ipybox
The ipybox server provides a secure, sandboxed IPython kernel environment in a Docker container for executing Python code with state preservation across executions.
Execute Python code securely within a stateful IPython kernel that preserves variables, imports, and definitions across calls
Support direct execution of asynchronous Python code within the kernel's active event loop
Install Python packages at runtime using
!pip installcommandsUpload files from the host to the container's
/appdirectory for use in code executionDownload files from the container's
/appdirectory to retrieve results or generated artifactsStream code execution output as it is generated
Return plots generated with visualization libraries
Reset the IPython kernel to a clean state, clearing memory while preserving installed packages and files
Provides secure Python code execution in Docker containers with IPython kernels, supporting data analytics, package installation, and plot generation with configurable network restrictions
Enables safe execution of Python code through IPython kernels in sandboxed environments, supporting stateful code execution, package management, and visualization library output
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ipyboxrun this Python code to calculate the average of these numbers: [45, 67, 89, 23, 56]"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ipybox
mcp-name: io.github.gradion-ai/ipybox
ipybox is a unified execution environment for Python code, shell commands, and programmatic MCP tool calls.
Overview
ipybox executes code blocks in a stateful IPython kernel. A code block can contain any combination of Python code, shell commands, and programmatic MCP tool calls. Kernels can be sandboxed with sandbox-runtime, enforcing filesystem and network restrictions at OS level.
It generates Python APIs for MCP server tools via mcpygen, and supports application-level approval of individual tool calls and shell commands during code execution. ipybox runs locally on your computer, enabling protected access to your local data and tools.
Next generation ipybox
This is the next generation of ipybox, a complete rewrite. Older versions are maintained on the 0.6.x branch and can be obtained with pip install ipybox<0.7.
Related MCP server: MCP Executor Server
Documentation:
📚 Documentation
🏗️ Architecture
🤖 llms.txt
🤖 llms-full.txt
Capabilities
Capability | Description |
Stateful execution | State persists across executions in IPython kernels |
Unified execution | Combine Python code, shell commands, and programmatic MCP tool calls in a code block |
Shell command execution | Run shell commands via |
Programmatic MCP tool calls | MCP tools called via generated Python API ("code mode"), not JSON directly |
Python tool API generation | Typed functions and Pydantic models generated from MCP tool schemas via mcpygen |
Application-level approval | Individual approval of tool calls and shell commands during code execution |
Lightweight sandboxing | Optional kernel isolation via Anthropic's sandbox-runtime |
Local execution | No cloud dependencies, everything runs locally on your machine |
Usage
Component | Description |
Python API for building applications on ipybox | |
ipybox as MCP server for code actions and programmatic tool calling | |
Plugin that bundles the ipybox MCP server and a code action skill |
Freeact agent
Freeact is a general-purpose agent built on ipybox.
Available Tools
4 toolsdownload_fileA
Download a file from the container's /app directory to the host filesystem.
Retrieves files created or modified during code execution from the container. The file at '/app/{relpath}' in the container will be saved to the specified location on the host.
Parent directories are created automatically if they don't exist.
| Name | Required | Description | Default |
|---|---|---|---|
| local_path | Yes | Absolute path on host filesystem where the file will be saved | |
| relpath | Yes | Source path relative to container's /app directory (e.g., 'output/results.csv' reads from /app/output/results.csv) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well by disclosing key behavioral traits: it explains the source and destination mapping, mentions automatic parent directory creation, and implies file transfer from container to host. However, it doesn't cover error conditions, file size limits, or permissions requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: the first sentence states the core purpose, followed by clarifying sentences that each add useful context without redundancy. There is no wasted text, and the structure supports quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (file transfer between container and host), no annotations, and no output schema, the description is fairly complete—it covers purpose, usage context, and key behavior. However, it lacks details on error handling, return values, or limitations, leaving some gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents both parameters. The description adds minimal value beyond the schema by clarifying the '/app/{relpath}' mapping and the host filesystem context, but doesn't provide additional syntax or format details. This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Download a file') and resource ('from the container's /app directory to the host filesystem'), distinguishing it from sibling tools like upload_file (which moves in the opposite direction) and execute_ipython_cell/reset (which are unrelated file operations).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool ('Retrieves files created or modified during code execution from the container'), but does not explicitly state when not to use it or name alternatives (e.g., it doesn't contrast with upload_file beyond the directional implication).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_ipython_cellA
Execute Python code in a stateful IPython kernel within a Docker container.
The kernel maintains state across executions - variables, imports, and definitions
persist between calls. Each execution builds on the previous one, allowing you to
build complex workflows step by step. Use '!pip install package_name' to install
packages as needed.
The kernel has an active asyncio event loop, so use 'await' directly for async
code. DO NOT use asyncio.run() or create new event loops.
Executions are sequential (not concurrent) as they share kernel state. Use the
reset() tool to clear the kernel state and start fresh.
Returns:
str: Output text from execution, or empty string if no output.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | Python code to execute in the IPython kernel | |
| timeout | No | Maximum execution time in seconds before the kernel is interrupted |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so comprehensively. It discloses key behavioral traits: state persistence across calls, asyncio event loop handling, sequential execution constraints, and the return format (output text or empty string). This goes well beyond what the input schema provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded with the core purpose. Each sentence adds value, such as state persistence details, async handling, and execution constraints. Minor improvements could include briefer phrasing, but it remains efficient with no wasted content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (stateful kernel, async support) and the presence of an output schema (which covers return values), the description is complete. It addresses all critical aspects: purpose, usage, behavioral nuances, and parameter context, making it fully adequate for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaningful context beyond the schema: it explains that the 'code' parameter can include '!pip install' commands and async 'await' usage, and it implies the 'timeout' parameter's role in preventing hangs. This elevates the score above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Execute Python code') and resource ('in a stateful IPython kernel within a Docker container'), distinguishing it from sibling tools like download_file, upload_file, and reset. It precisely defines what the tool does beyond just the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides when to use this tool (for executing Python code with persistent state) and when to use alternatives (use reset() to clear kernel state, and it mentions using '!pip install' for package installation). It also clarifies that executions are sequential, not concurrent, due to shared kernel state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resetA
Reset the IPython kernel to a clean state.
Creates a new kernel instance, clearing all variables, imports, and definitions from memory. Installed packages and files in the container filesystem are preserved. Useful for starting fresh experiments or clearing memory after processing large datasets.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does an excellent job disclosing behavioral traits: it explains what gets cleared (all variables, imports, definitions from memory), what gets preserved (installed packages and files in container filesystem), and the creation of a new kernel instance. The only minor gap is lack of information about potential side effects or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly structured: a clear opening statement of purpose, followed by specific behavioral details, and ending with usage context. Every sentence earns its place, with no redundant information or wasted words. The information is appropriately front-loaded with the core functionality stated first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no annotations and no output schema, the description provides excellent coverage of what the tool does, its effects, and when to use it. The only minor gap is the lack of information about what the tool returns (though with no output schema, this would be helpful to include). It adequately compensates for the absence of structured metadata.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters with 100% schema description coverage, so the baseline would be 4. The description appropriately doesn't discuss parameters since none exist, maintaining focus on the tool's behavior and purpose without unnecessary detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('reset the IPython kernel to a clean state') and distinguishes it from sibling tools (download_file, execute_ipython_cell, upload_file) by focusing on kernel state management rather than file operations or code execution. It provides a precise verb+resource combination with clear scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('useful for starting fresh experiments or clearing memory after processing large datasets'), providing clear context for its application. However, it doesn't specify when NOT to use it or mention alternatives among sibling tools, which prevents a perfect score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upload_fileA
Upload a file from the host filesystem to the container's /app directory.
Makes a file from the host available inside the container for code execution.
The uploaded file can then be accessed in execute_ipython_cell using the
path '/app/{relpath}'.
| Name | Required | Description | Default |
|---|---|---|---|
| local_path | Yes | Absolute path to the source file on host filesystem that will be uploaded | |
| relpath | Yes | Destination path relative to container's /app directory (e.g., 'data/input.csv' saves to /app/data/input.csv) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explains the tool's effect ('makes a file available inside the container') and how the uploaded file can be accessed later, but doesn't cover important behavioral aspects like error conditions (e.g., what happens if the local file doesn't exist), permissions, or whether the operation overwrites existing files. It adds some context but leaves gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with three sentences that each serve a clear purpose: stating the core action, explaining the utility, and providing access instructions. There's no wasted text, and information is front-loaded appropriately for an AI agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (file transfer operation), no annotations, and no output schema, the description provides adequate but incomplete coverage. It explains the basic functionality and integration with execute_ipython_cell, but lacks details about error handling, performance characteristics, or what the tool returns upon completion. It's minimally viable but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents both parameters (local_path and relpath). The description adds minimal value beyond the schema by mentioning the destination path format ('/app/{relpath}'), but doesn't provide additional semantic context like file size limits or supported file types. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('upload a file') and resource ('from the host filesystem to the container's /app directory'), distinguishing it from sibling tools like download_file (reverse operation) and execute_ipython_cell (different function). It provides a concrete purpose beyond just the tool name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('to make a file available inside the container for code execution') and mentions its relationship with execute_ipython_cell for accessing the uploaded file. However, it doesn't provide explicit alternatives or exclusions (e.g., when not to use it vs. other file management tools).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
4 tool updates
v1.0.0- First observed
download_file - First observed
execute_ipython_cell - First observed
reset - First observed
upload_file
TDQS
Each tool has a clearly distinct purpose with no overlap: download_file retrieves files from container to host, execute_ipython_cell runs Python code in a persistent kernel, reset clears kernel state, and upload_file sends files from host to container. The boundaries are unambiguous, preventing agent misselection.
All tool names follow a consistent verb_noun pattern (download_file, execute_ipython_cell, reset, upload_file) with clear, descriptive actions. Reset is a single verb but fits naturally as it describes a clear action without needing a noun, maintaining overall consistency in style and readability.
With 4 tools, the server is well-scoped for its purpose of interactive Python execution in a container. Each tool earns its place by covering essential operations: file transfer (upload/download), code execution, and state management (reset). This count avoids bloat while providing complete workflow coverage.
The tool set provides complete coverage for the domain of container-based IPython execution. It supports the full lifecycle: uploading files, executing code with state persistence, resetting the environment, and downloading results. No obvious gaps exist; agents can perform end-to-end workflows without dead ends.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Run Python code in a secure sandbox without local setup. Declare inline dependencies and execute s…
Execute code in 8 languages (Python, JS, TS, Go, Java, C++, C, Bash) in gVisor sandboxes.
- mcp-serverOAuthai.cdbx
Build Apps and run code in 30 languages — sandboxed, with persistent sessions for agent loops.
Host static HTML pages, generate PDFs, screenshots, scrape JS sites, run sandboxed JavaScript.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceAn interactive Python code execution environment that allows users and LLMs to safely execute Python code and install packages in isolated Docker containers.40Apache 2.0
- FlicenseNot gradedqualityNot gradedmaintenanceA secure server that enables code execution in isolated Docker environments, supporting Python with strict security constraints including network isolation, limited filesystem access, and resource limitations.-
- AlicenseAqualityCmaintenanceEnables code execution in isolated Docker containers with persistent IPython, Node.js, or R kernels, supporting file import/export and cross-session transfers via MCP tools.6MIT
- AlicenseNot gradedqualityDmaintenanceEnables LLMs to safely execute code in isolated Docker containers with resource limits and security controls, supporting session management and automatic dependency installation.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/gradion-ai/ipybox'
If you have feedback or need assistance with the MCP directory API, please join our Discord server