LLM Sandbox — Claude Code MCP server: what it does, how to install
Runs model-generated code in isolated sandboxes and containers across multiple backends. Useful when an AI agent needs to test scripts without exposing the host system.
claude mcp add --env BACKEND=<BACKEND> --env DOCKER_HOST=<DOCKER_HOST> --env KUBECONFIG=<KUBECONFIG> --env NAMESPACE=<NAMESPACE> --env COMMIT_CONTAINER=<COMMIT_CONTAINER> --transport stdio llm-sandbox -- uvx llm-sandboxWhat LLM Sandbox does
The server runs code in Python, JavaScript, Go, C++, Java, and R. Execution happens inside Docker or Kubernetes containers, or through local Linux tools such as Bubblewrap and NsJail. Windows isolation is also supported via MXC and WSL2.
Dependencies install during execution through pip or npm. The environment enforces strict memory and CPU limits. You can block network access entirely.
Bubblewrap execution requires version 0.8.0 or newer and unprivileged user namespace permissions on the host. Without them, the backend fails to start.
What it helps with
- run untrusted model-generated code in isolated containers
- enforce CPU, memory, and execution time limits on arbitrary scripts
- install temporary runtime packages without polluting host environments
- extract generated plots and visualization files safely
Example prompts for the agent
- Run this Python script inside the sandbox and return stdout.
- Execute this Go test snippet with a 30-second timeout.
- Install matplotlib in the sandbox session and export the plot.
How to install LLM Sandbox
Platform CLI
claude mcp add --env BACKEND=<BACKEND> --env DOCKER_HOST=<DOCKER_HOST> --env KUBECONFIG=<KUBECONFIG> --env NAMESPACE=<NAMESPACE> --env COMMIT_CONTAINER=<COMMIT_CONTAINER> --transport stdio llm-sandbox -- uvx llm-sandboxReplace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>
Platform CLI
codex mcp add llm-sandbox --env BACKEND=<BACKEND> --env DOCKER_HOST=<DOCKER_HOST> --env KUBECONFIG=<KUBECONFIG> --env NAMESPACE=<NAMESPACE> --env COMMIT_CONTAINER=<COMMIT_CONTAINER> -- uvx llm-sandboxReplace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>
Config file
{
"mcpServers": {
"llm-sandbox": {
"command": "uvx",
"args": [
"llm-sandbox"
],
"env": {
"BACKEND": "<BACKEND>",
"DOCKER_HOST": "<DOCKER_HOST>",
"KUBECONFIG": "<KUBECONFIG>",
"NAMESPACE": "<NAMESPACE>",
"COMMIT_CONTAINER": "<COMMIT_CONTAINER>"
}
}
}
}Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>
Config file
{
"servers": {
"llm-sandbox": {
"type": "stdio",
"command": "uvx",
"args": [
"llm-sandbox"
],
"env": {
"BACKEND": "<BACKEND>",
"DOCKER_HOST": "<DOCKER_HOST>",
"KUBECONFIG": "<KUBECONFIG>",
"NAMESPACE": "<NAMESPACE>",
"COMMIT_CONTAINER": "<COMMIT_CONTAINER>"
}
}
}
}Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>
Platform CLI
gemini mcp add -e BACKEND=<BACKEND> -e DOCKER_HOST=<DOCKER_HOST> -e KUBECONFIG=<KUBECONFIG> -e NAMESPACE=<NAMESPACE> -e COMMIT_CONTAINER=<COMMIT_CONTAINER> llm-sandbox uvx llm-sandboxReplace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about LLM Sandbox
How to install LLM Sandbox in Claude Code?
Run claude mcp add llm-sandbox -- uvx llm-sandbox in your terminal.
What does LLM Sandbox do?
It executes LLM-generated code inside isolated containers or local sandboxes. It protects the host system by restricting memory, execution time, and network access.
Can I run LLM Sandbox without Docker?
Yes, on Linux you can use daemonless local backends like Bubblewrap or NsJail. On Windows, native MXC isolation and WSL2 are available.
