mcp_run_isolated_python 0.1.0__tar.gz → 0.2.0__tar.gz

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/.github/actions/setup_python_environment/action.yaml

@@ -26,5 +26,5 @@ runs:
     - name: Install srt & deps
       shell: bash
       run: |
-        npm install -g @anthropic-ai/sandbox-runtime
+        npm install -g @anthropic-ai/sandbox-runtime@'<=0.0.64'
         sudo apt-get install ripgrep socat bubblewrap

mcp_run_isolated_python-0.2.0/.github/workflows/publish.yml

@@ -0,0 +1,73 @@
+name: "Publish to PyPI"
+
+on:
+  push:
+    tags:
+      # Publish on any tag starting with a `v`, e.g., v0.1.0
+      - v*
+
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+
+    environment:
+      name: pypi
+
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python Environment
+        uses: ./.github/actions/setup_python_environment
+
+      - name: Build
+        run: uv build
+
+      - name: Publish
+        run: uv publish
+
+  docker_hub:
+    runs-on: ubuntu-latest
+
+    permissions:
+      packages: write
+      contents: read
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: kigstn/mcp-run-isolated-python
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Generate artifact attestation
+        uses: actions/attest@v4
+        with:
+          subject-name: index.docker.io/kigstn/mcp-run-isolated-python
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/.pre-commit-config.yaml

@@ -4,7 +4,7 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.15.0
+    rev: v0.16.6
     hooks:
       # Run the linter.
       - id: ruff-check
@@ -19,7 +19,7 @@ repos:
 
   # Gitleaks
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.0
+    rev: v8.30.1
     hooks:
       - id: gitleaks
         priority: 10

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/Dockerfile

@@ -33,7 +33,7 @@ WORKDIR /code
 COPY . .
 
 # make sure the srt default config has the `enableWeakerNestedSandbox` set to true (needed for docker)
-# RUN sed -i 's/"enableWeakerNestedSandbox": *false/"enableWeakerNestedSandbox": true/' ./default_srt_settings.json
+RUN sed -i 's/"enableWeakerNestedSandbox": *false/"enableWeakerNestedSandbox": true/' ./default_srt_settings.json
 
 # Install project + deps into venv
 RUN uv sync --frozen --no-editable --no-dev
@@ -41,7 +41,7 @@ RUN uv sync --frozen --no-editable --no-dev
 # ----------------------------
 # Final stage
 # ----------------------------
-# Then, use a final image without uv, but with node
+# Then, use a final image with uv and with node
 FROM node:${ENVIROMENT}
 LABEL authors="daniel.j"
 
@@ -52,7 +52,7 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 
 # install the srt sandbox
-RUN npm install -g @anthropic-ai/sandbox-runtime
+RUN npm install -g @anthropic-ai/sandbox-runtime@'<=0.0.64'
 
 WORKDIR /code
 
@@ -63,6 +63,9 @@ RUN groupadd --system --gid 999 nonroot \
 # Copy the Python version
 COPY --from=builder --chown=python:python /python /python
 
+# uv, so users of the prebuilt image can add packages at runtime via -e PYTHON_DEPENDENCIES
+COPY --from=builder /usr/local/bin/uv /usr/local/bin/uv
+
 # Copy project (with venv)
 COPY --from=builder --chown=nonroot:nonroot /code /code
 
@@ -74,6 +77,5 @@ ENV PATH="/code/.venv/bin:$PATH"
 
 EXPOSE 6400
 
-ENTRYPOINT ["mcp-run-isolated-python", "--path_to_python='/sandbox/.venv/bin/python'", "--user=nonroot"]
-
-# todo create custom settings maybe?
+COPY --chmod=755 docker-entrypoint.sh /docker-entrypoint.sh
+ENTRYPOINT ["/docker-entrypoint.sh"]

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: mcp_run_isolated_python
-Version: 0.1.0
+Version: 0.2.0
 Summary: A secure and sandboxed python code interpreter for LLMs. Accessable via MCP, or directly in code
 Project-URL: Repository, https://github.com/Kigstn/mcp-run-isolated-python
 Author: Daniel J
@@ -14,7 +14,7 @@ License: Copyright © 2026 Daniel J
 License-File: LICENCE
 Requires-Python: >=3.10
 Requires-Dist: cyclopts>=4.5.1
-Requires-Dist: fastmcp>=3.0.1
+Requires-Dist: fastmcp>=4.0.3
 Requires-Dist: filetype>=1.2.0
 Requires-Dist: opentelemetry-api>=1.39.1
 Requires-Dist: pydantic>=2.12.5
@@ -36,21 +36,57 @@ If you this, your LLM will always be able to count the number of "r" in strawber
 
 ### MCP - via Docker (recommended)
 
-WIP - support is suboptimal, as the anthropic sandbox runtime does currently only run in privileged docker running
-configs.
-Waiting on them to add proper support for containers, the existing options does not seem to do anything :D
+For this to run we have to set some security options on the container.
+This is due to bubblewrap needing to create user, mount and pid namespaces, which the container has to be allowed to do:
+- seccomp=unconfined
+- apparmor=unconfined
+- systempaths=unconfined
 
-If you still want to use it, here is the command:
-`docker run --privileged .`
+This is mandatory - to my knowledge these are the miniumum needed permissions, but feel free to experiment :)
 
-You can pass your CLI settings directly after that, the dockerfile uses entrypoint to start the server and listens to
-all args.
+```
+docker run -p 6400:6400 \
+  --security-opt seccomp=unconfined \
+  --security-opt apparmor=unconfined \
+  --security-opt systempaths=unconfined \
+  -e PYTHON_DEPENDENCIES="pydantic numpy" \
+  kigstn/mcp-run-isolated-python
+```
+
+You can pass your CLI settings directly after that, the dockerfile uses entrypoint to start the server and listens to all args.
 
 Note:
 
+- If you are running on Ubuntu 24 you will need to adapt your apparmor profile. We have a script, just run `setup_host.sh`. [More Info](https://github.com/anthropics/sandbox-runtime/blob/main/.github/workflows/integration-tests.yml#L152)
+- These three options only loosen the *container*. The code your LLM runs is still sandboxed by `srt` inside it -
+  no network, no writes outside its temp dir, own pid namespace.
 - Docker automatically creates a separate UV python interpreter for the runtime - so you dont have to pass that :)
-- To control your python version & packages, use the docker build args `PYTHON_VERSION` and `PYTHON_DEPENDENCIES` (space
-  separated list)
+- To control your packages, use the env var `PYTHON_DEPENDENCIES` (space separated list). For greater control you need to build the image yourself
+- We provide a sample docker-compose file, which you can use to run the server with a single command. Just adapt the env vars to your needs.
+
+#### Configuration
+
+To configure what packages are available to the LLM set `PYTHON_DEPENDENCIES` as an env var (space seperated list).
+
+```
+docker run ... -e PYTHON_DEPENDENCIES="numpy pandas" kigstn/mcp-run-isolated-python
+```
+
+Or bake your own image on top, which is better if you restart often, deploy offline, or want a pinned set:
+
+```dockerfile
+FROM kigstn/mcp-run-isolated-python
+RUN uv pip install --python /sandbox/.venv/bin/python numpy pandas
+```
+
+---
+
+Build args, if you build the image yourself:
+- `ENVIROMENT` - Default: "trixie-slim"
+- `PYTHON_VERSION` - Default: "3.13"
+- `PYTHON_DEPENDENCIES` - Default: "pydantic" (space separated list)
+
+Consult the Dockerfile for detailed info
 
 ### MCP - via direct hosting
 
@@ -61,9 +97,10 @@ Then, just run the command to start the server:
 
 ### As a python package
 
-This approached is generally discouraged for any production use, as it removes a lot of this projects security features.
+This approached is generally discouraged for any production use, as it removes a lot of this projects security features. 
 
-But if you like to live dangerously, or you are the only one using this, or you are building a super quick prototype - this will be fine & should be safe, as it is still using sandboxed code execution.
+TBH - it should be fine, as this is used by procts such claude code in production on your PC.
+Just be warned :)
 
 ```py
 from mcp_run_isolated_python import CodeSandbox, CodeSandboxSettings
@@ -81,6 +118,8 @@ async with CodeSandbox(settings=settings) as sandbox:
     print(result)
 ```
 
+When using the library like this, it will use your current python interpreter and environment, so you will have to make sure that the packages you need are installed there.
+
 ---
 
 ## Why this tool?

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/README.md

@@ -12,21 +12,57 @@ If you this, your LLM will always be able to count the number of "r" in strawber
 
 ### MCP - via Docker (recommended)
 
-WIP - support is suboptimal, as the anthropic sandbox runtime does currently only run in privileged docker running
-configs.
-Waiting on them to add proper support for containers, the existing options does not seem to do anything :D
+For this to run we have to set some security options on the container.
+This is due to bubblewrap needing to create user, mount and pid namespaces, which the container has to be allowed to do:
+- seccomp=unconfined
+- apparmor=unconfined
+- systempaths=unconfined
 
-If you still want to use it, here is the command:
-`docker run --privileged .`
+This is mandatory - to my knowledge these are the miniumum needed permissions, but feel free to experiment :)
 
-You can pass your CLI settings directly after that, the dockerfile uses entrypoint to start the server and listens to
-all args.
+```
+docker run -p 6400:6400 \
+  --security-opt seccomp=unconfined \
+  --security-opt apparmor=unconfined \
+  --security-opt systempaths=unconfined \
+  -e PYTHON_DEPENDENCIES="pydantic numpy" \
+  kigstn/mcp-run-isolated-python
+```
+
+You can pass your CLI settings directly after that, the dockerfile uses entrypoint to start the server and listens to all args.
 
 Note:
 
+- If you are running on Ubuntu 24 you will need to adapt your apparmor profile. We have a script, just run `setup_host.sh`. [More Info](https://github.com/anthropics/sandbox-runtime/blob/main/.github/workflows/integration-tests.yml#L152)
+- These three options only loosen the *container*. The code your LLM runs is still sandboxed by `srt` inside it -
+  no network, no writes outside its temp dir, own pid namespace.
 - Docker automatically creates a separate UV python interpreter for the runtime - so you dont have to pass that :)
-- To control your python version & packages, use the docker build args `PYTHON_VERSION` and `PYTHON_DEPENDENCIES` (space
-  separated list)
+- To control your packages, use the env var `PYTHON_DEPENDENCIES` (space separated list). For greater control you need to build the image yourself
+- We provide a sample docker-compose file, which you can use to run the server with a single command. Just adapt the env vars to your needs.
+
+#### Configuration
+
+To configure what packages are available to the LLM set `PYTHON_DEPENDENCIES` as an env var (space seperated list).
+
+```
+docker run ... -e PYTHON_DEPENDENCIES="numpy pandas" kigstn/mcp-run-isolated-python
+```
+
+Or bake your own image on top, which is better if you restart often, deploy offline, or want a pinned set:
+
+```dockerfile
+FROM kigstn/mcp-run-isolated-python
+RUN uv pip install --python /sandbox/.venv/bin/python numpy pandas
+```
+
+---
+
+Build args, if you build the image yourself:
+- `ENVIROMENT` - Default: "trixie-slim"
+- `PYTHON_VERSION` - Default: "3.13"
+- `PYTHON_DEPENDENCIES` - Default: "pydantic" (space separated list)
+
+Consult the Dockerfile for detailed info
 
 ### MCP - via direct hosting
 
@@ -37,9 +73,10 @@ Then, just run the command to start the server:
 
 ### As a python package
 
-This approached is generally discouraged for any production use, as it removes a lot of this projects security features.
+This approached is generally discouraged for any production use, as it removes a lot of this projects security features. 
 
-But if you like to live dangerously, or you are the only one using this, or you are building a super quick prototype - this will be fine & should be safe, as it is still using sandboxed code execution.
+TBH - it should be fine, as this is used by procts such claude code in production on your PC.
+Just be warned :)
 
 ```py
 from mcp_run_isolated_python import CodeSandbox, CodeSandboxSettings
@@ -57,6 +94,8 @@ async with CodeSandbox(settings=settings) as sandbox:
     print(result)
 ```
 
+When using the library like this, it will use your current python interpreter and environment, so you will have to make sure that the packages you need are installed there.
+
 ---
 
 ## Why this tool?

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/default_srt_settings.json

@@ -6,7 +6,7 @@
         "allowLocalBinding": false
     },
     "filesystem": {
-        "denyRead": ["~/.ssh"],
+        "denyRead": [],
         "allowWrite": ["."],
         "denyWrite": []
     },

mcp_run_isolated_python-0.2.0/docker-compose.yml

@@ -0,0 +1,12 @@
+services:
+  mcp-run-isolated-python:
+    build:
+      context: .
+    environment:
+      PYTHON_DEPENDENCIES: "pydantic"
+    ports:
+      - "6400:6400"
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
+      - systempaths=unconfined

mcp_run_isolated_python-0.2.0/docker-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Lets people using the prebuilt image add packages without rebuilding:
+#   docker run -e PYTHON_DEPENDENCIES="numpy pandas" ...
+set -eu
+
+if [ -n "${PYTHON_DEPENDENCIES:-}" ]; then
+  echo "Installing extra python dependencies: ${PYTHON_DEPENDENCIES}"
+  # shellcheck disable=SC2086 # deliberate: space separated list of packages
+  uv pip install --python /sandbox/.venv/bin/python ${PYTHON_DEPENDENCIES}
+fi
+
+exec mcp-run-isolated-python \
+  --path_to_python=/sandbox/.venv/bin/python \
+  --user=nonroot \
+  --mcp_host=0.0.0.0 \
+  "$@"

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcp_run_isolated_python"
-version = "0.1.0"
+version = "0.2.0"
 description = "A secure and sandboxed python code interpreter for LLMs. Accessable via MCP, or directly in code"
 authors = [{ name = "Daniel J" }]
 license = { file = "LICENCE" }
@@ -10,7 +10,7 @@ requires-python = ">=3.10"
 dependencies = [
     "pydantic>=2.12.5",
     "rich>=14.3.2",
-    "fastmcp>=3.0.1",
+    "fastmcp>=4.0.3",
     "opentelemetry-api>=1.39.1",
     "structlog>=25.5.0",
     "filetype>=1.2.0",

mcp_run_isolated_python-0.2.0/setup_host.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Run this ON THE DOCKER HOST (the machine running dockerd)
+#
+# Only needed on Ubuntu 23.10+, which sets kernel.apparmor_restrict_unprivileged_userns=1. That lets
+# bubblewrap create a user namespace but gives it zero capabilities, so bwrap dies with
+# "setting up uid map: Permission denied". Same thing the sandbox-runtime CI does, see
+# https://github.com/anthropics/sandbox-runtime/blob/main/.github/workflows/integration-tests.yml
+set -eu
+
+echo "kernel.apparmor_restrict_unprivileged_userns = 0" | sudo tee /etc/sysctl.d/99-bwrap.conf >/dev/null
+sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/src/mcp_run_isolated_python/code_executor.py

@@ -1,8 +1,9 @@
 import os
 import shutil
-import subprocess  # noqa: S404
+import subprocess  # ruff: ignore[suspicious-subprocess-import]
 import traceback
 import uuid
+from pathlib import Path
 from typing import Annotated, Any, Literal
 
 from fastmcp.utilities.types import Audio, File, Image
@@ -29,17 +30,38 @@ TypeReturnValue = list[CodeExecutionResult | EmbeddedResource | ImageContent | A
 class CodeExecutor(BaseModel):
     settings: CodeSandboxSettings
 
+    def _make_run_dir(self, *subdirs: str) -> Path:
+        path = self.settings.working_directory / uuid.uuid4().hex
+        for subdir in subdirs or ("",):
+            (path / subdir).mkdir(parents=True, exist_ok=True)
+        # make sure this is owned by the correct user
+        if self.settings.user:
+            shutil.chown(path, user=self.settings.user)
+            for subdir in subdirs:
+                shutil.chown(path / subdir, user=self.settings.user)
+        return path
+
     def model_post_init(self, context: Any, /) -> None:
         logger.info("Pre first run: Running pre-check to verify SRT CLI tool is available and working...")
 
         # check that it actually works (all deps installed)
-        p = subprocess.run(("srt", "python -c '1+1'"), capture_output=True)
+        check_path = self._make_run_dir()
+        try:
+            p = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true]
+                ("srt", "--settings", self.settings.path_to_srt_settings, "-c", "true"),  # ruff: ignore[start-process-with-partial-path]
+                capture_output=True,
+                cwd=check_path,
+                check=False,
+                user=self.settings.user,
+            )
+        finally:
+            shutil.rmtree(check_path)
         if p.returncode == 0:
             logger.info("Pre-check for SRT CLI tool succeeded!")
         else:
             logger.error("Pre-check for SRT CLI tool failed", return_code=p.returncode, stderr=p.stderr.decode())
             raise RuntimeError(
-                "Pre-check for SRT CLI tool failed. Please install it: `npm install -g @anthropic-ai/sandbox-runtime` & ensure it is working correctly"
+                "Pre-check for SRT CLI tool failed. Please install it: `npm install -g @anthropic-ai/sandbox-runtime@'<=0.0.64'` & ensure it is working correctly"
             )
 
     # Note: This is a sync function on purpose, to avoid the complexity of async subprocess. Uvicorn will spawn this in a thread
@@ -49,8 +71,7 @@ class CodeExecutor(BaseModel):
     ) -> TypeReturnValue:
         try:
             # create a temp working dir for the code to have write perms in
-            code_path = self.settings.working_directory / uuid.uuid4().hex
-            (code_path / "output").mkdir(parents=True)
+            code_path = self._make_run_dir("output")
 
             # write the code to a temp file
             code_file_path = code_path / "code.py"
@@ -61,9 +82,10 @@ class CodeExecutor(BaseModel):
             logger.info("Running python code...", code=python_code, settings=self.settings.model_dump())
             try:
                 cmd = f""""{self.settings.path_to_python_interpreter}" "{code_file_path}" """
-                p = subprocess.run(  # noqa: S603
-                    ("srt", "--settings", self.settings.path_to_srt_settings, cmd),
+                p = subprocess.run(  # ruff: ignore[subprocess-without-shell-equals-true]
+                    ("srt", "--settings", self.settings.path_to_srt_settings, "-c", cmd),  # ruff: ignore[start-process-with-partial-path]
                     cwd=code_path,
+                    check=False,
                     capture_output=True,
                     timeout=self.settings.code_timeout_seconds,
                     user=self.settings.user,

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/tests/unit/code_executor/test_failure.py

@@ -57,11 +57,11 @@ from mcp_run_isolated_python.code_executor import CodeExecutionResult, CodeExecu
         ),
         pytest.param(
             """
-            import requests
-            requests.get("https://www.google.com")
+            import httpx2
+            httpx2.get("https://www.google.com")
             """,
             "",
-            """OSError: Tunnel connection failed""",
+            """httpx2.ProxyError: 403 Forbidden""",
             id="network request",
         ),
     ],

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/tests/unit/test_cli.py

@@ -13,7 +13,7 @@ async def test_cli_starts_mcp_server():
     # test that the MCP server is up by sending a request
     try:
         async with Client("http://localhost:6400/mcp") as client:
-            await client.ping()
+            await client.list_tools()
 
     # stop MCP server
     finally:

{mcp_run_isolated_python-0.1.0 → mcp_run_isolated_python-0.2.0}/tests/unit/test_mcp_server.py

@@ -18,8 +18,6 @@ async def test_start_mcp_server(settings: FullSettings):
     # test that the MCP server is up by sending a request
     try:
         async with Client("http://localhost:6400/mcp") as client:
-            await client.ping()
-
             tools = await client.list_tools()
             assert len(tools) == 1