Code execution sandboxes MCP servers

A server here runs code or commands in an isolated sandbox or container for an AI agent.

Not here: deploying apps to production.

307servers
107 remote200 localTagged by Odel's AI, which can make mistakes

Best fit

182 made for this, ranked by starsRemoteLocal
  1. LocalStack @localstack/localstack-mcp-serverA LocalStack MCP Server providing essential tools for local cloud development & testing3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.27 GitHub stars.
  2. devcontainer-mcp @aniongithub/devcontainer-mcpManage dev container environments via MCP (Docker, DevPod, Codespaces).9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.27 GitHub stars.
  3. Codex Tool @x51xxx/codex-mcp-toolMCP server bridging AI assistants to OpenAI Codex CLI for code analysis and review6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.24 GitHub stars.
  4. ArcGIS MCP Bridge @muend/arcgis-mcp-bridgeSecure local-first MCP server for licensed ArcGIS Pro and ArcPy on Windows.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.22 GitHub stars.
  5. Memory Journal @neverinfamous/memory-journal-mcpDeveloper journal with knowledge graphs, relationships, Git context, and semantic search4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.20 GitHub stars.
  6. Codex Octopus @xiaolai/codex-octopusSpawn multiple specialized Codex agents as MCP servers, each independently configured.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.20 GitHub stars.
  7. Memory Journal @smithery/neverinfamous-memory-journal-mcpA MCP server built for developers enabling Git based project management with project and personal…16% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.20 GitHub stars.
  8. Ironclaw @ironsecco/ironclawSandboxed shell exec for MCP clients: run untrusted agent commands in a gVisor container.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.19 GitHub stars.
  9. Chiplab @veecle/chiplabRun, build, and validate firmware on virtual hardware from your AI agent. Hardware knowledge corpus.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.17 GitHub stars.
  10. SageMath @xbp-europe/sagemath-mcpStateful SageMath MCP server with 40 tools and a sandboxed Sage session per client.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.16 GitHub stars.
  11. Orbit @constellation-works/orbitOrbit's local-first task and workflow registry for coding agents.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.14 GitHub stars.
  12. BioMCP-TS @yeyuan98/biomcp-tsBiomedical MCP server: genes, variants, trials, literature, patents, optional SQL/R/biowasm tools.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.12 GitHub stars.
  13. PostgreSQL MCP Server @neverinfamous/postgres-mcp-serverEnterprise PostgreSQL MCP server with 63 tools, 10 resources, 10 prompts for AI-native operations7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.12 GitHub stars.
  14. Edict @sowiedu/edictAI-agent programming language. JSON AST in, WASM out. Typed, effect-tracked, Z3-verified.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.12 GitHub stars.
  15. Interactive LeetCode @sperekrestova/interactive-leetcode-mcpInteractive LeetCode MCP server with authorization and solution submission capabilities14% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.12 GitHub stars.
  16. Eterna MCP @eternahybridexchange/eterna-mcpNo-KYC managed MCP for AI agents: sandboxed TypeScript trading SDK, isolated sub-accounts, futures.21% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.11 GitHub stars.
  17. Colab Exec @pdwi2020/mcp-server-colab-execExecute Python code on Google Colab GPU runtimes (T4/L4) from any MCP client9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.9 GitHub stars.
  18. Covenant Guard @opencovenant/guardHard spend cap, OS sandbox, and signed receipts for unattended coding agents like Claude Code.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.8 GitHub stars.
  19. RLM Tools @stefanoshea/rlm-toolsPersistent Python sandbox for token-efficient codebase exploration in MCP clients4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.8 GitHub stars.
  20. Sevalla @sevalla-hosting/mcpOfficial Sevalla MCP — full PaaS API access through just 2 tools.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.8 GitHub stars.
  21. PineForge — offline PineScript v6 backtest MCP @pineforge-4pass/pineforge-codegen-mcpOffline PineScript v6 → C++ backtests at deterministic TradingView parity, run locally via MCP.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.8 GitHub stars.
  22. OpenGrok MCP Server @icyhot09/opengrok-mcp-serverMCP server bridging OpenGrok search engine with AI for instant context across massive codebases.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.8 GitHub stars.
  23. Pymcp @smithery/anirbanbasu-pymcpPrimarily to be used as a template repository for developing MCP servers with FastMCP in Python, P…6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.8 GitHub stars.
  24. EasyBits @easybits/easybitsPersistent Linux microVMs for agents: root, internet, sub-second resume and a public URL.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.7 GitHub stars.