Skip to main content
Glama

ipybox

mcp-name: io.github.gradion-ai/ipybox

ipybox is a unified execution environment for Python code, shell commands, and programmatic MCP tool calls.

Overview

ipybox executes code blocks in a stateful IPython kernel. A code block can contain any combination of Python code, shell commands, and programmatic MCP tool calls. Kernels can be sandboxed with sandbox-runtime, enforcing filesystem and network restrictions at OS level.

It generates Python APIs for MCP server tools via mcpygen, and supports application-level approval of individual tool calls and shell commands during code execution. ipybox runs locally on your computer, enabling protected access to your local data and tools.

NOTE

Next generation ipybox

This is the next generation of ipybox, a complete rewrite. Older versions are maintained on the 0.6.x branch and can be obtained with pip install ipybox<0.7.

Related MCP server: MCP Executor Server

Documentation:

Capabilities

Capability

Description

Stateful execution

State persists across executions in IPython kernels

Unified execution

Combine Python code, shell commands, and programmatic MCP tool calls in a code block

Shell command execution

Run shell commands via !cmd syntax, capture output into Python variables

Programmatic MCP tool calls

MCP tools called via generated Python API ("code mode"), not JSON directly

Python tool API generation

Typed functions and Pydantic models generated from MCP tool schemas via mcpygen

Application-level approval

Individual approval of tool calls and shell commands during code execution

Lightweight sandboxing

Optional kernel isolation via Anthropic's sandbox-runtime

Local execution

No cloud dependencies, everything runs locally on your machine

Usage

Component

Description

Python SDK

Python API for building applications on ipybox

MCP server

ipybox as MCP server for code actions and programmatic tool calling

Claude Code plugin

Plugin that bundles the ipybox MCP server and a code action skill

TIP

Freeact agent

Freeact is a general-purpose agent built on ipybox.

Available Tools

4 tools
download_fileA

Download a file from the container's /app directory to the host filesystem.

Retrieves files created or modified during code execution from the container. The file at '/app/{relpath}' in the container will be saved to the specified location on the host.

Parent directories are created automatically if they don't exist.

ParametersJSON Schema
NameRequiredDescriptionDefault
local_pathYesAbsolute path on host filesystem where the file will be saved
relpathYesSource path relative to container's /app directory (e.g., 'output/results.csv' reads from /app/output/results.csv)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does well by disclosing key behavioral traits: it explains the source and destination mapping, mentions automatic parent directory creation, and implies file transfer from container to host. However, it doesn't cover error conditions, file size limits, or permissions requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and front-loaded: the first sentence states the core purpose, followed by clarifying sentences that each add useful context without redundancy. There is no wasted text, and the structure supports quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (file transfer between container and host), no annotations, and no output schema, the description is fairly complete—it covers purpose, usage context, and key behavior. However, it lacks details on error handling, return values, or limitations, leaving some gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents both parameters. The description adds minimal value beyond the schema by clarifying the '/app/{relpath}' mapping and the host filesystem context, but doesn't provide additional syntax or format details. This meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Download a file') and resource ('from the container's /app directory to the host filesystem'), distinguishing it from sibling tools like upload_file (which moves in the opposite direction) and execute_ipython_cell/reset (which are unrelated file operations).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool ('Retrieves files created or modified during code execution from the container'), but does not explicitly state when not to use it or name alternatives (e.g., it doesn't contrast with upload_file beyond the directional implication).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_ipython_cellA

Execute Python code in a stateful IPython kernel within a Docker container.

    The kernel maintains state across executions - variables, imports, and definitions
    persist between calls. Each execution builds on the previous one, allowing you to
    build complex workflows step by step. Use '!pip install package_name' to install
    packages as needed.

    The kernel has an active asyncio event loop, so use 'await' directly for async
    code. DO NOT use asyncio.run() or create new event loops.

    Executions are sequential (not concurrent) as they share kernel state. Use the
    reset() tool to clear the kernel state and start fresh.

    Returns:
        str: Output text from execution, or empty string if no output.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
codeYesPython code to execute in the IPython kernel
timeoutNoMaximum execution time in seconds before the kernel is interrupted

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does so comprehensively. It discloses key behavioral traits: state persistence across calls, asyncio event loop handling, sequential execution constraints, and the return format (output text or empty string). This goes well beyond what the input schema provides.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and front-loaded with the core purpose. Each sentence adds value, such as state persistence details, async handling, and execution constraints. Minor improvements could include briefer phrasing, but it remains efficient with no wasted content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (stateful kernel, async support) and the presence of an output schema (which covers return values), the description is complete. It addresses all critical aspects: purpose, usage, behavioral nuances, and parameter context, making it fully adequate for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaningful context beyond the schema: it explains that the 'code' parameter can include '!pip install' commands and async 'await' usage, and it implies the 'timeout' parameter's role in preventing hangs. This elevates the score above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Execute Python code') and resource ('in a stateful IPython kernel within a Docker container'), distinguishing it from sibling tools like download_file, upload_file, and reset. It precisely defines what the tool does beyond just the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides when to use this tool (for executing Python code with persistent state) and when to use alternatives (use reset() to clear kernel state, and it mentions using '!pip install' for package installation). It also clarifies that executions are sequential, not concurrent, due to shared kernel state.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

resetA

Reset the IPython kernel to a clean state.

Creates a new kernel instance, clearing all variables, imports, and definitions from memory. Installed packages and files in the container filesystem are preserved. Useful for starting fresh experiments or clearing memory after processing large datasets.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and does an excellent job disclosing behavioral traits: it explains what gets cleared (all variables, imports, definitions from memory), what gets preserved (installed packages and files in container filesystem), and the creation of a new kernel instance. The only minor gap is lack of information about potential side effects or error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly structured: a clear opening statement of purpose, followed by specific behavioral details, and ending with usage context. Every sentence earns its place, with no redundant information or wasted words. The information is appropriately front-loaded with the core functionality stated first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no annotations and no output schema, the description provides excellent coverage of what the tool does, its effects, and when to use it. The only minor gap is the lack of information about what the tool returns (though with no output schema, this would be helpful to include). It adequately compensates for the absence of structured metadata.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters with 100% schema description coverage, so the baseline would be 4. The description appropriately doesn't discuss parameters since none exist, maintaining focus on the tool's behavior and purpose without unnecessary detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('reset the IPython kernel to a clean state') and distinguishes it from sibling tools (download_file, execute_ipython_cell, upload_file) by focusing on kernel state management rather than file operations or code execution. It provides a precise verb+resource combination with clear scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('useful for starting fresh experiments or clearing memory after processing large datasets'), providing clear context for its application. However, it doesn't specify when NOT to use it or mention alternatives among sibling tools, which prevents a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_fileA

Upload a file from the host filesystem to the container's /app directory.

    Makes a file from the host available inside the container for code execution.
    The uploaded file can then be accessed in execute_ipython_cell using the
    path '/app/{relpath}'.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
local_pathYesAbsolute path to the source file on host filesystem that will be uploaded
relpathYesDestination path relative to container's /app directory (e.g., 'data/input.csv' saves to /app/data/input.csv)

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explains the tool's effect ('makes a file available inside the container') and how the uploaded file can be accessed later, but doesn't cover important behavioral aspects like error conditions (e.g., what happens if the local file doesn't exist), permissions, or whether the operation overwrites existing files. It adds some context but leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with three sentences that each serve a clear purpose: stating the core action, explaining the utility, and providing access instructions. There's no wasted text, and information is front-loaded appropriately for an AI agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (file transfer operation), no annotations, and no output schema, the description provides adequate but incomplete coverage. It explains the basic functionality and integration with execute_ipython_cell, but lacks details about error handling, performance characteristics, or what the tool returns upon completion. It's minimally viable but has clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents both parameters (local_path and relpath). The description adds minimal value beyond the schema by mentioning the destination path format ('/app/{relpath}'), but doesn't provide additional semantic context like file size limits or supported file types. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('upload a file') and resource ('from the host filesystem to the container's /app directory'), distinguishing it from sibling tools like download_file (reverse operation) and execute_ipython_cell (different function). It provides a concrete purpose beyond just the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('to make a file available inside the container for code execution') and mentions its relationship with execute_ipython_cell for accessing the uploaded file. However, it doesn't provide explicit alternatives or exclusions (e.g., when not to use it vs. other file management tools).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 4 tool updatesv1.0.0
    • First observeddownload_file
    • First observedexecute_ipython_cell
    • First observedreset
    • First observedupload_file

TDQS

A4.4/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose with no overlap: download_file retrieves files from container to host, execute_ipython_cell runs Python code in a persistent kernel, reset clears kernel state, and upload_file sends files from host to container. The boundaries are unambiguous, preventing agent misselection.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern (download_file, execute_ipython_cell, reset, upload_file) with clear, descriptive actions. Reset is a single verb but fits naturally as it describes a clear action without needing a noun, maintaining overall consistency in style and readability.

Tool Count5/5

With 4 tools, the server is well-scoped for its purpose of interactive Python execution in a container. Each tool earns its place by covering essential operations: file transfer (upload/download), code execution, and state management (reset). This count avoids bloat while providing complete workflow coverage.

Completeness5/5

The tool set provides complete coverage for the domain of container-based IPython execution. It supports the full lifecycle: uploading files, executing code with state persistence, resetting the environment, and downloading results. No obvious gaps exist; agents can perform end-to-end workflows without dead ends.

Maintenance

ActivityInactive
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    An interactive Python code execution environment that allows users and LLMs to safely execute Python code and install packages in isolated Docker containers.
    40
    Apache 2.0
  • F
    license
    Not graded
    quality
    Not graded
    maintenance
    A secure server that enables code execution in isolated Docker environments, supporting Python with strict security constraints including network isolation, limited filesystem access, and resource limitations.
    -
  • A
    license
    A
    quality
    C
    maintenance
    Enables code execution in isolated Docker containers with persistent IPython, Node.js, or R kernels, supporting file import/export and cross-session transfers via MCP tools.
    6
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables LLMs to safely execute code in isolated Docker containers with resource limits and security controls, supporting session management and automatic dependency installation.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/gradion-ai/ipybox'

If you have feedback or need assistance with the MCP directory API, please join our Discord server