---
title: "sandbox"
description: "Portable LLM-first sandboxing with shell, files, browser and artifacts over MCP."
canonical: https://agentpluginsdirectory.com/plugins/sandbox
last-updated: 2026-09-21
---

# sandbox
Portable LLM-first sandboxing with shell, files, browser and artifacts over MCP.
- Slug: sandbox
- Publisher: Fabio Nagao
- Repository: https://github.com/nagaozen/sandbox
- Manifest: plugin.json
- Version: 0.3.0
- License: Apache-2.0
- Category (editorial): other
- Skills: 1 (sandbox)
- MCP servers: 1 (sandbox)
- Stars: 0
- Repository created: 2026-09-20
- Repository last pushed: 2026-09-20
- Publisher type: User
- Listing: https://agentpluginsdirectory.com/plugins/sandbox
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What sandbox does, in the publisher's words

LLM-first sandboxing for agents.

This repository defines a small semantic MCP surface over isolated Docker runtimes and ships itself as an Agent Plugin. The public contract is designed for models first: eight tools, progressive capability disclosure, a single /workspace, and explicit sandbox lifecycle.

- LLM semantics over REST completeness. Models see task-oriented tools, not every low-level runtime endpoint.
- Progressive disclosure. sandbox_discover reveals details only when an agent needs them.
- One workspace. Shell, files, browser downloads, generated artifacts, and future tools share /workspace.
- Runtime independence. MCP semantics do not depend on Docker. Docker is the first runtime adapter.
- Explicit lifecycle. Sandboxes are created, inspected, used, and destroyed deliberately.
- Artifacts are first-class. Files produced in /workspace can be enumerated and returned without leaking host details.

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/nagaozen/sandbox/HEAD/README.md

## Skills

- sandbox: Use an isolated sandbox when a task needs shell commands, code execution, filesystem changes, browser automation, downloads, or generated artifacts.

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.

## MCP servers

- sandbox: transport: stdio; command: node ${PLUGIN_ROOT}/bin/sandbox.mjs; env: SANDBOX_PLUGIN_ROOT, SANDBOX_PLUGIN_DATA

Read from the plugin's own mcp.json. Environment variable names only, never values.