Code execution sandboxes MCP servers

A server here runs code or commands in an isolated sandbox or container for an AI agent.

Not here: deploying apps to production.

312servers
108 remote204 localTagged by Odel's AI, which can make mistakes

Best fit

184 made for this, ranked by starsRemoteLocal
  1. Grok Build @nuruvala/grok-build-mcp-serverRun the Grok Build CLI as MCP tools: agent runs with live progress, code review, web research.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  2. tollbooth @chrzanowy/agent-tollboothStateful backend for AI agents: memory, watch, render, execute, and shared boards with digests.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.
  3. Agentic Compute @codelad1304/agentic-computeSecure Python sandbox for data optimization and Matplotlib rendering via x402 microtransactions.37% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  4. ScratchRun @scratchrun/mcpEphemeral MicroVM-isolated code execution for AI agents. Fresh VM per call, hard-purged after.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  5. Codexbox @psyb0t/codexboxSelf-hosted MCP server: run OpenAI Codex CLI prompts and manage workspace files.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.
  6. Cinch @yusufkadry/cinchRun AI-generated code safely. gVisor-isolated Python/JS sandboxes for any MCP client. Pay per run.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  7. Ghostlink @bgorzelic/ghostlinkSandboxed repo access for coding agents: search, read, patch, run, git -- confined to a repo root.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  8. Kubernetes Ephemeral Job @inhuman/mcp-k8s-ephemeral-jobRuns a command in a throwaway Kubernetes pod and returns exit code, output and artifacts.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.
  9. Forge MCP @frmoded/forge-mcpMCP server + tools for the Forge E-- generative-music authoring loop (compile / run / commit).7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  10. Deep Agentic Core MCP @deepagentlabs/deep-agentic-core-mcpUnified MCP server for AgenticLens and Agentic Chaos capabilities.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  11. PLwC Personal @mhoedt-ai/plwc-gatewayWindows x64/Python 3.12 MCPB preview: governed local tools and persistent profiles.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.
  12. MCP stdio ShellGuard @studiomeyer/stdio-shellguardDefense-in-depth for MCP stdio servers: shell-injection guard, AST audit CLI, RCE blocking.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  13. BugProof @sidinsearch/bugproofCapture, replay, and debug failures with portable, executable bug artifacts5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  14. Render Unto Caesar @mightydatainc/ruc-mcpAn MCP server that fuses LLM contextual intelligence with procedural code reliability.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.
  15. agent-godmode @mdvohra/agent-godmodeSandboxed workspace MCP: file ops, argv-only run_command, list_files; BYO LLM prompts.10% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  16. Kitsune @kaiser-data/kitsune-mcpHot-reload for MCP servers + mount any community server mid-session, Docker-caged. No restarts.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  17. Essentials @fieldcure/essentialsEssential MCP server: HTTP, web search, downloads, Wolfram|Alpha, shell, JS, file I/O, memory.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from NuGet.
  18. Forgejudge @ahmedeid1/forgejudgeOpen eval leaderboard + CI gate for autonomous coding agents (solve, score, trace).3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  19. Code Executor @csoai-org/code-executor-mcpCode Executor MCP Server by MEOK AI Labs13% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  20. NeevCloud Sandbox @neevcloud/sandboxA NeevCloud sandbox as native tools: run commands, edit files, manage processes, snapshots.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.
  21. NIRA REPL MCP @pachote/nira-replSecure code execution sandbox for Claude — run Python, JavaScript, and shell commands10% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  22. Ovrin @joshluberisse/ovrin-mcpSecure Linux sandboxes for AI agents, as MCP tools.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  23. Bedc @be-dce/bedc-mcpMCP server for Dual Canvas Execution (DCE) - use with Polsia, Cursor, Claude, and other MCP clients9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  24. Gibil @alexikm/gibilSpawns an ephemeral Ubuntu VM with project clone, shell exec, file I/O, and auto-destroy on TTL.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.