sandboxmcp is a modular Python library for secure, isolated code execution. Run Python, Node.js, and shell scripts in sandboxed environments. Zero-egress networking, secret vaults, artifact signing, and immutable audit logs.
from sandboxmcp import SandboxFactory, ExecutionRequest
sandbox = SandboxFactory.default()
result = await sandbox.execute(ExecutionRequest(
code="print('Hello from the sandbox!')",
language="python",
))
print(result.stdout) # "Hello from the sandbox!"
for art in result.artifacts:
print(art.name, art.sha256) # artifact hash for verification
from sandboxmcp.mcp_server import SandboxMCPServer
SandboxMCPServer(sandbox).run()
Two isolation backends: Process (subprocess with OS rlimits / Windows Job Objects) and Docker (OCI containers).
Default-deny networking. Sandboxed code cannot reach the internet unless you explicitly allowlist a host.
Inject secrets at runtime without exposing them in code or logs. Scoped per-execution and scrubbed from output.
Execute Python, Node.js, and Shell scripts in the same sandbox infrastructure.
Every execution result is hashed with SHA-256. Chain-of-custody for every artifact your agent produces.
Append-only audit log for every execution. Query by session, time range, or execution ID.
Bounded execution queue with a configurable concurrency limit, enforced by an async semaphore (max_concurrent).
Per-execution limits on CPU time, memory, process count, and output size. Enforced at the OS level (rlimit / Job Objects).
Execution request enters the backpressure queue.
Secrets are injected into the execution environment.
Backend spins up an isolated environment.
Code runs with resource guards active.
Outputs hashed with SHA-256.
Full record appended to immutable log.
sandboxmcp vs a raw OS subprocessSame model, same controls, losses shown as plainly as wins. Every number reproduces from a script with raw JSON in the repo.
| Metric | sandboxmcp | a raw OS subprocess |
|---|---|---|
| host-impact escapes contained — raw | — | 1 / 5 |
| contained — process backend | 3 / 5 | — |
| contained — Docker backend | 5 / 5 | — |
| dependencies (process backend) | 0 | — |
Real defense-in-depth with zero dependencies. The process backend stops egress and resource attacks but has no kernel isolation — host file reads/writes leak. The Docker backend contains all of them, verified on the host filesystem. Not an unescapable sandbox: process for trusted code with guardrails, Docker to contain code you don't trust.