microsandbox-mcp
This server enables AI agents to create and manage lightweight microVM sandboxes with the following capabilities:
Sandbox lifecycle: Create ephemeral or persistent sandboxes with configurable CPU, memory, and OCI images; start, stop, list, inspect, wait, drain, and remove sandboxes.
Command execution: Run arbitrary commands or shell scripts inside sandboxes with support for environment variables, working directory, timeouts, I/O control, and long-running interactive sessions.
Filesystem operations: Read, write, list, create, remove, rename, stat, and copy files/directories within sandboxes; copy files between host and sandbox.
Volume management: Create, list, inspect, and remove named persistent volumes; perform filesystem operations (read, write, list, mkdir, remove, copy, rename, stat) on volume contents.
Resource monitoring: Obtain point-in-time or streamed metrics (CPU, memory, disk, network) for running sandboxes.
Logging: Read and stream captured logs from sandboxes with filtering options.
Image management: List, inspect, remove, and prune cached OCI images.
Snapshot management: Create, list, inspect, verify, remove, save, and load snapshots of stopped sandboxes.
Remote access: Execute commands and transfer files via SSH/SFTP within sandboxes.
Runtime management: Check for required dependencies (
msb,libkrunfw) and install them.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@microsandbox-mcprun python3 -c 'print(42)' in a sandbox"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
microsandbox-mcp
Give your AI agents sandboxes. This MCP server connects any AI agent to microsandbox — letting them create fast lightweight sandboxes, execute code, manage files, and monitor resources.
Documentation | npm Package | GitHub
Installation
Run the server with npx -y microsandbox-mcp using stdio transport.
claude mcp add --transport stdio microsandbox -- npx -y microsandbox-mcpAdd to ~/.cursor/mcp.json:
{
"mcpServers": {
"microsandbox": {
"command": "npx",
"args": ["-y", "microsandbox-mcp"]
}
}
}Add to .vscode/mcp.json:
{
"servers": {
"microsandbox": {
"command": "npx",
"args": ["-y", "microsandbox-mcp"]
}
}
}Add to your config file:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"microsandbox": {
"command": "npx",
"args": ["-y", "microsandbox-mcp"]
}
}
}Add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"microsandbox": {
"command": "npx",
"args": ["-y", "microsandbox-mcp"]
}
}
}Add to your Zed settings:
{
"context_servers": {
"microsandbox": {
"command": {
"path": "npx",
"args": ["-y", "microsandbox-mcp"]
}
}
}
}For any MCP client that supports stdio transport:
{
"mcpServers": {
"microsandbox": {
"command": "npx",
"args": ["-y", "microsandbox-mcp"]
}
}
}Related MCP server: py-sandbox
Available Tools
Every tool returns a JSON envelope: { "ok": true, "data": ... } on success or { "ok": false, "error": ... } on failure. Large command output, logs, and file reads are capped by default and include truncation metadata when shortened.
Runtime
Tool | Description |
| Check whether the microsandbox runtime, |
| Install runtime dependencies using the microsandbox SDK installer |
Sandbox Lifecycle
Tool | Description |
| Create an ephemeral sandbox, run a shell command, return output, and remove it |
| Create and boot a persistent sandbox with rootfs, resources, process, mounts, patches, network, secrets, and lifecycle options |
| Start stopped sandboxes by name, labels, or status selector |
| List sandboxes with status, image, labels, and timestamps |
| Show status for one sandbox or a filtered sandbox set |
| Return full configuration and metadata for one sandbox |
| Stop selected sandboxes gracefully or forcefully, with optional timeout |
| Request graceful drain for selected sandboxes |
| Wait until selected sandboxes reach a terminal state |
| Remove selected stopped sandboxes, optionally force-stopping running ones first |
Command Execution
Tool | Description |
| Execute an argv command with env, cwd, user, TTY, timeout, rlimits, stdin, and output caps |
| Execute a shell command string with the same execution controls |
| Start a long-running command and return an in-memory exec session id |
| Poll output events and exit status for an exec session |
| Write UTF-8 or base64 data to an exec session stdin |
| Send |
| Close and forget an exec session |
Logs
Tool | Description |
| Read captured logs with tail, time, source, grep, session id, and output cap filters |
| Poll captured logs using cursors and a bounded follow timeout |
Filesystem
Tool | Description |
| Read a sandbox file as UTF-8 text or base64 bytes |
| Write UTF-8 text or base64 bytes to a sandbox file |
| List sandbox directory entries |
| Create a sandbox directory |
| Remove a sandbox file or directory |
| Copy a file within one sandbox or between two running sandboxes |
| Rename a sandbox file or directory |
| Get sandbox path metadata |
| Check whether a sandbox path exists |
| Copy an allowlisted host path into a sandbox |
| Copy a sandbox path to an allowlisted host destination |
Metrics
Tool | Description |
| Get point-in-time metrics for one running sandbox |
| Get point-in-time metrics for all running sandboxes |
| Collect a bounded number of metrics samples from one sandbox |
Volumes
Tool | Description |
| Create a directory or disk-backed named volume with quota, capacity, and labels |
| List named volumes with kind, quota, capacity, usage, disk format, labels, and timestamps |
| Inspect one named volume |
| Remove one or more named volumes |
| Read a volume file as UTF-8 text or base64 bytes |
| Write UTF-8 text or base64 bytes to a volume file |
| List volume directory entries |
| Create a directory inside a volume |
| Remove a file or directory from a volume |
| Copy a file inside a volume |
| Rename a file or directory inside a volume |
| Get volume path metadata |
| Check whether a volume path exists |
Images
Tool | Description |
| List cached images |
| Inspect cached image config and layers |
| Remove one or more cached images, optionally forced with confirmation |
| Remove cached image artifacts unused by sandboxes, with confirmation |
Snapshots
Tool | Description |
| Create a named snapshot from a stopped sandbox, optionally into an allowlisted destination directory |
| List indexed snapshots |
| Inspect snapshot metadata by name, digest, or path, optionally verifying integrity |
| Verify recorded snapshot content integrity |
| Remove one or more snapshots, optionally forced with confirmation |
| Rebuild the local snapshot index |
| Save a snapshot to an allowlisted host archive path |
| Load a snapshot archive from an allowlisted host path |
SSH and SFTP
Tool | Description |
| Execute a command through the sandbox SSH subsystem |
| Read a file through sandbox SFTP as UTF-8 text or base64 bytes |
| Write UTF-8 text or base64 bytes through sandbox SFTP |
| Create a directory through sandbox SFTP |
| Remove a file or directory through sandbox SFTP |
| Rename a path through sandbox SFTP |
| Resolve a real path through sandbox SFTP |
| Read a symlink target through sandbox SFTP |
| Create a symlink through sandbox SFTP |
Resources
URI | Description |
| Runtime installation status and MCP configuration |
| Current sandbox inventory |
| Current volume inventory |
| Current image cache inventory |
| Current snapshot index |
| JSON Schema for sandbox creation inputs |
| Effective host path and dangerous-operation policy |
Configuration
Env var | Default | Description |
| current working directory | Colon-separated allowlist for bind mounts, host copy, snapshot save/load, and other host path operations |
|
| Set to |
|
| Enables future dangerous operations; destructive cache operations still require explicit |
|
| Default cap for command output, logs, and file reads |
|
| Default timeout budget for exec-style operations |
|
| Idle TTL for in-memory exec sessions |
| unset | Explicit backend selection: |
| unset | Select a named backend profile from |
| unset | API key used after Cloud is selected; does not select Cloud by itself |
|
| Optional endpoint override used after Cloud is selected |
| unset | Optional path to the |
| unset | Optional path to |
Cloud execution is opt-in. Set both MSB_BACKEND=cloud and MSB_API_KEY, or select a cloud profile with MSB_PROFILE/active_profile. Selecting Cloud without a usable credential returns a configuration error and never falls back to the local runtime.
SDK Gaps
The server intentionally stays a thin TypeScript SDK adapter and does not shell out to msb for core behavior. Image pull/load/save, persistent registry login/logout/list, SSH authorization management, and managed SSH serving are not exposed until the TypeScript SDK provides first-class APIs for them. Command aliases (msb install/msb uninstall) and runtime self-update/uninstall are intentionally out of scope.
Requirements
macOS (Apple Silicon) or Linux (x86_64/ARM64 with KVM support).
Use runtime_check to verify whether msb and libkrunfw are available. Use runtime_install to install them from the MCP server. If that fails, install manually:
curl -fsSL https://install.microsandbox.dev | shDevelopment
git clone https://github.com/superradcompany/microsandbox-mcp.git
cd microsandbox-mcp
npm install
npm run build
npm test
npm run test:e2e
node dist/index.jsnpm run test:e2e launches the built MCP server over stdio and calls every registered tool and resource with live parameters. It creates temporary sandboxes, volumes, snapshots, and host files, then cleans them up. Global image cache deletion is guarded by default; set MICROSANDBOX_MCP_E2E_DESTRUCTIVE_CACHE=1 to let the e2e script run destructive image prune behavior instead of the safe confirmation-error path.
Links
microsandbox — The microVM sandbox runtime
Documentation — Guides and API reference
Agent Skills — Teach agents to use microsandbox without MCP
License
Apache-2.0
Available Tools
19 toolscheck_installedCheck InstallationARead-onlyIdempotent
Verify that msb and libkrunfw are available on the system. Returns installation status. If not installed, the server can attempt to install them.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description states the server can attempt to install if not found, implying a potential mutation. This contradicts annotations (readOnlyHint=true, destructiveHint=false, idempotentHint=true), resulting in a serious inconsistency. Score 1 due to contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that are front-loaded with the core purpose and follow up with the side effect. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lacks details on the return format (e.g., boolean or object) and the contradiction between the side effect and annotations undermines completeness. Adequate for a simple tool but incomplete due to inconsistency.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters defined, schema coverage is 100%. Description adds value by specifying what is checked (msb and libkrunfw) and the installation fallback, going beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool verifies availability of msb and libkrunfw and returns installation status. It distinguishes itself from all sibling sandbox/volume tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Context is clear: it is a prerequisite check for system components. No sibling tools overlap in purpose, and usage context is implied. However, no explicit when-not or alternative guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_createCreate SandboxA
Create and boot a persistent named sandbox with full configuration. The sandbox stays running until explicitly stopped.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Unique sandbox name | |
| image | Yes | OCI image reference (e.g. "python:3.12", "ubuntu:24.04") | |
| cpus | No | Virtual CPUs (default: 1) | |
| memoryMib | No | Memory in MiB (default: 512) | |
| workdir | No | Default working directory inside the sandbox | |
| env | No | Environment variables | |
| volumes | No | Volume mounts | |
| patches | No | Rootfs modifications applied before boot | |
| entrypoint | No | Override image entrypoint | |
| hostname | No | Guest hostname | |
| maxDuration | No | Auto-stop after N seconds | |
| idleTimeout | No | Auto-stop after N seconds of inactivity |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide only basic hints (not read-only, not idempotent). The description adds that the sandbox boots and persists, but does not disclose side effects like resource consumption, error behavior, or lifecycle details beyond stopping.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words, front-loaded with the core action. Highly concise while covering purpose and key behavioral trait (persistence).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 12 parameters including complex nested objects (volumes, patches) and no output schema. The description is too brief, omitting what the return value is, how to reference the created sandbox, or how 'full configuration' maps to the rich parameter set.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all parameters have descriptions in the schema. The description does not add additional meaning beyond 'full configuration,' so it meets the baseline but provides no extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates and boots a persistent sandbox with full configuration. It uses specific verbs ('Create and boot') and distinguishes from sibling tools like sandbox_run or sandbox_exec by emphasizing persistence and full configuration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions the sandbox 'stays running until explicitly stopped,' implying use when a persistent sandbox is needed. However, it provides no explicit guidance on when to use alternatives (e.g., sandbox_run for ephemeral tasks) or when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_execExecute Command in SandboxA
Execute a command inside a running sandbox and return stdout/stderr/exit code.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| command | Yes | Command to execute | |
| args | No | Command arguments | |
| cwd | No | Working directory override | |
| env | No | Additional environment variables | |
| timeout | No | Timeout in seconds |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare non-destructive, non-read-only, non-idempotent. Description adds return format (stdout/stderr/exit code) and confirms execution behavior. No further details on side effects or error states.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that effectively communicates the tool's function. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters and no output schema, the description is too sparse. Missing details like timeout behavior, error handling, or return value structure. Could be more helpful for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% description coverage; description does not add any new information about parameters beyond what's already in the schema. Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'execute', resource 'command inside a running sandbox', and output 'stdout/stderr/exit code'. Distinguishes from sibling tools like sandbox_shell or sandbox_run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. No prerequisites mentioned (e.g., sandbox must be running). No exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_fs_listList Directory in SandboxBRead-onlyIdempotent
List directory contents inside the sandbox.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| path | Yes | Directory path to list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true and idempotentHint=true, so the description does not need to restate those. However, it adds no extra behavioral details such as sorting order, inclusion of hidden files, or whether the listing is recursive. With high annotation coverage, the description fails to provide value beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that immediately conveys the tool's purpose. Every word is necessary, and there is no redundancy or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the operation and the presence of annotations and schema coverage, the description is minimally adequate. However, it lacks details about listing behavior (e.g., hidden files, sorting, error handling) that would help an agent handle edge cases. A more complete description would mention these aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully describes both parameters ('Sandbox name' and 'Directory path to list') with 100% coverage. The description adds no additional meaning beyond the schema, meeting the baseline expectation for a parameter description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (List), the resource (directory contents), and the scope (inside the sandbox). This distinct purpose separates it from sibling tools like sandbox_fs_read (reads file content) or sandbox_fs_stat (file metadata).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives (e.g., sandbox_fs_stat for single file info). There is no mention of prerequisites (e.g., sandbox must exist) or what happens if the path does not exist (e.g., error vs empty list). The agent must infer usage from the name and parameters.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_fs_mkdirCreate Directory in SandboxAIdempotent
Create a directory with parent directories inside the sandbox.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| path | Yes | Directory path to create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate idempotentHint=true and readOnlyHint=false. The description adds the behavior of creating parent directories, which is non-obvious. However, it does not clarify behavior if the directory already exists or error handling, leaving some ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is front-loaded with the core action and key detail (parent directories). No redundant or extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple mkdir tool, the description covers the primary functionality and the important parent-directory behavior. Lacks details on return values, error conditions, or restrictions (e.g., path length, characters), but these are relatively minor for a basic creation operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The tool description does not add any additional meaning or constraints beyond what the schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Create a directory with parent directories inside the sandbox' specifies the action (create directory) and adds the critical detail of parent directory creation, which distinguishes it from other file system tools like sandbox_fs_remove or sandbox_fs_write.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like sandbox_fs_write or shell commands. No mention of prerequisites (e.g., sandbox existence) or scenarios where mkdir might not be appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_fs_readRead File from SandboxARead-onlyIdempotent
Read a file from the sandbox filesystem and return its contents as text.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| path | Yes | Absolute path inside the sandbox |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, covering safety. The description adds that it returns contents as text, but lacks details on encoding, size limits, or error handling. Adds minimal value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, direct, no wasted words. Front-loaded with verb and resource. Efficiently structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given low complexity (2 required params, no output schema), the description adequately explains the operation and return value as text. Missing edge cases or format details, but sufficient for a simple read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with both 'name' and 'path' described in schema. The description does not add any additional meaning beyond what the schema already provides, achieving baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read', the resource 'file from the sandbox filesystem', and the output 'return its contents as text'. It distinguishes from siblings like sandbox_fs_list (list) and sandbox_fs_stat (stats).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for reading text files but does not explicitly state when to use vs alternatives like sandbox_fs_stat or sandbox_fs_list. No when-not-to or alternative tool guidance provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_fs_removeRemove File or Directory in SandboxCDestructiveIdempotent
Remove a file or directory inside the sandbox.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| path | Yes | Path to remove |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint and idempotentHint. The description adds little beyond restating the action; it does not disclose error handling, recursion behavior, or permission requirements, which are important for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and to the point, with no wasted words. However, it may be too concise, missing essential details like recursion behavior for directories.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool and absence of output schema, the description still lacks key behavioral details (recursion, error handling, behavior on non-existent paths), making it incomplete for an agent to use reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters. The description adds minimal context beyond what the schema provides, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool removes a file or directory inside the sandbox, using a specific verb and resource. However, it does not explicitly mention recursive removal for directories, which could be a gap in clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., sandbox_fs_write, sandbox_remove). It lacks any context about prerequisites or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_fs_statGet File Metadata in SandboxARead-onlyIdempotent
Get file or directory metadata (kind, size, mode, modified time) inside the sandbox.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| path | Yes | Path to stat |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds value by listing the specific metadata fields returned, but does not disclose error behavior (e.g., what happens if path does not exist). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no redundant words. It front-loads the key action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple stat tool with full schema coverage and annotations, the description adequately explains what the tool returns (metadata fields) and the context (inside the sandbox). No output schema is needed as the return is straightforward.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents both parameters. The description does not add additional meaning beyond what is in the schema (e.g., format, constraints, or examples).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get', the resource 'file or directory metadata', and specifies the metadata fields (kind, size, mode, modified time). It effectively distinguishes from sibling tools like sandbox_fs_list or sandbox_fs_read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for retrieving metadata, but it does not explicitly state when to use it over alternatives such as sandbox_fs_list for listing contents or sandbox_fs_read for reading data. No guidance on prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_fs_writeWrite File to SandboxAIdempotent
Write content to a file inside the sandbox. Creates parent directories as needed.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| path | Yes | Absolute path inside the sandbox | |
| content | Yes | File content to write |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false, destructiveHint=false, idempotentHint=true. Description adds that parent directories are created as needed, which is a useful behavioral detail. However, it does not disclose overwrite behavior, file size limits, or encoding. Given annotations provide the safety profile, the description adds moderate value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words. First sentence states the primary purpose; second adds a crucial behavioral note. Front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple write tool with three required parameters and no output schema, the description covers the core action and a key behavioral detail (directory creation). It could mention overwrite behavior or content handling, but the provided context is largely sufficient given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters are described in the schema (100% coverage), earning a baseline of 3. The description adds that 'Creates parent directories as needed', which clarifies the effect of the 'path' parameter beyond its schema description ('Absolute path inside the sandbox'). This extra context elevates the score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'write content to a file inside the sandbox', specifying verb and resource. It also mentions creating parent directories, which adds specificity. However, it does not explicitly differentiate from sibling tools like sandbox_fs_mkdir or sandbox_fs_read, so it loses a point for missing sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool over alternatives. For example, it does not explain that it can overwrite files, or that it is suitable for both creating and updating files. Lacks any 'when not to use' or reference to sibling tools like sandbox_fs_mkdir for directory creation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_inspectInspect SandboxARead-onlyIdempotent
Get detailed information about a specific sandbox including full configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, so the description adds minimal behavioral context beyond stating it returns full configuration. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the key action and resource. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With one simple parameter, strong annotations, and no output schema, the description adequately covers the purpose but could benefit from noting the return format or typical use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter 'name' with description 'Sandbox name'. The description does not add further semantics or format details, so the schema carries the full weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Get' and specifies the resource 'detailed information about a specific sandbox including full configuration', clearly distinguishing it from list tools like sandbox_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidelines are provided; the description does not mention when to use this tool versus alternatives (e.g., sandbox_list for an overview). The agent must infer from sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_listList SandboxesARead-onlyIdempotent
List all sandboxes with their status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, destructiveHint, and idempotentHint. The description adds minor context ('with their status') but does not disclose other behavioral traits like pagination or order.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, succinct sentence with no unnecessary words. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and no output schema, the description is mostly complete. It could potentially mention the return format, but for a simple list tool, it is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, and the schema coverage is 100%. Following guidelines, a baseline of 4 is appropriate as no parameter explanation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (List), the resource (sandboxes), and the detail included (their status). It effectively distinguishes from sibling tools like sandbox_create or sandbox_remove.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool over alternatives. However, due to the tool's simplicity (listing all sandboxes) and distinct name, the usage context is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_metricsGet Sandbox MetricsARead-onlyIdempotent
Get live resource usage metrics (CPU, memory, disk, network) for a running sandbox.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds the context of 'live' metrics, but annotations already indicate read-only and idempotent behavior; no significant additional behavioral disclosure beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence of 13 words, front-loaded with the key action and resource, with no unnecessary details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema (one required param) and no output schema, the description adequately lists the types of metrics returned, though it omits format or granularity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single 'name' parameter described as 'Sandbox name'; the description adds no extra semantic value beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'live resource usage metrics (CPU, memory, disk, network)' for a running sandbox, distinguishing it from sibling tools like sandbox_inspect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for monitoring a sandbox's real-time metrics but does not explicitly state when to use it or provide alternatives like sandbox_inspect for status details.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_removeRemove SandboxADestructiveIdempotent
Remove a sandbox. Must be stopped unless force is true.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| force | No | Stop and remove in one step if still running |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and idempotent behavior. The description adds the important pre-condition about stopping the sandbox, enhancing transparency beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two short sentences, no unnecessary words, and front-loads the key purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple removal tool, the description covers the essential behavior. It lacks details on permanence and return values, but given the low complexity and no output schema, it is adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are documented. The description adds value by explaining the condition for using the force parameter, which complements the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Remove' and the resource 'sandbox', effectively distinguishing it from sibling tools like sandbox_create and sandbox_stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance: sandbox must be stopped unless force is true. However, it does not explicitly mention when not to use the tool or suggest alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_runRun Command in Ephemeral SandboxA
Create an ephemeral sandbox, run a shell command, return the output, and destroy the sandbox. Best for quick one-off tasks like running a script, checking a command, or testing code.
| Name | Required | Description | Default |
|---|---|---|---|
| image | Yes | OCI image (e.g. "python:3.12", "node:22", "alpine") | |
| command | Yes | Shell command to execute | |
| memoryMib | No | Memory in MiB (default: 512) | |
| cpus | No | Number of vCPUs (default: 1) | |
| env | No | Environment variables |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds context beyond annotations by explaining the full lifecycle (create, run, destroy) and that the sandbox is ephemeral. Annotations only show non-readOnly, non-destructive, and non-idempotent, which aligns with the description's intent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, concise, and front-loaded with the core action. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the tool's purpose and lifecycle holistically. Given no output schema, it could mention that the output is returned as a single string, but the context is adequate for a combined operation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all parameters with descriptions (100% coverage), so the description does not need to add detail. It adds no additional semantics but is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it creates an ephemeral sandbox, runs a command, returns output, and destroys it. This distinguishes it from sibling tools that require separate create/exec steps, but does not explicitly mention those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says 'Best for quick one-off tasks' with examples, providing guidance on when to use. However, it does not specify when not to use this tool (e.g., for repeated commands, sandbox_shell might be better) or mention alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_shellRun Shell Command in SandboxA
Execute a shell command or script string inside a running sandbox. Interprets pipes, redirects, and shell syntax.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| command | Yes | Shell command or script to execute | |
| timeout | No | Timeout in seconds |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only and non-destructive behavior. The description adds context about shell interpretation but does not disclose potential side effects, resource limits, or authentication requirements beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences, front-loading the purpose and adding a key behavioral detail. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter tool with no output schema, the description covers the execution function but omits return value format (stdout/stderr) and timeout behavior, which are relevant for an execution tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all three parameters. The description adds no further meaning beyond the schema, only noting shell syntax interpretation which relates to the command parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'execute' and resource 'shell command or script string inside a running sandbox'. It adds specific detail about interpreting pipes, redirects, and shell syntax, which distinguishes it from sibling tools like sandbox_exec that may not have full shell interpretation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly suggests use for shell commands with syntax, but it does not explicitly state when to use this tool versus alternatives (e.g., sandbox_exec for simpler commands) nor provides any when-not conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_stopStop SandboxADestructive
Stop a running sandbox. Use force to kill with SIGKILL instead of graceful SIGTERM.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Sandbox name | |
| force | No | Force kill with SIGKILL instead of graceful SIGTERM |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and non-readonly nature. The description adds valuable detail about signal types (SIGKILL vs SIGTERM), which goes beyond annotations. Minor gap: no mention of side effects or state changes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main action and immediate detail. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two parameters and no output schema, the description covers both parameters and behavioral options. It is fully adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds meaning to the force parameter by explaining the signal distinction, exceeding schema but not fully compensating for lack of deeper parameter context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Stop' and resource 'running sandbox', distinguishing it from sibling tools like sandbox_create or sandbox_remove. It's specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the force parameter (SIGKILL vs SIGTERM), but does not explicitly contrast with other tools like sandbox_remove or provide exclusion criteria. However, the context is clear for this simple operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
volume_createCreate VolumeA
Create a named persistent volume. Volumes survive sandbox restarts and can be shared across sandboxes.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Volume name | |
| sizeMib | No | Quota in MiB |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate mutation (readOnlyHint=false), and the description adds that volumes are persistent and shareable. However, it fails to disclose any side effects, required permissions, or whether the operation is reversible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the primary action, and contains no extraneous information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description misses information about the return value (e.g., volume ID or status). It adequately covers the tool's core purpose but lacks complete behavioral context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the schema already documents both parameters. The description adds no extra semantic context beyond the schema, such as naming conventions or size unit implications.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a named persistent volume, and highlights key features (survives restarts, shareable) that distinguish it from sibling tools like volume_list or volume_remove.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (when you need a persistent volume) but does not explicitly state when to avoid or mention alternatives. No 'when not' guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
volume_listList VolumesARead-onlyIdempotent
List all named volumes.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, destructiveHint, and idempotentHint. The description adds no further behavioral context but does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, concise and front-loaded. Every word is necessary and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no output schema, the description is minimal. It states what it does but omits details like return format or scope, making it barely adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema provides full coverage. Baseline is 4, and the description adds no extra parameter meaning but is adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('named volumes') clearly. It distinguishes from sibling tools like volume_create and volume_remove, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not specify context, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
volume_removeRemove VolumeBDestructiveIdempotent
Remove a named volume.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Volume name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate destructiveHint=true, but the description adds no additional behavioral context (e.g., what happens if volume is in use). The description relies on annotations without elaboration.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence efficiently conveys the core functionality with no waste. Slightly more structure (e.g., hinting at idempotency) could improve, but it is appropriate for a simple operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple tool with one parameter and annotations. However, it lacks usage guidelines and behavioral details, leaving some gaps for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and parameter description is succinct. The tool description adds no new meaning beyond the schema, which is acceptable given full coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Remove') and the resource ('a named volume'). It distinguishes from sibling tools like volume_create and volume_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. No context about prerequisites or consequences is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
19 tool updates
v0.4.6- First observed
check_installed - First observed
sandbox_create - First observed
sandbox_exec - First observed
sandbox_fs_list - First observed
sandbox_fs_mkdir - First observed
sandbox_fs_read - First observed
sandbox_fs_remove - First observed
sandbox_fs_stat - First observed
sandbox_fs_write - First observed
sandbox_inspect - First observed
sandbox_list - First observed
sandbox_metrics - First observed
sandbox_remove - First observed
sandbox_run - First observed
sandbox_shell - First observed
sandbox_stop - First observed
volume_create - First observed
volume_list - First observed
volume_remove
TDQS
Each tool targets a distinct operation with clear prefixes (sandbox_, volume_, check_installed). The subtle overlap between sandbox_exec and sandbox_shell is resolved by their descriptions (command vs shell syntax).
All tool names follow a consistent verb_pattern: sandbox_<action> for sandbox tools, volume_<action> for volume tools, and check_installed conforms to verb_noun. No mixing of conventions.
19 tools cover sandbox lifecycle, filesystem operations, and volume management comprehensively. While slightly above the typical 3-15 range, the count is justified by the breadth of functionality.
The tool set covers the full sandbox lifecycle (create, run, exec, shell, stop, remove), filesystem operations, monitoring via metrics, and volume management. No obvious gaps for the domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- mcp-serverOAuthai.cdbx
Build Apps and run code in 30 languages — sandboxed, with persistent sessions for agent loops.
Connect AI agents to Alpaca Cloud: Postgres, Auth, Storage, Sandboxes, and Workflows.
OCR, transcription, file extraction, and image generation for AI agents via MCP.
Build and supervise fleets of agents from Claude Code, Codex or Cursor. Connects over OAuth.
Related MCP Servers
- AlicenseBqualityDmaintenanceExposes Arrakis VM sandbox functionality to LLMs, enabling sandbox management and command execution.911AGPL 3.0
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to execute arbitrary Python code securely in a sandboxed environment with resource limits and security constraints via MCP protocol.MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to create, manage, and execute code in isolated Firecracker microVM sandboxes via the MCP protocol, with support for sandbox lifecycle and file operations.2Apache 2.0
- FlicenseNot gradedqualityCmaintenanceEnables AI agents to safely execute Python, JavaScript, and Bash code in an isolated Docker sandbox with strict security constraints.1-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/superradcompany/microsandbox-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server