MCP server

BoxCompute’s remote MCP server lets an AI app create Linux VMs in your account, run commands in them, read and edit their files, and open preview URLs for servers they run.

https://mcp.boxcompute.ai/mcp

You need a BoxCompute account with credit. New customers can join the early-access waitlist.

Connect an app

Apps that support MCP sign-in need only the URL. The first time the app connects, it opens a BoxCompute page in your browser that names the app and what it will be able to do. Choose Allow access to connect it, or Cancel to refuse.

claude mcp add --transport http boxcompute https://mcp.boxcompute.ai/mcp

What an app can do

The sign-in page lists what you grant:

Allowing access creates an API key named after the app, such as MCP · Claude, on your API keys page. The app acts as that key: its requests appear in your API activity and the VMs it creates are attributed to it. Revoke the key to disconnect the app. Connecting again asks you to allow it again.

Use an API key instead

Every client can authenticate with a BoxCompute API key in the Authorization header. The key’s scopes decide which tools the client is offered.

claude mcp add --transport http boxcompute https://mcp.boxcompute.ai/mcp \
  --header "Authorization: Bearer $BOXCOMPUTE_API_KEY"

For Cursor (~/.cursor/mcp.json) and similar clients:

{
  "mcpServers": {
    "boxcompute": {
      "url": "https://mcp.boxcompute.ai/mcp",
      "headers": { "Authorization": "Bearer ${env:BOXCOMPUTE_API_KEY}" }
    }
  }
}

VS Code uses the same entry in .vscode/mcp.json, under servers instead of mcpServers. Keep the key in an environment variable or secret store, not in a file you commit.

Tools

sandbox_create accepts optional disk_gib, a whole number from 10 to 30, defaulting to 30. Below 30 requires early access; other accounts receive INVALID_REQUEST. The disk is fixed for the VM’s lifetime and counts in full against account storage even when stopped. sandbox_list and sandbox_get return disk_gib: null for older VMs whose disk size was not recorded. Do not infer those disks’ sizes from today’s default.

Each tool is marked read-only or not, and destructive or not, so your app can ask before it stops, deletes or changes anything. These annotations describe the requested operation, not a guarantee that compute stays stopped: file_read and file_list can start a stopped VM and incur compute charges, even though they do not change its files. sandbox_list and sandbox_get never start it.

Limits

• Every call answers within about 75 seconds. A VM that is still booting returns ready: false from sandbox_create or sandbox_start, and the boot continues; commands and file tools on it say it is still starting, and can be called again a few seconds later.
• Commands longer than 60 seconds belong in process_start.
• Files are confined to /workspace. file_read defaults to 64 KiB and allows up to 256 KiB per part; pass next_offset and the returned cursor to continue. Binary data is base64. file_list defaults to 200 entries and allows up to 500 per page; pass its cursor to continue.
• command_run output is capped at 48 KiB per stream. process_start retains up to 1 MiB per stream; process_output reads up to 48 KiB at a time. Pass next_offset back to continue; earliest_offset identifies output already discarded.
• A preview URL is public: anyone with it can reach that port until it expires.
• Account limits on running and total VMs apply as they do in the app and the HTTP API.

Errors carry the same codes as the HTTP API, such as INSUFFICIENT_CREDIT or NOT_FOUND, with a message the app can act on.

Privacy and support

The app receives the output of the tools it calls, such as command output and file contents, and handles it under its own terms. BoxCompute records each request in your API activity without the tool’s arguments. See the privacy policy.

For help, email [email protected]. Do not include API keys or passwords in your message.