Code Execution & Sandboxes MCP servers

Outbound-only remote shell, detached long-running jobs and temporary file transfer for AI agents, without exposing SSH, ports or a VPN.

ADB-based Android access: read-only logcat, UI hierarchy, package listing and allowlisted shell commands.

Read-only local code graph for Rust, Cangjie, ArkTS, TS/JS, C/C++, Python and Shell: call graphs, quality gates, change review and impact analysis.

Single exec tool running caller Python in a network-isolated locked-down sandbox.

Test FIX from Claude, ChatGPT, or Cursor: free sandbox FIX sessions or your own FIXSIM instances.

Screen OCR on macOS via FreezeText: freeze the screen and extract text with Apple Vision, OCR regions or images, and search capture history.

The most complete Godot 4 MCP: secure sandbox, 40+ tools (projects–runtime), major MCP clients.

Rent real GPUs from the terminal. Per-second billing, $0.50 minimum. stdio MCP server.

Signed sandbox verdicts on any artifact, plus an agent marketplace. No key, no signup, no payment.

Give a private ChatGPT app access to selected local folders through OpenAI Secure MCP Tunnel, with per-folder permissions, hash-checked edits and recovery. No shell or public port.

Local-first MCP server and terminal CLI for safe Resource Optimiser logwork automation.

Governed email for AI agents (Mailbuttons / mbag.ai): sandbox inboxes, policy gate, audit log.

Control Nemeton, a macOS virtual machine manager built on Apple's Virtualization framework: Linux and macOS VMs, APFS snapshots, console, files and networking.

MCP server for the live ProfitPlay BTC five-minute AI agent sandbox

Sandboxed Python execution for AI agents. PEP 723 inline deps, multi-version Python, zero pollution.

Sanctions API docs and request validation, with account-linked synthetic sandbox testing.

Persistent Docker/SSH sandbox for AI agents: shell exec, file ops, audit log.

Evidence-first security review of authorized repositories. Read-only, root-confined, no shell.

Money, FX, capital-market and metadata-only China macro evidence with source clocks and limits.

Static security scanner for MCP servers and agent tools: detects secrets, shell execution, risky tool descriptions, environment access and prompt injection.

Fork, break and revert VirtualBox VMs with linked clones and RAM snapshots, and drive GUI-only guests via screenshots and input without SSH or a guest agent.

Undo a coding agent turn, including shell commands and untracked files.

Injects secrets into shell commands at exec time; plaintext never reaches the LLM context

MCP server that gives AI agents eyes on your terminal — PNG screenshots, visual diffs, GIF recording, and full keyboard/text interaction

Check a website's security in plain English from the terminal, or give your AI agent the tool. Free, no key.

See and control your own Windows PC locally or remotely: UIA and screenshot observation, clicking, typing, dragging, scrolling, launching apps and Live View.

Run commands on machines you cannot SSH into, such as air-gapped or bastion-only hosts, via git, file shares or S3, with timestamped run logs.

The INITE Club from a terminal: ask a member agent a question with no account, join as a member, or run as the MCP server your editor connects through.

Full Mac control: shell, AppleScript, files, processes and human-like GUI input with a screenshot loop, plus an optional safe mode with read-only, gated access.

Plaid MCP — wraps Plaid Sandbox API (sandbox.plaid.com)

Dedicated Linux VM sandboxes for untrusted, model-generated code: run commands, move files, expose a preview URL and destroy the VM.

MCP server + CLI for ToolRouter — discover, search, and call AI tools from any agent or terminal

Receive, inspect, forward, sign and verify webhooks from your terminal, your test suite and your AI agent (CLI + library + MCP server).

WinCtl — full Windows desktop control for Claude and other MCP clients: screen capture, UI Automation, synthetic input, window and process management, files and shell, behind tiered permissions with audit logging.

Read-only-by-default Mac control: files, processes, screenshots and clipboard, with opt-in allowlisted shell commands, AppleScript and GUI input.

Ask probe402's public record about an x402 endpoint before an agent pays it, and re-check a published archive head from a terminal. Reads public surfaces of probe402.com only.

Run privileged commands locally or over SSH, each gated by a single-keypress human approval before sudo, with audit logging and no stored password.

pi-repl's shared tmux REPLs (Python, Julia, R and more) for Claude Code, Codex, OpenCode and other agents, over MCP and a CLI.

Secure Python sandbox for data optimization and Matplotlib rendering via x402 microtransactions.

Verified merchants accepting agentic payments on Lightning/L402/BOLT12/USDT — search, verify, pay.

Aviation accident report parsing and prompt generation service under the SHELL framework.

Contextual blast-radius scoring for shell commands an AI agent is about to run

Persistent Linux computers for AI agents: desktop, signed-in browser, vault, apps and shell.

GTIN product search and feeds with tracked affiliate links, programs and deals. Free sandbox key.

Deploy from your terminal, and give an AI coding agent the same abilities over MCP.

Execute Python, JavaScript, SQL code in a sandbox. x402 micropayment.

Run AI customer support from your terminal: conversations, knowledge base, and chat widget.

Xident build-time MCP server — docs lookup, sandbox test verifications, webhook debugging.