MCP server (stdio) that runs commands in a nanosandbox sandbox
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"nanosandbox-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# nanosandbox-mcp An [MCP](https://modelcontextprotocol.io) server that lets an AI agent run commands in a [nanosandbox](https://github.com/Erio-Harrison/nanosandbox) sandbox. It speaks MCP over stdio and offers one tool, `run_command`. ## Install ```bash npx -y nanosandbox-mcp --help # npm, nothing to install first uvx nanosandbox-mcp --help # PyPI, via uv cargo install nanosandbox-mcp # crates.io, builds from source ``` Prebuilt binaries cover macOS (Apple silicon and Intel) and Linux (x86_64 and aarch64, glibc 2.17+). Linux and macOS only. Windows isn't supported yet: the sandbox there is a resource limiter, not a security boundary. ## Use Add it to an MCP client's configuration (Claude Desktop, Cursor, Zed, ...): ```json { "mcpServers": { "sandbox": { "command": "npx", "args": ["-y", "nanosandbox-mcp", "--workspace", "/path/to/project"] } } } ``` (With `uvx`: `"command": "uvx", "args": ["nanosandbox-mcp", "--workspace", ...]`. With a `cargo install`ed binary: `"command": "nanosandbox-mcp"`.) The agent can now run programs, with their files limited to that workspace and no network. ## Who decides what the sandbox may do You do, when you launch the server. The model chooses *what to run*; it never chooses *what the sandbox may touch*. The tool takes only `command`, `args` and `stdin`. There is no parameter for paths, network, memory or time, so a model can't ask for more than you allowed. An extra argument is refused. | Option | Meaning | Default | |---|---|---| | `--workspace <DIR>` | Working directory and the only place commands can write. **Required.** | | | `--read-only <PATH>`, `--writable <PATH>` | Also allow reading / writing a path (repeatable). A `--read-only` path inside the workspace is read-only again, so a settings file there, or `.git/hooks` and `.git/config` (both: `core.hooksPath` in the config runs code from anywhere), can't be changed by a command (on Linux this needs mounting, refused …
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.