# LLM Sandbox

Runs model-generated code in isolated sandboxes and containers across multiple backends. Useful when an AI agent needs to test scripts without exposing the host system.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 1137
- Author: vndee
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vndee/llm-sandbox
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/llm-sandbox

## What it does

The server runs code in Python, JavaScript, Go, C++, Java, and R. Execution happens inside Docker or Kubernetes containers, or through local Linux tools such as Bubblewrap and NsJail. Windows isolation is also supported via MXC and WSL2.

Dependencies install during execution through pip or npm. The environment enforces strict memory and CPU limits. You can block network access entirely.

Bubblewrap execution requires version 0.8.0 or newer and unprivileged user namespace permissions on the host. Without them, the backend fails to start.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `BACKEND`, `DOCKER_HOST`, `KUBECONFIG`, `NAMESPACE`, `COMMIT_CONTAINER`, `KEEP_TEMPLATE`, `SANDBOX_NETWORK_MODE`, `SANDBOX_READ_ONLY`, `SANDBOX_CAP_DROP`, `SANDBOX_SECURITY_OPT` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env BACKEND=<BACKEND> --env DOCKER_HOST=<DOCKER_HOST> --env KUBECONFIG=<KUBECONFIG> --env NAMESPACE=<NAMESPACE> --env COMMIT_CONTAINER=<COMMIT_CONTAINER> --transport stdio llm-sandbox -- uvx llm-sandbox
```
Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>

### Codex

**Platform CLI**
```bash
codex mcp add llm-sandbox --env BACKEND=<BACKEND> --env DOCKER_HOST=<DOCKER_HOST> --env KUBECONFIG=<KUBECONFIG> --env NAMESPACE=<NAMESPACE> --env COMMIT_CONTAINER=<COMMIT_CONTAINER> -- uvx llm-sandbox
```
Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "llm-sandbox": {
            "command": "uvx",
            "args": [
                "llm-sandbox"
            ],
            "env": {
                "BACKEND": "<BACKEND>",
                "DOCKER_HOST": "<DOCKER_HOST>",
                "KUBECONFIG": "<KUBECONFIG>",
                "NAMESPACE": "<NAMESPACE>",
                "COMMIT_CONTAINER": "<COMMIT_CONTAINER>"
            }
        }
    }
}
```
Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "llm-sandbox": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "llm-sandbox"
            ],
            "env": {
                "BACKEND": "<BACKEND>",
                "DOCKER_HOST": "<DOCKER_HOST>",
                "KUBECONFIG": "<KUBECONFIG>",
                "NAMESPACE": "<NAMESPACE>",
                "COMMIT_CONTAINER": "<COMMIT_CONTAINER>"
            }
        }
    }
}
```
Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e BACKEND=<BACKEND> -e DOCKER_HOST=<DOCKER_HOST> -e KUBECONFIG=<KUBECONFIG> -e NAMESPACE=<NAMESPACE> -e COMMIT_CONTAINER=<COMMIT_CONTAINER> llm-sandbox uvx llm-sandbox
```
Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from llm-sandbox <command>

## When to use it
- run untrusted model-generated code in isolated containers
- enforce CPU, memory, and execution time limits on arbitrary scripts
- install temporary runtime packages without polluting host environments
- extract generated plots and visualization files safely

## Example prompts
- Run this Python script inside the sandbox and return stdout.
- Execute this Go test snippet with a 30-second timeout.
- Install matplotlib in the sandbox session and export the plot.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [bernstein](https://affpapa.org/en/nevibecode/mcp/bernstein.md) — MCP server · ★ 1331
- [Kody](https://affpapa.org/en/nevibecode/mcp/kody.md) — MCP server · ★ 851
- [skylos](https://affpapa.org/en/nevibecode/mcp/skylos.md) — MCP server · ★ 849

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md