create npm's global folder, and npx refuses to run without it. Create it once and retry:

mkdir %APPDATA%\npm

Server exits immediately with "CINCHAPIKEY is not set" — the env var didn't reach the server. In Claude Code, put -e CINCHAPIKEY=... before the server name in claude mcp add. In config files, check the env block is inside the cinch entry.

Debugging any connection failure — run the server directly to see the real error instead of a generic status:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Cinch: common questions

Is Cinch MCP server safe?
Mostly: it is graded B (75/100). Read the Cinch safety report
How do I install Cinch?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Cinch need an API key?
Yes. The registry entry asks for CINCH_API_KEY.
Is Cinch maintained?
The last commit was 104 days ago (2026-07-23). The latest release is v0.1.1.
How does Cinch compare with other MCP servers?
safety score 75/100 (higher than 45% of 48,255 servers); tools 1 (the typical server has 7); tools that change things 100% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.