PlugWiki
LLM Sandbox logo

LLM Sandbox MCP Server: Run AI-Written Code in Containers

CommunityLocal
GetPyPIllm-sandboxvndee/llm-sandboxDocs
Tools
3
2 read · 1 change
Works in
12
apps
Risk
Medium
can write
Version
0.3.46
last commit Oct 2026

Lets Claude, Cursor and other assistants run code they write inside throwaway Docker, Podman or Kubernetes containers.

LLM Sandbox is a Python library for running AI-written code in containers, and it ships an MCP server. Your assistant sends code and a language, the server runs it in a container, and you get the output and any plot back. It is a community project by Duy Huynh (vndee) and needs Docker, Podman or a Kubernetes cluster. Turn on the hardening settings in the README, because the containers are not locked down by default.

Good for

  • Developers who want an assistant to test code without running it on their own machine
  • Analysts who want charts from matplotlib and similar libraries returned in chat
  • Teams that already run Docker, Podman or Kubernetes and want a locked-down code runner

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install LLM Sandbox MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the LLM Sandbox MCP server to Claude Code. Run this command:

claude mcp add llm-sandbox -- uvx --from "llm-sandbox[mcp-docker]" llm-sandbox-mcp

Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires uv (Python), Docker, Podman or Kubernetes.

Read-only mode: No read-only mode. For a hardened sandbox add SANDBOX_NETWORK_MODE=none, SANDBOX_READ_ONLY=true and SANDBOX_CAP_DROP=ALL to the env block (Docker and Podman only).

The base llm-sandbox package has no MCP dependencies, so these commands install the mcp-docker extra and run the llm-sandbox-mcp command from pyproject.toml. The README itself shows pip install 'llm-sandbox[mcp-docker]' followed by python3 -m llm_sandbox.mcp_server.server. For Podman use the mcp-podman extra and set BACKEND to podman, and for Kubernetes use mcp-k8s with BACKEND set to kubernetes and KUBECONFIG pointing at your config. Set DOCKER_HOST if your socket is not found automatically.

Built from the package data we hold. Not yet tested by us.

Tools

  • Runs code in a container and returns the output

    Runs your code in a fresh container for Python, JavaScript, Java, C++, Go, R or Ruby, installing any libraries you list first. It returns the output and the last plot as an image for languages that support plots. The default time limit is 30 seconds.

    Try: “Run a Python script with matplotlib that plots y = x squared and show me the chart.”

    Runs code · execute_code

  • Lists the languages it can run

    Returns the list of programming languages the sandbox supports.

    Try: “Which languages can the sandbox run?”

    Read · get_supported_languages

  • Describes one language setup

    Returns the details the server holds for one language, or an error if the language is not supported.

    Try: “What does the sandbox use to run Go?”

    Read · get_language_details

Read from the source code

Permissions

medium risk · 5 things to watch · 1 advisory

Medium risk

The assistant can run any code it writes in a container and install packages, and the container is the only barrier between that code and your machine. Set the hardening variables the README recommends, such as no network and a read-only filesystem, before you use it on anything sensitive.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It runs code the model wrote, in a container with no limits set by default

    The execute_code tool runs any code in a fresh container on your chosen backend, kept apart from your own files and processes by the container. The server sets no network, filesystem, capability or memory limits unless you add them, so by default the code has network access and a writable filesystem, and only the 30 second timeout applies. The README recommends SANDBOX_NETWORK_MODE=none, SANDBOX_READ_ONLY=true, SANDBOX_CAP_DROP=ALL and a restrictive SANDBOX_SECURITY_OPT. github.com

  • It needs access to your container engine

    The server talks to the Docker or Podman socket, or your Kubernetes cluster, to start containers. Anyone who can use that socket can start containers on your machine. This is our advice, not the README's: run it where that is acceptable. github.com

  • Hardening settings skip Kubernetes

    The SANDBOX_* settings do not apply to the Kubernetes backend. The README says to supply a custom pod manifest or use the Python API for Kubernetes limits. github.com

  • Packages install from the internet

    The libraries argument installs packages inside the container before running code, so it needs network access that SANDBOX_NETWORK_MODE=none blocks. github.com

  • Installed libraries can persist

    Setting COMMIT_CONTAINER=true saves the container after a run so installed libraries stay for later runs. It is off by default. github.com

Security advisories

Technical details
Turning on read-onlyNo read-only mode for the server. SANDBOX_READ_ONLY=true makes the container filesystem read-only (Docker and Podman only), but code still runs.
Talks toContainer image pulls and package installs inside the container. Your Docker, Podman or Kubernetes API
Sign-in and keysNo account or API key. It uses your local Docker or Podman socket, or your kubeconfig for Kubernetes.

Questions

Is LLM Sandbox official?

No. It is a community project by Duy Huynh (vndee) that makes the llm-sandbox Python library. It is not made by Anthropic, Docker or any other vendor.

Does it need Docker?

You need a container backend: Docker (the default), Podman or Kubernetes. Install the matching extra (mcp-docker, mcp-podman or mcp-k8s) and set the BACKEND variable for Podman or Kubernetes.

Is it really sandboxed?

It runs code in a container, which is isolation but not a guarantee. The project recommends no network, a read-only filesystem, dropped capabilities and low memory and CPU limits. Those are off unless you set them.

Which languages can it run?

Python, JavaScript, Java, C++, Go, R and Ruby. Plots are captured automatically for languages that support visualization.

Does it work with Claude Desktop?

Yes. The project shows a Claude Desktop config. The install box lists other apps too.

Can it run read-only?

No. Its job is to run code. You can make the container filesystem read-only with SANDBOX_READ_ONLY, but that does not stop code from running.

Is it free?

Yes. It is MIT licensed and needs no account or API key.

Why does uvx llm-sandbox not work?

The base package ships no MCP dependencies. The install box uses the mcp-docker extra and the llm-sandbox-mcp command, which is the entry point in the package.

Information

updated Nov 2, 2026

Publisher
Community
Package
llm-sandbox
Registry
PyPI
Transport
stdio
Version
0.3.46
License
MIT
Last commit
Oct 26, 2026
Open issues
19
Listed in
Official MCP registry

WebsiteDocsGitHubPyPIOfficial MCP RegistryChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 4
  1. github.com · github.com
  2. github.com · github.com
  3. github.com · github.com
  4. github.com · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.