Cinch MCP server
io.github.yusufkadry/cinch·v0.1.1Run AI-generated code safely. gVisor-isolated Python/JS sandboxes for any MCP client. Pay per run.
0 stars22 downloads/wk
Reviews
Write oneNobody has reviewed Cinch yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Cinch tools (1, 1 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
execute_codewrite actionExecute Python or JavaScript in a secure, isolated, disposable sandbox and return its output.
Public scan report
scanner v0.1.9 · 2026-09-25 · same rubric, same numbers if you re-run it
- Code scan3 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 64 days ago12/15
- Maintainer identityregistry namespace matches repository owner6/10
How Cinch compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 75/100
- higher than 45% of 48,255 servers
- Tools
- 1
- the typical server has 7
- Tools that change things
- 100%
- typical: 0%. Fewer write tools means less an agent can break
- Downloads a week
- 22
- more than 8% of 12,191 servers with a package
What its tools let an agent do: 1 run or deploy
Install Cinch in Claude Code, Cursor or VS Code
Runs npx -y @cinch-codes/mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add cinch -- npx -y @cinch-codes/mcp
What the publisher says
From the Cinch repository's README, as published. We do not edit it. Read it on GitHub
@cinch-codes/mcp
MCP server for Cinch. Gives your AI assistant a real sandbox to run code in.
Without it, an assistant writes code and you run it yourself. With it, the assistant runs the code and reads the actual output — inside a gVisor-isolated container on Cinch's infrastructure, with no access to your machine, filesystem, or local network.
Pay per execution. No subscription floor.
Setup
Get an API key at cinch.codes, then add the server to your MCP client.
Claude Desktop — claudedesktopconfig.json:
{
"mcpServers": {
"cinch": {
"command": "npx",
"args": ["-y", "@cinch-codes/mcp"],
"env": {
"CINCH_API_KEY": "cinch_live_..."
}
}
}
}Claude Desktop on Windows — same file, but Windows can't spawn npx directly, so wrap it with cmd /c:
{
"mcpServers": {
"cinch": {
"command": "cmd",
"args": ["/c", "npx", "-y", "@cinch-codes/mcp"],
"env": {
"CINCH_API_KEY": "cinch_live_..."
}
}
}
}Claude Code (macOS/Linux):
claude mcp add --scope user cinch -e CINCH_API_KEY=cinch_live_... -- npx -y @cinch-codes/mcpClaude Code (Windows):
claude mcp add --scope user cinch -e CINCH_API_KEY=cinch_live_... -- cmd /c npx -y @cinch-codes/mcpCursor — .cursor/mcp.json, same shape as the Claude Desktop config above.
Restart the client. That's it — no install step, npx fetches it on first run.
What it exposes
execute_code
Runs a self-contained Python or JavaScript program and returns stdout, stderr, exit code, and duration.
Each call gets a clean sandbox. State does not persist between calls, so every snippet needs to stand on its own.
The sandbox environment
Deliberately minimal. Worth knowing before you wonder why an import failed:
The tool description tells the model all of this up front, so it writes stdlib-only code instead of reaching for numpy and failing on the first call.
Configuration
Troubleshooting
Windows: "Failed to connect" in claude mcp list — you're missing the cmd /c wrapper. Windows resolves npx to a batch script that can't be spawned directly; re-add the server using the Windows command above.
Windows: npm error ENOENT ... AppData\Roaming\npm — some Node installs never create npm's global folder, and npx refuses to run without it. Create it once and retry:
mkdir %APPDATA%\npmServer exits immediately with "CINCHAPIKEY is not set" — the env var didn't reach the server. In Claude Code, put -e CINCHAPIKEY=... before the server name in claude mcp add. In config files, check the env block is inside the cinch entry.
Debugging any connection failure — run the server directly to see the real error instead of a generic status:
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Cinch: common questions
- Is Cinch MCP server safe?
- Mostly: it is graded B (75/100). Read the Cinch safety report
- How do I install Cinch?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Cinch need an API key?
- Yes. The registry entry asks for
CINCH_API_KEY. - Is Cinch maintained?
- The last commit was 104 days ago (2026-07-23). The latest release is v0.1.1.
- How does Cinch compare with other MCP servers?
- safety score 75/100 (higher than 45% of 48,255 servers); tools 1 (the typical server has 7); tools that change things 100% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.