sandbox-mcp CLI
The sbx CLI and an MCP server run an agent's app in a clean Windows Sandbox and return a report with screenshots and crashes
- 422 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The agent runs apps, installers and untrusted files in the sandbox, and the `firewall` and `on` network modes give the guest outside access.
- Enabling Windows Sandbox requires admin rights and a restart.
Install
- Works in
Manual install
Set up the sandbox-mcp CLI by following: https://raw.githubusercontent.com/shanselman/sandbox-mcp/main/docs/agent-setup.md Install the latest verified release. The CLI must work without MCP; configure the optional MCP adapter only if my agent needs it. Ask before admin changes or a restart.
The README prompt: the agent checks the PC, verifies the release checksum and asks before admin changes.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs apps, installers and untrusted files in the sandbox, and the `firewall` and `on` network modes give the guest outside access.
- Enabling Windows Sandbox requires admin rights and a restart.
This is third-party code. Review the repository files before installing.
What it does
sandbox-mcp gives an agent a disposable Windows 11 computer built on the built-in Windows Sandbox. The `sbx run` command boots a clean guest, deploys the app, launches it, collects screenshots and crash events, then destroys the machine. A typical GUI app run takes 40–50 seconds. The report shows what a developer's machine hides: for example, an app crashes on a clean system because a Visual C++ redistributable is missing. Dependencies are installed only with the explicit `--provision auto` flag. The agent can also click UI elements through UI Automation and record the run as video. `sbx install-test` compares the system before install and after uninstall and shows what was left behind. `sbx detonate` runs a suspicious file without network and lists its processes, connections and changes. The same actions are available as MCP tools, and the `skills/` folder has a skill for each scenario.
Who it is for. Windows desktop app developers who check builds, installers and suspicious files with the help of an agent.
Good fit when
- An app works on the developer's machine but fails for a customer, and the cause must be found on a clean Windows.
- The agent built a WPF or WinForms app, and the interface should be checked with clicks and a screenshot.
- An installer is suspected of leaving junk after uninstall, and you need a list of leftover files, registry keys and services.
- An unknown script or executable arrived, and you want to see its behaviour without exposing your own system.
Not a fit when
- You are on Windows Home, Windows Server, macOS or Linux: Windows Sandbox is not available there.
- You need several isolated machines running in parallel.
- You need to test Microsoft Store apps or dependencies installed through winget.
Example request
Build the app, run it in a fresh Windows Sandbox with no network, type my name in the box, click Greet and show me a screenshot.Limitations
You need Windows 11 24H2 (build 26100) or newer in the Pro, Enterprise or Education edition with Windows Sandbox enabled and a signed-in user. Only one sandbox runs at a time, and a second run fails at once. The guest has no Microsoft Store, winget, Notepad or Calculator, while Windows PowerShell 5.1 and .NET Framework 4.8 are present. A system snapshot for the installer test takes 10–20 seconds, and the whole run about two minutes. Prebuilt packages exist only for x64; ARM64 is not supported yet.
How to disable. Delete the extracted folder or run `npm unlink` in the clone. Remove the `windows-sandbox` server from your MCP settings; reports live in `%LOCALAPPDATA%\sandbox-mcp\runs`.
FAQ
Does an agent need the MCP server to use sandbox-mcp?
No. If the agent can run commands, `sbx` is enough. The MCP adapter helps clients that prefer tool schemas and inline images in results.
How do I enable Windows Sandbox?
In an administrator PowerShell run `Enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All` and restart Windows. Then open Windows Sandbox from the Start menu once and run `sbx doctor`.
Does sbx install dependencies in the guest on its own?
No, nothing is installed by default. `sbx deps` shows what is missing, and installation happens only with `--provision auto`.
Where are run reports stored?
In `%LOCALAPPDATA%\sandbox-mcp\runs\<timestamp>`: `report.md`, `report.json`, screenshots and the `audit.jsonl` log. The `SANDBOX_MCP_HOME` variable changes the root.
How do I connect it to Claude Desktop?
Add a `windows-sandbox` server under `mcpServers` with full paths to `node.exe` and `src\server.js` from the extracted archive. Claude Desktop does not need the `type` and `tools` fields.
Discussion
No questions or reviews yet.
Related
CLI toolsAn MCP server and CLI that give an agent its own hidden Linux desktop on X11 or Wayland without touching your screen or browser
BrowserStack MCP Server: testing on real devices
BrowserStack MCP Server
The official BrowserStack MCP server: real devices, automated tests and test cases driven by an agent from your editor
sunpeak tests any MCP server in local replicas of the ChatGPT and Claude hosts and builds MCP Apps with React
kogiQA MCP gives an agent a browser that finds page elements without selectors, for debugging web apps and writing e2e tests
Electron debugging MCP server: 111 tools let an agent see the window, click buttons, read console and network and audit security.
CLI, MCP server and typed Node.js API so an agent can verify its changes in a live mobile app on iOS, Android and more
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| sandbox-mcp (this card) | no | 422 | ||
| Windows-MCP | no | not required | 11,574 | controls your own Windows desktop; here the agent works in a disposable clean machine that is destroyed after the run |
| AIO Sandbox | no | key is optional | 6,331 | a Linux container sandbox with a browser and terminal; here a real Windows 11 for desktop apps |
README in short
The README opens with a prompt for the agent to install it and an example of a bug caught on a clean system. Then come a comparison with VMs and containers, enabling Windows Sandbox, a table of CLI commands and MCP tools, network modes and limits.