boxkiteGive your agent a secure sandbox in 60 seconds.
An MCP chat session is a conversation, not a security boundary. The moment your local agent runs a shell command or edits a file, it's running on your machine with your permissions. boxkite's MCP server bridges that gap — every tool call executes inside a real, isolated Kubernetes pod instead.
Three steps, zero glue code
Install the MCP server
pip install boxkite-mcpAlso works with uvx / npx — no local install needed.
Add one block to your editor config
{
"mcpServers": {
"boxkite": {
"command": "boxkite-mcp",
"env": {
"BOXKITE_BASE_URL": "https://your-cp...",
"BOXKITE_API_KEY": "bxk_live_..."
}
}
}
}Codex uses TOML (~/.codex/config.toml) instead — full guide has the exact block.
Restart — tools appear automatically
26 tools discovered: sandbox lifecycle, exec, file ops, plus opt-in custom-image and storage-volume management. Nothing else to wire up.
The 26 MCP tools (the control-plane MCP server's full surface) are distinct from the 15 framework-agnostic sandbox tools the self-hosted factory binds for LangChain/OpenAI-style agents — the MCP server adds sandbox, image, and volume management on top.
Real pod isolation
If the agent hallucinates and runs rm -rf /, it destroys a temporary pod — not your laptop, not your cloud account.
Network-dark by default
Egress denied by default, plus a fresh empty network namespace on every execcall — a policy misconfiguration alone still can't reach the network.
Runs on your infra
Self-host the whole control-plane on your own cluster, or point the MCP server at the free hosted beta — same code either way.