Securely run LLM-generated code in isolated containers across 7 languages and 3 container backends.
Connect Runs on your machine
claude mcp add llm-sandbox -e BACKEND=<BACKEND> -e DOCKER_HOST=<DOCKER_HOST> -e KUBECONFIG=<KUBECONFIG> -e NAMESPACE=<NAMESPACE> -e COMMIT_CONTAINER=<COMMIT_CONTAINER> -e KEEP_TEMPLATE=<KEEP_TEMPLATE> -e SANDBOX_NETWORK_MODE=<SANDBOX_NETWORK_MODE> -e SANDBOX_READ_ONLY=<SANDBOX_READ_ONLY> -e SANDBOX_CAP_DROP=<SANDBOX_CAP_DROP> -e SANDBOX_SECURITY_OPT=<SANDBOX_SECURITY_OPT> -e SANDBOX_MEMORY=<SANDBOX_MEMORY> -e SANDBOX_CPUS=<SANDBOX_CPUS> -- uvx llm-sandbox==0.3.43{
"mcpServers": {
"llm-sandbox": {
"command": "uvx",
"args": [
"llm-sandbox==0.3.43"
],
"env": {
"BACKEND": "<BACKEND>",
"DOCKER_HOST": "<DOCKER_HOST>",
"KUBECONFIG": "<KUBECONFIG>",
"NAMESPACE": "<NAMESPACE>",
"COMMIT_CONTAINER": "<COMMIT_CONTAINER>",
"KEEP_TEMPLATE": "<KEEP_TEMPLATE>",
"SANDBOX_NETWORK_MODE": "<SANDBOX_NETWORK_MODE>",
"SANDBOX_READ_ONLY": "<SANDBOX_READ_ONLY>",
"SANDBOX_CAP_DROP": "<SANDBOX_CAP_DROP>",
"SANDBOX_SECURITY_OPT": "<SANDBOX_SECURITY_OPT>",
"SANDBOX_MEMORY": "<SANDBOX_MEMORY>",
"SANDBOX_CPUS": "<SANDBOX_CPUS>"
}
}
}
}{
"mcpServers": {
"llm-sandbox": {
"command": "uvx",
"args": [
"llm-sandbox==0.3.43"
],
"env": {
"BACKEND": "<BACKEND>",
"DOCKER_HOST": "<DOCKER_HOST>",
"KUBECONFIG": "<KUBECONFIG>",
"NAMESPACE": "<NAMESPACE>",
"COMMIT_CONTAINER": "<COMMIT_CONTAINER>",
"KEEP_TEMPLATE": "<KEEP_TEMPLATE>",
"SANDBOX_NETWORK_MODE": "<SANDBOX_NETWORK_MODE>",
"SANDBOX_READ_ONLY": "<SANDBOX_READ_ONLY>",
"SANDBOX_CAP_DROP": "<SANDBOX_CAP_DROP>",
"SANDBOX_SECURITY_OPT": "<SANDBOX_SECURITY_OPT>",
"SANDBOX_MEMORY": "<SANDBOX_MEMORY>",
"SANDBOX_CPUS": "<SANDBOX_CPUS>"
}
}
}
}{
"servers": {
"llm-sandbox": {
"type": "stdio",
"command": "uvx",
"args": [
"llm-sandbox==0.3.43"
],
"env": {
"BACKEND": "<BACKEND>",
"DOCKER_HOST": "<DOCKER_HOST>",
"KUBECONFIG": "<KUBECONFIG>",
"NAMESPACE": "<NAMESPACE>",
"COMMIT_CONTAINER": "<COMMIT_CONTAINER>",
"KEEP_TEMPLATE": "<KEEP_TEMPLATE>",
"SANDBOX_NETWORK_MODE": "<SANDBOX_NETWORK_MODE>",
"SANDBOX_READ_ONLY": "<SANDBOX_READ_ONLY>",
"SANDBOX_CAP_DROP": "<SANDBOX_CAP_DROP>",
"SANDBOX_SECURITY_OPT": "<SANDBOX_SECURITY_OPT>",
"SANDBOX_MEMORY": "<SANDBOX_MEMORY>",
"SANDBOX_CPUS": "<SANDBOX_CPUS>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
BACKENDOptional | Container backend to use. Must match the installed extra: mcp-docker, mcp-podman, or mcp-k8s. |
DOCKER_HOSTOptional | Docker or Podman socket URL, e.g. unix:///var/run/docker.sock |
KUBECONFIGOptional | Path to kubeconfig file when BACKEND=kubernetes. |
NAMESPACEOptional | Kubernetes namespace used for sandbox pods when BACKEND=kubernetes. |
COMMIT_CONTAINEROptional | Commit the container after a run so installed libraries persist between sessions. |
KEEP_TEMPLATEOptional | Keep the base image after the session ends to avoid re-pulling it on the next run. |
SANDBOX_NETWORK_MODEOptional | Network mode for the sandbox container. Set to 'none' for hardened isolation. Docker and Podman backends only. |
SANDBOX_READ_ONLYOptional | Mount the sandbox root filesystem read-only. Recommended: true. Docker and Podman backends only. |
SANDBOX_CAP_DROPOptional | Comma-separated Linux capabilities to drop. Recommended: ALL. Docker and Podman backends only. |
SANDBOX_SECURITY_OPTOptional | Comma-separated container security options, e.g. no-new-privileges. Docker and Podman backends only. |
SANDBOX_MEMORYOptional | Memory limit for the sandbox container, e.g. 4g. Docker and Podman backends only. |
SANDBOX_CPUSOptional | Fractional CPU allocation for the sandbox container, e.g. 1.5. Docker and Podman backends only. |
Details
| Package | [email protected] (PYPI, stdio) |
| First published | 3 Aug 2026 |
| Last updated | 3 Aug 2026 |
| Registry name | io.github.vndee/llm-sandbox |
More ai and media servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.