Execute Code Securely in Sandboxed Environments

Onyx is an MCP server that executes arbitrary code securely inside Docker sandboxes, integrating with Claude Desktop or other MCP clients so an AI assistant can run code without touching the host machine directly. It supports six languages via dedicated Docker images: Python (python:3.11), Java (openjdk:17), C and C++ (gcc:12), JavaScript/Node.js (node:20), and Rust (rust:1.72).

Sandboxing is deliberately restrictive: containers run with networking disabled (--network none), a read-only filesystem with tmpfs mounts for the writes execution actually needs, limited CPU, memory, and process counts, and non-root execution (--user 1000:1000). The server exposes a single MCP tool, run_code, for executing arbitrary code inside this environment, and routes all execution logs to stderr so they don't interfere with the MCP client's stdio protocol channel. The project also ships GitHub Actions CI that runs automated tests against its language executors.

Internally it is a Go project: cmd/server/main.go is the MCP server entrypoint, internal/model defines code parameters, the executor interface, and result types, internal/executor holds one executor implementation per supported language, and internal/utils checks Docker availability before attempting to run anything.

go build -o sandbox_server ./cmd/server/main.go

Adding a new language is a defined five-step process: pick a Docker image with the language's compiler or runtime (the docs give golang:1.22 for Go and php:8.2-cli for PHP as examples); implement an executor struct in internal/executor/<lang>.go whose Execute method pipes source code into the container, compiles or interprets it inside /workspace, and runs the resulting binary or script; register the new executor by language name in main.go; write a test for it; and pre-pull the corresponding Docker image.

Use this connector when you want an AI assistant to run and verify code across multiple languages without exposing your host filesystem or network to untrusted execution - the disabled networking, read-only filesystem, and non-root, resource-limited containers are specifically designed for that threat model. It is a good fit for Claude Desktop workflows that need to actually execute generated code rather than just review it statically.

It requires Docker (Desktop or Engine) and Go 1.20+ to run the server itself, and each supported language's Docker image must be pulled - ideally ahead of time - to avoid first-run delays; environments that cannot run Docker containers cannot use this connector at all.

One tool, run_code, backed by a per-language executor struct (implementing a shared Execute interface) that pipes source into the container, compiles or interprets it inside /workspace, and returns the resulting output - the same interface every future language addition must implement, keeping the six current executors and any new ones behaviorally consistent.

Requires Docker (Desktop or Engine) and Go 1.20+. Build the server with go build -o sandbox_server ./cmd/server/main.go, pre-pull each language's Docker image to avoid first-run delays, then register it with Claude Desktop via an mcpServers entry in claude_desktop_config.json pointing at the built sandbox_server binary.

Claude Desktop power users and developers building AI workflows that need to actually execute untrusted or AI-generated code safely, across Python, Java, C, C++, Node.js, or Rust, rather than running it unsandboxed on the host.