Sandbox Providers With an MCP Server: Let Your Agent Create and Manage Environments Directly

CreateOS Sandbox ships an MCP server that exposes the same sandbox primitives as its SDK and CLI, so an MCP-speaking agent can create, configure, pause, resume, and fork environments without a human in the loop. Every session is a Firecracker microVM with its own guest kernel. Start free with 500 credits.

Introduction

An agent that writes code needs somewhere to run it, and the loop breaks when the machine is out of reach. If spinning up an environment means opening a dashboard, copying an API key into a config file, or wiring an HTTP client the agent does not have, the agent waits for a human. The fix is to put the sandbox lifecycle where the agent already speaks: the Model Context Protocol.

MCP is the tool interface most agent harnesses already speak. When a sandbox provider exposes an MCP server, the agent's create-and-run loop becomes tool calls. The documentation covers the REST API, the SDK, the CLI, and MCP, and the whole surface ships as plain text an agent can parse, indexed at createos.sh/llms.txt.

Key Takeaways

An MCP server turns sandbox provisioning into tool calls, so the agent creates and manages environments itself instead of waiting on a human or a bespoke HTTP client.
CreateOS Sandbox's MCP server exposes the same primitives as the SDK and CLI: create, egress rules, pause, resume, fork.
Every sandbox is a Firecracker microVM with its own guest kernel, not a container on a shared host.
Snapshot restore brings a new sandbox up in tens of milliseconds, about 30 ms on an idle host. That is an idle-host figure, not an SLA.
Pricing is published and checkable: per-second billing, $0 egress, 500 free credits on the Sandbox pricing page.

Why an MCP Server Is the Right Interface for This

The agent loop is: decide, act, observe, repeat. Sandboxes fit the "act" step, but only if the agent can reach them the way it reaches every other tool. Three things follow from that.

First, the agent needs the full lifecycle, not just "run this command." It needs to create a machine, set what the machine can reach, pause it when idle, resume it, and fork it when it wants to try two paths at once. A provider that only exposes "execute code" through MCP leaves the agent's operator doing the rest by hand.

Second, the interface has to be the same one the humans use. When the MCP server exposes the same primitives as the SDK and CLI, what you prototype through an agent matches what you later wire into CI or a product. There is no second API to keep in your head.

Third, the agent needs to read the rules before it acts. CreateOS publishes limits, defaults, and prices as plain text, indexed at llms.txt, so an agent can parse the surface without a browser.

What CreateOS Sandbox's MCP Server Exposes

CreateOS Sandbox is Firecracker microVM infrastructure for untrusted and agent-written code. The MCP server exposes the same primitives the SDK (@nodeops-createos/sandbox) and the CLI (createos sandbox) expose, so an agent that speaks MCP can drive the whole lifecycle.

Create and restore. A create call returns a microVM with its own guest kernel. New sandboxes restore from snapshot in tens of milliseconds, about 30 ms on an idle host (idle-host figure, not an SLA), so a create-per-action loop does not pay a boot tax. Shapes run from a quarter CPU up to 8 CPUs and 16 GB of memory, with 10 to 60 GB of disk.

Egress, set by the agent itself. Outbound access is open until at least one rule is set. Once a rule exists, everything else is denied, and enforcement sits in the host kernel with eBPF, outside the guest, so code inside the sandbox cannot rewrite or route around it. Inbound is closed by default either way. Rules take hosts, host:port pairs, wildcard subdomains, IPs, and CIDRs, and changes apply live with no restart. Egress traffic bills at $0.

Pause, resume, fork. Pausing writes a snapshot of full guest state and stops the meter. Pause takes about 1.4 seconds, same-host resume comes back in under 0.7 seconds, and a cross-host cold start runs 11 to 13 seconds. Forking branches agent state, which is how you run N candidate fixes in parallel instead of one at a time. One tradeoff, stated plainly: the first request after a pause waits for the resume.

Networking between sandboxes. Private overlay networks with private DNS let a team of agents find each other without public exposure.

The Sandbox product page covers the full surface, and the docs carry runnable examples across agent frameworks and coding agents.

Proof You Can Check Without a Sales Call

The scale is real: 2.6 million sandboxes created since June 2026 (as of 1 October 2026). CreateOS's own CI has run on sandboxes since July 2026, so the platform runs its own builds on itself daily. The infrastructure under CreateOS is operated by NodeOps, the infrastructure company behind CreateOS, operating production infrastructure since December 2023.

The frame is a young product, stated plainly: a working reference implementation, our own CI on it, and published unit rates you can multiply before signup on the Sandbox pricing page. Wherever compliance comes up: we are SOC 2 Type II and ISO 27001 certified, with reports available under NDA.

What to Check Before Your Agent Commits

Ask these questions of any sandbox provider with an MCP server, including us:

Does the MCP server cover the full lifecycle? Create alone is not enough. Your agent needs egress, pause, resume, and fork as tool calls too.
What is the isolation boundary? A container shares the host kernel. A Firecracker microVM has its own guest kernel, which is a different claim when the code is untrusted.
Where is egress enforced? Rules enforced inside the guest can be rewritten by the guest. Host-kernel enforcement with eBPF survives a full guest compromise.
What does the egress default actually do? Open-until-a-rule-is-set is the correct description. Treat any provider that claims outbound is locked down before you configure anything with suspicion.
What does a second cost, and what is free? Per-second billing, $0 egress, and 500 free credits are published and checkable.
Can the docs be parsed by the agent itself? If the surface ships as plain text with a machine-readable index, the agent can self-serve the evaluation.

If your agents write code, stop putting it on a shared box. Start free with 500 credits and let the agent create its first sandbox over MCP today.

Frequently Asked Questions

What can an agent actually do through the CreateOS Sandbox MCP server?

It can drive the sandbox lifecycle as tool calls: create a microVM sandbox, set or update its egress rules, pause it, resume it, and fork it. The MCP server exposes the same primitives as the SDK and the createos sandbox CLI, so there is one lifecycle across all three surfaces.

Do I need to write code to connect my agent to it?

No. If your agent harness speaks MCP, you register the sandbox server as a tool provider and the agent calls it directly. The SDK and CLI remain available for CI pipelines and product code, and the docs carry runnable examples for both.

Is outbound network access restricted by default?

No, and this matters. Outbound access is open until you set at least one egress rule. Once a rule exists, everything else is denied, and enforcement sits in the host kernel with eBPF, outside the guest. Inbound is closed by default regardless.

What does it cost to let an agent create sandboxes on demand?

Billing is per second, so an idle sandbox you paused stops costing anything, and egress traffic bills at $0. New accounts get 500 free credits, which is enough to run the first agent-driven sessions before paying. Current rates are on the Sandbox pricing page.

Conclusion

A sandbox the agent cannot reach is a sandbox you operate by hand. An MCP server closes that gap: the agent creates the environment, sets what it can reach, pauses it when idle, and forks it when it needs parallel paths, all as tool calls in the loop it already runs. CreateOS Sandbox puts that lifecycle on Firecracker microVMs with host-enforced egress, published prices, and 500 free credits to start. Point your agent at it and watch the first session come up in tens of milliseconds.

About CreateOS

CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.