Skip to main content
Glama

microsandbox-mcp

Give your AI agents sandboxes. This MCP server connects any AI agent to microsandbox — letting them create fast lightweight sandboxes, execute code, manage files, and monitor resources.

Documentation | npm Package | GitHub

Installation

Run the server with npx -y microsandbox-mcp using stdio transport.

claude mcp add --transport stdio microsandbox -- npx -y microsandbox-mcp

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "microsandbox": {
      "command": "npx",
      "args": ["-y", "microsandbox-mcp"]
    }
  }
}

Add to .vscode/mcp.json:

{
  "servers": {
    "microsandbox": {
      "command": "npx",
      "args": ["-y", "microsandbox-mcp"]
    }
  }
}

Add to your config file:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "microsandbox": {
      "command": "npx",
      "args": ["-y", "microsandbox-mcp"]
    }
  }
}

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "microsandbox": {
      "command": "npx",
      "args": ["-y", "microsandbox-mcp"]
    }
  }
}

Add to your Zed settings:

{
  "context_servers": {
    "microsandbox": {
      "command": {
        "path": "npx",
        "args": ["-y", "microsandbox-mcp"]
      }
    }
  }
}

For any MCP client that supports stdio transport:

{
  "mcpServers": {
    "microsandbox": {
      "command": "npx",
      "args": ["-y", "microsandbox-mcp"]
    }
  }
}

Related MCP server: py-sandbox

Available Tools

Every tool returns a JSON envelope: { "ok": true, "data": ... } on success or { "ok": false, "error": ... } on failure. Large command output, logs, and file reads are capped by default and include truncation metadata when shortened.

Runtime

Tool

Description

runtime_check

Check whether the microsandbox runtime, msb, and libkrunfw are available

runtime_install

Install runtime dependencies using the microsandbox SDK installer

Sandbox Lifecycle

Tool

Description

sandbox_run

Create an ephemeral sandbox, run a shell command, return output, and remove it

sandbox_create

Create and boot a persistent sandbox with rootfs, resources, process, mounts, patches, network, secrets, and lifecycle options

sandbox_start

Start stopped sandboxes by name, labels, or status selector

sandbox_list

List sandboxes with status, image, labels, and timestamps

sandbox_status

Show status for one sandbox or a filtered sandbox set

sandbox_inspect

Return full configuration and metadata for one sandbox

sandbox_stop

Stop selected sandboxes gracefully or forcefully, with optional timeout

sandbox_drain

Request graceful drain for selected sandboxes

sandbox_wait

Wait until selected sandboxes reach a terminal state

sandbox_remove

Remove selected stopped sandboxes, optionally force-stopping running ones first

Command Execution

Tool

Description

sandbox_exec

Execute an argv command with env, cwd, user, TTY, timeout, rlimits, stdin, and output caps

sandbox_shell

Execute a shell command string with the same execution controls

sandbox_exec_start

Start a long-running command and return an in-memory exec session id

sandbox_exec_poll

Poll output events and exit status for an exec session

sandbox_exec_write_stdin

Write UTF-8 or base64 data to an exec session stdin

sandbox_exec_signal

Send hup, int, term, kill, or a numeric signal to an exec session

sandbox_exec_close

Close and forget an exec session

Logs

Tool

Description

sandbox_logs_read

Read captured logs with tail, time, source, grep, session id, and output cap filters

sandbox_logs_stream

Poll captured logs using cursors and a bounded follow timeout

Filesystem

Tool

Description

sandbox_fs_read

Read a sandbox file as UTF-8 text or base64 bytes

sandbox_fs_write

Write UTF-8 text or base64 bytes to a sandbox file

sandbox_fs_list

List sandbox directory entries

sandbox_fs_mkdir

Create a sandbox directory

sandbox_fs_remove

Remove a sandbox file or directory

sandbox_fs_copy

Copy a file within one sandbox or between two running sandboxes

sandbox_fs_rename

Rename a sandbox file or directory

sandbox_fs_stat

Get sandbox path metadata

sandbox_fs_exists

Check whether a sandbox path exists

sandbox_fs_copy_from_host

Copy an allowlisted host path into a sandbox

sandbox_fs_copy_to_host

Copy a sandbox path to an allowlisted host destination

Metrics

Tool

Description

sandbox_metrics

Get point-in-time metrics for one running sandbox

sandbox_metrics_all

Get point-in-time metrics for all running sandboxes

sandbox_metrics_stream

Collect a bounded number of metrics samples from one sandbox

Volumes

Tool

Description

volume_create

Create a directory or disk-backed named volume with quota, capacity, and labels

volume_list

List named volumes with kind, quota, capacity, usage, disk format, labels, and timestamps

volume_inspect

Inspect one named volume

volume_remove

Remove one or more named volumes

volume_fs_read

Read a volume file as UTF-8 text or base64 bytes

volume_fs_write

Write UTF-8 text or base64 bytes to a volume file

volume_fs_list

List volume directory entries

volume_fs_mkdir

Create a directory inside a volume

volume_fs_remove

Remove a file or directory from a volume

volume_fs_copy

Copy a file inside a volume

volume_fs_rename

Rename a file or directory inside a volume

volume_fs_stat

Get volume path metadata

volume_fs_exists

Check whether a volume path exists

Images

Tool

Description

image_list

List cached images

image_inspect

Inspect cached image config and layers

image_remove

Remove one or more cached images, optionally forced with confirmation

image_prune

Remove cached image artifacts unused by sandboxes, with confirmation

Snapshots

Tool

Description

snapshot_create

Create a named snapshot from a stopped sandbox, optionally into an allowlisted destination directory

snapshot_list

List indexed snapshots

snapshot_inspect

Inspect snapshot metadata by name, digest, or path, optionally verifying integrity

snapshot_verify

Verify recorded snapshot content integrity

snapshot_remove

Remove one or more snapshots, optionally forced with confirmation

snapshot_reindex

Rebuild the local snapshot index

snapshot_save

Save a snapshot to an allowlisted host archive path

snapshot_load

Load a snapshot archive from an allowlisted host path

SSH and SFTP

Tool

Description

sandbox_ssh_exec

Execute a command through the sandbox SSH subsystem

sandbox_sftp_read

Read a file through sandbox SFTP as UTF-8 text or base64 bytes

sandbox_sftp_write

Write UTF-8 text or base64 bytes through sandbox SFTP

sandbox_sftp_mkdir

Create a directory through sandbox SFTP

sandbox_sftp_remove

Remove a file or directory through sandbox SFTP

sandbox_sftp_rename

Rename a path through sandbox SFTP

sandbox_sftp_realpath

Resolve a real path through sandbox SFTP

sandbox_sftp_readlink

Read a symlink target through sandbox SFTP

sandbox_sftp_symlink

Create a symlink through sandbox SFTP

Resources

URI

Description

microsandbox://runtime

Runtime installation status and MCP configuration

microsandbox://sandboxes

Current sandbox inventory

microsandbox://volumes

Current volume inventory

microsandbox://images

Current image cache inventory

microsandbox://snapshots

Current snapshot index

microsandbox://schemas/sandbox-create

JSON Schema for sandbox creation inputs

microsandbox://policy

Effective host path and dangerous-operation policy

Configuration

Env var

Default

Description

MICROSANDBOX_MCP_HOST_PATHS

current working directory

Colon-separated allowlist for bind mounts, host copy, snapshot save/load, and other host path operations

MICROSANDBOX_MCP_HOST_PATH_POLICY

allowlist

Set to unrestricted to allow any host path

MICROSANDBOX_MCP_ENABLE_DANGEROUS

0

Enables future dangerous operations; destructive cache operations still require explicit confirm: true

MICROSANDBOX_MCP_MAX_OUTPUT_BYTES

1048576

Default cap for command output, logs, and file reads

MICROSANDBOX_MCP_DEFAULT_TIMEOUT_MS

120000

Default timeout budget for exec-style operations

MICROSANDBOX_MCP_SESSION_TTL_MS

900000

Idle TTL for in-memory exec sessions

MSB_BACKEND

unset

Explicit backend selection: local or cloud

MSB_PROFILE

unset

Select a named backend profile from ~/.microsandbox/config.json

MSB_API_KEY

unset

API key used after Cloud is selected; does not select Cloud by itself

MSB_API_URL

https://api.microsandbox.dev

Optional endpoint override used after Cloud is selected

MSB_PATH

unset

Optional path to the msb binary for SDK/runtime discovery

MSB_LIBKRUNFW_PATH

unset

Optional path to libkrunfw

Cloud execution is opt-in. Set both MSB_BACKEND=cloud and MSB_API_KEY, or select a cloud profile with MSB_PROFILE/active_profile. Selecting Cloud without a usable credential returns a configuration error and never falls back to the local runtime.

SDK Gaps

The server intentionally stays a thin TypeScript SDK adapter and does not shell out to msb for core behavior. Image pull/load/save, persistent registry login/logout/list, SSH authorization management, and managed SSH serving are not exposed until the TypeScript SDK provides first-class APIs for them. Command aliases (msb install/msb uninstall) and runtime self-update/uninstall are intentionally out of scope.

Requirements

macOS (Apple Silicon) or Linux (x86_64/ARM64 with KVM support).

Use runtime_check to verify whether msb and libkrunfw are available. Use runtime_install to install them from the MCP server. If that fails, install manually:

curl -fsSL https://install.microsandbox.dev | sh

Development

git clone https://github.com/superradcompany/microsandbox-mcp.git
cd microsandbox-mcp
npm install
npm run build
npm test
npm run test:e2e
node dist/index.js

npm run test:e2e launches the built MCP server over stdio and calls every registered tool and resource with live parameters. It creates temporary sandboxes, volumes, snapshots, and host files, then cleans them up. Global image cache deletion is guarded by default; set MICROSANDBOX_MCP_E2E_DESTRUCTIVE_CACHE=1 to let the e2e script run destructive image prune behavior instead of the safe confirmation-error path.

License

Apache-2.0

Available Tools

19 tools
check_installedCheck InstallationA
Read-onlyIdempotent

Verify that msb and libkrunfw are available on the system. Returns installation status. If not installed, the server can attempt to install them.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description states the server can attempt to install if not found, implying a potential mutation. This contradicts annotations (readOnlyHint=true, destructiveHint=false, idempotentHint=true), resulting in a serious inconsistency. Score 1 due to contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences that are front-loaded with the core purpose and follow up with the side effect. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lacks details on the return format (e.g., boolean or object) and the contradiction between the side effect and annotations undermines completeness. Adequate for a simple tool but incomplete due to inconsistency.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters defined, schema coverage is 100%. Description adds value by specifying what is checked (msb and libkrunfw) and the installation fallback, going beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool verifies availability of msb and libkrunfw and returns installation status. It distinguishes itself from all sibling sandbox/volume tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Context is clear: it is a prerequisite check for system components. No sibling tools overlap in purpose, and usage context is implied. However, no explicit when-not or alternative guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_createCreate SandboxA

Create and boot a persistent named sandbox with full configuration. The sandbox stays running until explicitly stopped.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesUnique sandbox name
imageYesOCI image reference (e.g. "python:3.12", "ubuntu:24.04")
cpusNoVirtual CPUs (default: 1)
memoryMibNoMemory in MiB (default: 512)
workdirNoDefault working directory inside the sandbox
envNoEnvironment variables
volumesNoVolume mounts
patchesNoRootfs modifications applied before boot
entrypointNoOverride image entrypoint
hostnameNoGuest hostname
maxDurationNoAuto-stop after N seconds
idleTimeoutNoAuto-stop after N seconds of inactivity

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide only basic hints (not read-only, not idempotent). The description adds that the sandbox boots and persists, but does not disclose side effects like resource consumption, error behavior, or lifecycle details beyond stopping.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words, front-loaded with the core action. Highly concise while covering purpose and key behavioral trait (persistence).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 12 parameters including complex nested objects (volumes, patches) and no output schema. The description is too brief, omitting what the return value is, how to reference the created sandbox, or how 'full configuration' maps to the rich parameter set.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all parameters have descriptions in the schema. The description does not add additional meaning beyond 'full configuration,' so it meets the baseline but provides no extra value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates and boots a persistent sandbox with full configuration. It uses specific verbs ('Create and boot') and distinguishes from sibling tools like sandbox_run or sandbox_exec by emphasizing persistence and full configuration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the sandbox 'stays running until explicitly stopped,' implying use when a persistent sandbox is needed. However, it provides no explicit guidance on when to use alternatives (e.g., sandbox_run for ephemeral tasks) or when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_execExecute Command in SandboxA

Execute a command inside a running sandbox and return stdout/stderr/exit code.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
commandYesCommand to execute
argsNoCommand arguments
cwdNoWorking directory override
envNoAdditional environment variables
timeoutNoTimeout in seconds

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-destructive, non-read-only, non-idempotent. Description adds return format (stdout/stderr/exit code) and confirms execution behavior. No further details on side effects or error states.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence that effectively communicates the tool's function. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters and no output schema, the description is too sparse. Missing details like timeout behavior, error handling, or return value structure. Could be more helpful for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% description coverage; description does not add any new information about parameters beyond what's already in the schema. Baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'execute', resource 'command inside a running sandbox', and output 'stdout/stderr/exit code'. Distinguishes from sibling tools like sandbox_shell or sandbox_run.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives. No prerequisites mentioned (e.g., sandbox must be running). No exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_fs_listList Directory in SandboxB
Read-onlyIdempotent

List directory contents inside the sandbox.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
pathYesDirectory path to list

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true and idempotentHint=true, so the description does not need to restate those. However, it adds no extra behavioral details such as sorting order, inclusion of hidden files, or whether the listing is recursive. With high annotation coverage, the description fails to provide value beyond the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence that immediately conveys the tool's purpose. Every word is necessary, and there is no redundancy or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the operation and the presence of annotations and schema coverage, the description is minimally adequate. However, it lacks details about listing behavior (e.g., hidden files, sorting, error handling) that would help an agent handle edge cases. A more complete description would mention these aspects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema fully describes both parameters ('Sandbox name' and 'Directory path to list') with 100% coverage. The description adds no additional meaning beyond the schema, meeting the baseline expectation for a parameter description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (List), the resource (directory contents), and the scope (inside the sandbox). This distinct purpose separates it from sibling tools like sandbox_fs_read (reads file content) or sandbox_fs_stat (file metadata).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool vs alternatives (e.g., sandbox_fs_stat for single file info). There is no mention of prerequisites (e.g., sandbox must exist) or what happens if the path does not exist (e.g., error vs empty list). The agent must infer usage from the name and parameters.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_fs_mkdirCreate Directory in SandboxA
Idempotent

Create a directory with parent directories inside the sandbox.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
pathYesDirectory path to create

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate idempotentHint=true and readOnlyHint=false. The description adds the behavior of creating parent directories, which is non-obvious. However, it does not clarify behavior if the directory already exists or error handling, leaving some ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence that is front-loaded with the core action and key detail (parent directories). No redundant or extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple mkdir tool, the description covers the primary functionality and the important parent-directory behavior. Lacks details on return values, error conditions, or restrictions (e.g., path length, characters), but these are relatively minor for a basic creation operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for both parameters. The tool description does not add any additional meaning or constraints beyond what the schema provides, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Create a directory with parent directories inside the sandbox' specifies the action (create directory) and adds the critical detail of parent directory creation, which distinguishes it from other file system tools like sandbox_fs_remove or sandbox_fs_write.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like sandbox_fs_write or shell commands. No mention of prerequisites (e.g., sandbox existence) or scenarios where mkdir might not be appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_fs_readRead File from SandboxA
Read-onlyIdempotent

Read a file from the sandbox filesystem and return its contents as text.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
pathYesAbsolute path inside the sandbox

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, covering safety. The description adds that it returns contents as text, but lacks details on encoding, size limits, or error handling. Adds minimal value beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, direct, no wasted words. Front-loaded with verb and resource. Efficiently structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given low complexity (2 required params, no output schema), the description adequately explains the operation and return value as text. Missing edge cases or format details, but sufficient for a simple read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with both 'name' and 'path' described in schema. The description does not add any additional meaning beyond what the schema already provides, achieving baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Read', the resource 'file from the sandbox filesystem', and the output 'return its contents as text'. It distinguishes from siblings like sandbox_fs_list (list) and sandbox_fs_stat (stats).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for reading text files but does not explicitly state when to use vs alternatives like sandbox_fs_stat or sandbox_fs_list. No when-not-to or alternative tool guidance provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_fs_removeRemove File or Directory in SandboxC
DestructiveIdempotent

Remove a file or directory inside the sandbox.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
pathYesPath to remove

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint and idempotentHint. The description adds little beyond restating the action; it does not disclose error handling, recursion behavior, or permission requirements, which are important for a destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short and to the point, with no wasted words. However, it may be too concise, missing essential details like recursion behavior for directories.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple tool and absence of output schema, the description still lacks key behavioral details (recursion, error handling, behavior on non-existent paths), making it incomplete for an agent to use reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters. The description adds minimal context beyond what the schema provides, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool removes a file or directory inside the sandbox, using a specific verb and resource. However, it does not explicitly mention recursive removal for directories, which could be a gap in clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., sandbox_fs_write, sandbox_remove). It lacks any context about prerequisites or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_fs_statGet File Metadata in SandboxA
Read-onlyIdempotent

Get file or directory metadata (kind, size, mode, modified time) inside the sandbox.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
pathYesPath to stat

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds value by listing the specific metadata fields returned, but does not disclose error behavior (e.g., what happens if path does not exist). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no redundant words. It front-loads the key action and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple stat tool with full schema coverage and annotations, the description adequately explains what the tool returns (metadata fields) and the context (inside the sandbox). No output schema is needed as the return is straightforward.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters. The description does not add additional meaning beyond what is in the schema (e.g., format, constraints, or examples).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get', the resource 'file or directory metadata', and specifies the metadata fields (kind, size, mode, modified time). It effectively distinguishes from sibling tools like sandbox_fs_list or sandbox_fs_read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for retrieving metadata, but it does not explicitly state when to use it over alternatives such as sandbox_fs_list for listing contents or sandbox_fs_read for reading data. No guidance on prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_fs_writeWrite File to SandboxA
Idempotent

Write content to a file inside the sandbox. Creates parent directories as needed.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
pathYesAbsolute path inside the sandbox
contentYesFile content to write

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false, destructiveHint=false, idempotentHint=true. Description adds that parent directories are created as needed, which is a useful behavioral detail. However, it does not disclose overwrite behavior, file size limits, or encoding. Given annotations provide the safety profile, the description adds moderate value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words. First sentence states the primary purpose; second adds a crucial behavioral note. Front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple write tool with three required parameters and no output schema, the description covers the core action and a key behavioral detail (directory creation). It could mention overwrite behavior or content handling, but the provided context is largely sufficient given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters are described in the schema (100% coverage), earning a baseline of 3. The description adds that 'Creates parent directories as needed', which clarifies the effect of the 'path' parameter beyond its schema description ('Absolute path inside the sandbox'). This extra context elevates the score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'write content to a file inside the sandbox', specifying verb and resource. It also mentions creating parent directories, which adds specificity. However, it does not explicitly differentiate from sibling tools like sandbox_fs_mkdir or sandbox_fs_read, so it loses a point for missing sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool over alternatives. For example, it does not explain that it can overwrite files, or that it is suitable for both creating and updating files. Lacks any 'when not to use' or reference to sibling tools like sandbox_fs_mkdir for directory creation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_inspectInspect SandboxA
Read-onlyIdempotent

Get detailed information about a specific sandbox including full configuration.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, so the description adds minimal behavioral context beyond stating it returns full configuration. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the key action and resource. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one simple parameter, strong annotations, and no output schema, the description adequately covers the purpose but could benefit from noting the return format or typical use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'name' with description 'Sandbox name'. The description does not add further semantics or format details, so the schema carries the full weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Get' and specifies the resource 'detailed information about a specific sandbox including full configuration', clearly distinguishing it from list tools like sandbox_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidelines are provided; the description does not mention when to use this tool versus alternatives (e.g., sandbox_list for an overview). The agent must infer from sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_listList SandboxesA
Read-onlyIdempotent

List all sandboxes with their status.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, destructiveHint, and idempotentHint. The description adds minor context ('with their status') but does not disclose other behavioral traits like pagination or order.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, succinct sentence with no unnecessary words. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and no output schema, the description is mostly complete. It could potentially mention the return format, but for a simple list tool, it is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, and the schema coverage is 100%. Following guidelines, a baseline of 4 is appropriate as no parameter explanation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (List), the resource (sandboxes), and the detail included (their status). It effectively distinguishes from sibling tools like sandbox_create or sandbox_remove.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool over alternatives. However, due to the tool's simplicity (listing all sandboxes) and distinct name, the usage context is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_metricsGet Sandbox MetricsA
Read-onlyIdempotent

Get live resource usage metrics (CPU, memory, disk, network) for a running sandbox.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds the context of 'live' metrics, but annotations already indicate read-only and idempotent behavior; no significant additional behavioral disclosure beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence of 13 words, front-loaded with the key action and resource, with no unnecessary details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple input schema (one required param) and no output schema, the description adequately lists the types of metrics returned, though it omits format or granularity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single 'name' parameter described as 'Sandbox name'; the description adds no extra semantic value beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'live resource usage metrics (CPU, memory, disk, network)' for a running sandbox, distinguishing it from sibling tools like sandbox_inspect.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for monitoring a sandbox's real-time metrics but does not explicitly state when to use it or provide alternatives like sandbox_inspect for status details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_removeRemove SandboxA
DestructiveIdempotent

Remove a sandbox. Must be stopped unless force is true.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
forceNoStop and remove in one step if still running

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive and idempotent behavior. The description adds the important pre-condition about stopping the sandbox, enhancing transparency beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two short sentences, no unnecessary words, and front-loads the key purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple removal tool, the description covers the essential behavior. It lacks details on permanence and return values, but given the low complexity and no output schema, it is adequately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are documented. The description adds value by explaining the condition for using the force parameter, which complements the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Remove' and the resource 'sandbox', effectively distinguishing it from sibling tools like sandbox_create and sandbox_stop.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance: sandbox must be stopped unless force is true. However, it does not explicitly mention when not to use the tool or suggest alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_runRun Command in Ephemeral SandboxA

Create an ephemeral sandbox, run a shell command, return the output, and destroy the sandbox. Best for quick one-off tasks like running a script, checking a command, or testing code.

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYesOCI image (e.g. "python:3.12", "node:22", "alpine")
commandYesShell command to execute
memoryMibNoMemory in MiB (default: 512)
cpusNoNumber of vCPUs (default: 1)
envNoEnvironment variables

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds context beyond annotations by explaining the full lifecycle (create, run, destroy) and that the sandbox is ephemeral. Annotations only show non-readOnly, non-destructive, and non-idempotent, which aligns with the description's intent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, concise, and front-loaded with the core action. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains the tool's purpose and lifecycle holistically. Given no output schema, it could mention that the output is returned as a single string, but the context is adequate for a combined operation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all parameters with descriptions (100% coverage), so the description does not need to add detail. It adds no additional semantics but is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it creates an ephemeral sandbox, runs a command, returns output, and destroys it. This distinguishes it from sibling tools that require separate create/exec steps, but does not explicitly mention those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says 'Best for quick one-off tasks' with examples, providing guidance on when to use. However, it does not specify when not to use this tool (e.g., for repeated commands, sandbox_shell might be better) or mention alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_shellRun Shell Command in SandboxA

Execute a shell command or script string inside a running sandbox. Interprets pipes, redirects, and shell syntax.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
commandYesShell command or script to execute
timeoutNoTimeout in seconds

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate non-read-only and non-destructive behavior. The description adds context about shell interpretation but does not disclose potential side effects, resource limits, or authentication requirements beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two sentences, front-loading the purpose and adding a key behavioral detail. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no output schema, the description covers the execution function but omits return value format (stdout/stderr) and timeout behavior, which are relevant for an execution tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all three parameters. The description adds no further meaning beyond the schema, only noting shell syntax interpretation which relates to the command parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'execute' and resource 'shell command or script string inside a running sandbox'. It adds specific detail about interpreting pipes, redirects, and shell syntax, which distinguishes it from sibling tools like sandbox_exec that may not have full shell interpretation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly suggests use for shell commands with syntax, but it does not explicitly state when to use this tool versus alternatives (e.g., sandbox_exec for simpler commands) nor provides any when-not conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sandbox_stopStop SandboxA
Destructive

Stop a running sandbox. Use force to kill with SIGKILL instead of graceful SIGTERM.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesSandbox name
forceNoForce kill with SIGKILL instead of graceful SIGTERM

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive and non-readonly nature. The description adds valuable detail about signal types (SIGKILL vs SIGTERM), which goes beyond annotations. Minor gap: no mention of side effects or state changes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the main action and immediate detail. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two parameters and no output schema, the description covers both parameters and behavioral options. It is fully adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds meaning to the force parameter by explaining the signal distinction, exceeding schema but not fully compensating for lack of deeper parameter context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Stop' and resource 'running sandbox', distinguishing it from sibling tools like sandbox_create or sandbox_remove. It's specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the force parameter (SIGKILL vs SIGTERM), but does not explicitly contrast with other tools like sandbox_remove or provide exclusion criteria. However, the context is clear for this simple operation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_createCreate VolumeA

Create a named persistent volume. Volumes survive sandbox restarts and can be shared across sandboxes.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesVolume name
sizeMibNoQuota in MiB

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate mutation (readOnlyHint=false), and the description adds that volumes are persistent and shareable. However, it fails to disclose any side effects, required permissions, or whether the operation is reversible.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the primary action, and contains no extraneous information. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description misses information about the return value (e.g., volume ID or status). It adequately covers the tool's core purpose but lacks complete behavioral context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage, the schema already documents both parameters. The description adds no extra semantic context beyond the schema, such as naming conventions or size unit implications.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates a named persistent volume, and highlights key features (survives restarts, shareable) that distinguish it from sibling tools like volume_list or volume_remove.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (when you need a persistent volume) but does not explicitly state when to avoid or mention alternatives. No 'when not' guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_listList VolumesA
Read-onlyIdempotent

List all named volumes.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, destructiveHint, and idempotentHint. The description adds no further behavioral context but does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, concise and front-loaded. Every word is necessary and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no output schema, the description is minimal. It states what it does but omits details like return format or scope, making it barely adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema provides full coverage. Baseline is 4, and the description adds no extra parameter meaning but is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('named volumes') clearly. It distinguishes from sibling tools like volume_create and volume_remove, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description does not specify context, prerequisites, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_removeRemove VolumeB
DestructiveIdempotent

Remove a named volume.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesVolume name

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate destructiveHint=true, but the description adds no additional behavioral context (e.g., what happens if volume is in use). The description relies on annotations without elaboration.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence efficiently conveys the core functionality with no waste. Slightly more structure (e.g., hinting at idempotency) could improve, but it is appropriate for a simple operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for a simple tool with one parameter and annotations. However, it lacks usage guidelines and behavioral details, leaving some gaps for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and parameter description is succinct. The tool description adds no new meaning beyond the schema, which is acceptable given full coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Remove') and the resource ('a named volume'). It distinguishes from sibling tools like volume_create and volume_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. No context about prerequisites or consequences is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 19 tool updatesv0.4.6
    • First observedcheck_installed
    • First observedsandbox_create
    • First observedsandbox_exec
    • First observedsandbox_fs_list
    • First observedsandbox_fs_mkdir
    • First observedsandbox_fs_read
    • First observedsandbox_fs_remove
    • First observedsandbox_fs_stat
    • First observedsandbox_fs_write
    • First observedsandbox_inspect
    • First observedsandbox_list
    • First observedsandbox_metrics
    • First observedsandbox_remove
    • First observedsandbox_run
    • First observedsandbox_shell
    • First observedsandbox_stop
    • First observedvolume_create
    • First observedvolume_list
    • First observedvolume_remove

TDQS

A3.8/5.0
Disambiguation5/5

Each tool targets a distinct operation with clear prefixes (sandbox_, volume_, check_installed). The subtle overlap between sandbox_exec and sandbox_shell is resolved by their descriptions (command vs shell syntax).

Naming Consistency5/5

All tool names follow a consistent verb_pattern: sandbox_<action> for sandbox tools, volume_<action> for volume tools, and check_installed conforms to verb_noun. No mixing of conventions.

Tool Count4/5

19 tools cover sandbox lifecycle, filesystem operations, and volume management comprehensively. While slightly above the typical 3-15 range, the count is justified by the breadth of functionality.

Completeness5/5

The tool set covers the full sandbox lifecycle (create, run, exec, shell, stop, remove), filesystem operations, monitoring via metrics, and volume management. No obvious gaps for the domain.

Maintenance

ActivityActive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to execute arbitrary Python code securely in a sandboxed environment with resource limits and security constraints via MCP protocol.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to create, manage, and execute code in isolated Firecracker microVM sandboxes via the MCP protocol, with support for sandbox lifecycle and file operations.
    2
    Apache 2.0
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to safely execute Python, JavaScript, and Bash code in an isolated Docker sandbox with strict security constraints.
    1
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/superradcompany/microsandbox-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server