Sandbox MCP and skills

The MCP bridge is local stdio, not a remote worker backdoor. sandbox-mcp speaks newline-delimited JSON-RPC over standard input and output, then connects to the authenticated controller API. It does not need Docker, PostgreSQL, NATS, or a worker credential.

Install the client integration

The one-command setup detects common agent clients and installs the Sandbox skill together with the local MCP bridge:

123curl -fsSL https://tools.yshubham.com/sandbox/setup.sh | sh
export SANDBOX_URL=https://sandbox.example.com
export SANDBOX_TOKEN='read-from-your-secret-store'

Codex, Claude Code, and Gemini CLI can register sandbox-mcp natively. Cursor, Claude Desktop, Windsurf, Cline, Roo Code, and Gemini Code Assist use a shared mcpServers envelope; Pi, Aider, CommandCode, and hosts without native MCP use the same CLI plus skill.

Tool surface

The tool list mirrors the lifecycle contract. A completion from the bridge still needs operation-state and remote-exit-code inspection.

Tool	Job
`sandbox_health`	Verify controller reachability and version
`sandbox_create` / `sandbox_delete`	Create or tear down a sandbox
`sandbox_list` / `sandbox_inspect`	Read current sandbox state
`sandbox_exec`	Execute argv-safe work
`sandbox_tunnel_create` / `sandbox_tunnel_delete`	Manage one public HTTP/WebSocket route
`sandbox_operation` / `sandbox_wait`	Read or wait for asynchronous work
`sandbox_agent_list` / `sandbox_agent_run`	Discover and start built-in agent profiles

Resources and prompts

Read resources before making a claim about a deployment. sandbox://capabilities describes the current feature set, sandbox://agents exposes profile defaults, and sandbox://workflow provides the compact lifecycle runbook.

The bridge also exposes sandbox-task and sandbox-agent-session prompts. Use them to structure a request, not to smuggle credentials or a tunnel policy into an agent task.

The sandbox-platform skill

The sandbox-platform skill is a safety-focused operator playbook. It directs an agent to classify risk, default network access to deny or restricted, use argv execution, wait for mutations, report public URLs accurately, and clean up at the end.

Read the dedicated skill guide for the agent workflow and consult the hosted raw Sandbox documentation index for product-specific references.