CodeRunner MCP Server by InstaVM: Setup for Claude, Gemini CLI and Other Apps

• Runs Python code in the sandbox

  Runs the Python you give it in a persistent Jupyter kernel inside the sandbox and returns the result, streaming progress as it runs. Pass a session ID to keep state separate from other agents.

  Try: “Load the CSV I uploaded and plot the monthly totals.”

  Runs code · execute_python_code

• Opens a named, separate Python session

  Reserves an isolated kernel under a session name, so one agent's variables do not mix with another's. Up to five named sessions can run at once.

  Try: “Start a Python session called analysis.”

  Runs code · start_python_session

• Lists open Python sessions

  Returns the named sessions that are currently active.

  Try: “Which Python sessions are open?”

  Read · list_python_sessions

• Closes a Python session

  Stops a session and throws away its kernel state.

  Try: “Stop the analysis session.”

  Runs code · stop_python_session

• Reads the text of a web page

  Opens the page in a Playwright browser inside the sandbox and returns all the text visible on it.

  Try: “Get the visible text from https://example.com/pricing.”

  Network · navigate_and_get_all_visible_text

• Lists the skills in the sandbox

  Lists the built-in skills, such as working with Word, Excel, PowerPoint, PDF and image files.

  Try: “What skills does the sandbox have?”

  Read · list_skills

• Shows how a skill works

  Returns the documentation for one skill.

  Try: “Show me how the PDF skill works.”

  Read · get_skill_info

• Reads a file from a skill

  Returns a skill's file or example, so the assistant can follow it.

  Try: “Open the example script from the xlsx skill.”

  Read · get_skill_file

Watch out for

• It runs any Python code the assistant writes

  execute_python_code runs arbitrary code in the container and the project documents no read-only mode. Treat everything in the container as reachable by the model, and keep secrets out of uploads. github.com

• The container has open internet access by default

  Code in the sandbox can reach the network unless you install with CODERUNNER_NETWORK=none. That mode also moves the endpoint to 127.0.0.1:8222. github.com

• The local endpoint has no sign-in and also serves REST routes

  Inside the container the server listens on all interfaces (uvicorn --host 0.0.0.0, port 8222) with no authentication. Besides /mcp it serves plain REST routes such as /execute that run Python code. Host and Origin checks block drive-by requests from web pages, but anything that can reach port 8222 can run code in the sandbox. github.com

• Two host folders are shared with the container

  The installer mounts ~/.coderunner/assets/skills/user and ~/.coderunner/assets/outputs into the container, so files written there appear on your Mac. github.com

Security advisories