Execute Python code safely in isolated Docker containers

ipybox is a unified execution environment for Python code, shell commands, and programmatic MCP tool calls, running entirely locally on your machine with no cloud dependency. Code blocks execute inside a stateful IPython kernel, so state persists across executions and a single block can freely mix Python, shell commands (via !cmd syntax, with output captured into Python variables), and MCP tool calls. Rather than calling MCP tools via raw JSON, ipybox uses mcpygen to generate typed Python functions and Pydantic models directly from each MCP server's tool schemas - this "code mode" lets an agent call tools like ordinary typed function calls. Kernels can optionally be sandboxed with Anthropic's sandbox-runtime, which enforces filesystem and network restrictions at the OS level, and the runtime supports application-level approval of individual tool calls and shell commands as code executes. This is a full rewrite ("next generation ipybox"); the prior generation is maintained separately on the 0.6.x branch and remains installable with pip install ipybox<0.7.

Use ipybox when an agent needs to execute code and call MCP tools together in one stateful session, and you want typed Python bindings for those MCP tools rather than hand-built JSON calls - particularly if you also need OS-level sandboxing or per-call approval gates. It is an execution environment, not an agent itself: if you want a ready-made general-purpose agent built on top of it, the companion Freeact project fills that role instead of ipybox directly.

ipybox exposes three distinct interfaces onto the same execution core: a Python SDK for building applications directly against the code executor API; an MCP server mode, where ipybox's own code-execution and tool-calling capabilities are themselves exposed as MCP tools so any MCP client can drive it; and a Claude Code plugin that bundles the MCP server together with a code-action skill for direct use inside Claude Code. Across all three, inputs are code blocks (Python, shell, or MCP tool calls) and outputs are the resulting kernel state, captured shell output, and typed tool-call results.

Built on mcpygen for generating typed Python APIs from MCP tool schemas, and on Anthropic's sandbox-runtime for optional OS-level kernel sandboxing. Freeact, a general-purpose agent, is built directly on top of ipybox. Distributed on PyPI.

Developers building agents or applications that need to combine code execution with MCP tool calling in a single stateful, locally-run session - especially where typed tool APIs, sandboxed execution, or per-call approval gates matter more than a quick raw-JSON MCP integration.