Overview

The Daytona MCP (Model Context Protocol) server provides a lightweight, low-latency runtime for executing AI-generated code inside isolated sandboxes. It is designed to accept short-lived execution requests from LLMs or other automation systems, run the code safely and quickly, and return results for use in downstream pipelines. The MCP server emphasizes speed, reproducibility, and compliance by combining resource isolation, strict execution limits, and an API-first design suitable for integration with model-led agents and developer tooling.

Typical usage patterns include running snippets produced by large language models for validation, running untrusted or third-party code safely, and scaling many small executions concurrently for evaluation or CI-like workflows. The server exposes a simple HTTP/CLI interface, configurable execution sandboxes (languages, mounts, resource limits), and operational endpoints for metrics and health checks.

Features

Fast, low-latency execution for short-lived code snippets
Process and file-system isolation for secure sandboxing
Language sandboxes (examples: Python, Node/JavaScript, shell) and pluggable runtimes
Request-level resource limits (CPU, memory, walltime)
Simple HTTP API and CLI for submitting jobs
Configurable mounts and input/output capture
Health, metrics, and logging endpoints for observability
Designed for horizontal scaling and integration with model orchestration

Installation / Configuration

You can run the MCP server from source, as a built binary, or inside Docker. The examples below assume you have a built binary named daytona-mcp or the Docker image available.

Build from source (example):

git clone https://github.com/daytonaio/daytona.git
cd daytona/apps/cli/mcp
# build the binary (tooling depends on repository; adjust as needed)
go build -o daytona-mcp .

Run the server locally:

./daytona-mcp --config ./config.yaml

Run with Docker (example):

docker run --rm -p 8080:8080 \
  -v /var/daytona/sandboxes:/sandboxes \
  ghcr.io/daytonaio/daytona-mcp:latest \
  --config /sandboxes/config.yaml

Example minimal YAML configuration (config.yaml):

server:
  host: 0.0.0.0
  port: 8080
  api_key: "your-api-key"   # optional: use for request authentication

sandboxes:
  - name: python3
    image: python:3.11-slim
    cmd: ["python", "-u"]   # command to run snippets
    timeout_seconds: 5
    memory_mb: 256
    cpu_shares: 128
  - name: node
    image: node:20-slim
    cmd: ["node"]
    timeout_seconds: 5
    memory_mb: 256

Configuration options (common):

Option	Description
server.port	HTTP port for the MCP API
server.api_key	Optional shared key for simple auth
sandboxes[].name	Logical sandbox identifier
sandboxes[].image	Base runtime or container image
sandboxes[].timeout_seconds	Max execution wall time per request
sandboxes[].memory_mb	Memory cap for sandbox
sandboxes[].cmd	Command used to execute code inside the sandbox

Available Resources

The MCP server typically exposes the following HTTP endpoints:

POST /execute — Submit a code execution request (language/sandbox, source, inputs, mounts)
GET /status — Application health/status
GET /metrics — Prometheus-compatible metrics
GET /sandboxes — List configured sandboxes and capabilities

Example /execute request payload (JSON):

{
  "sandbox": "python3",
  "source": "print('hello from mcp')",
  "stdin": "",
  "timeout_seconds": 2,
  "env": {"FOO": "bar"}
}

Example curl call:

curl -X POST http://localhost:8080/execute \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your-api-key" \
  -d '{"sandbox":"python3","source":"print(2+2)"}'

Example response:

{
  "exit_code": 0,
  "stdout": "4\n",
  "stderr": "",
  "duration_ms": 42,
  "timed_out": false
}

Use Cases

Model output validation: Run small code snippets proposed by an LLM to verify output correctness before including them in a response or patch. Example: compile/run generated unit tests or sample scripts.
Safe evaluation of untrusted code: Provide an API for customer-facing assistants to run user-submitted code with strict limits and no network access, returning sanitized outputs.
Automated scoring and CI: Execute many short tasks concurrently to evaluate model-generated solutions in a reproducible sandboxed environment (e.g., grading code answers).
Plugin/agent execution backend: Use MCP as the execution runtime for an agent that needs to run ephemeral tooling (formatters, small scripts, data transformations) as part of a multi-step workflow.
Performance testing: Measure LLM-assisted code modifications by executing variations quickly across many sandboxes.

Operational Notes

Security: Run the server with least privilege and isolate sandboxes with kernel isolation (containers or namespaces). Configure no-network or restricted network for untrusted workloads.
Observability: Expose /metrics to scrape execution counts, latencies, timeouts, and failure rates. Aggregate logs externally.
Scaling: Deploy multiple MCP instances behind a load balancer or use a job queue/worker pattern for high throughput. Use per-sandbox concurrency limits to avoid resource exhaustion.
Cleanup: Ensure ephemeral files from sandboxes are removed between runs; configure mounts as read-only where possible.

For full source, examples, and the latest flags, see the repository: https://github.com/daytonaio/daytona/tree/main/apps/cli/mcp

Daytona MCP Server for Fast Secure AI Sandboxes