That line is drawn on purpose: the server binds existing team secrets to a sandbox under an environment variable, and secret_list returns metadata only — raw values stay in the SDK and console rather than an agent transcript. Combine that with per-sandbox egress rules and the network log, and an agent running unreviewed code has a boundary you can inspect afterwards.
An MCP server for Superserve sandboxes: isolated Firecracker microVMs created, driven and destroyed from any MCP client, targeted per call by sandbox id.
- sandbox_create, sandbox_list, sandbox_info, sandbox_update and sandbox_kill — lifecycle, with metadata filters and egress rules you can change after creation
- sandbox_exec — run a shell command and get stdout, stderr and the exit code; it auto-resumes a paused sandbox
- sandbox_files_read, sandbox_files_write, sandbox_files_list and sandbox_files_download_dir — file access, with a 1 MiB read cap, 8 MiB inline write cap and 10 MiB zipped directory download
- sandbox_pause and sandbox_resume — state is preserved while paused
- sandbox_preview_url — publish a port and get a public or private signed URL back
- sandbox_network_log — audit what the sandbox connected out to
- sandbox_template_list and sandbox_template_create — prebuilt base images, and custom ones with your own vCPU, memory and disk shape
- secret_list, sandbox_attach_secret and sandbox_detach_secret — bind stored team secrets to a sandbox under an env var; secret creation is deliberately not exposed
A Superserve API key in SUPERSERVE_API_KEY, set in the client's env block — clients do not inherit it from your shell. Runs locally over stdio via npx @superserve/mcp, or as a hosted Streamable HTTP endpoint at https://mcp.superserve.ai with the key as a bearer token. The hosted endpoint does not support OAuth yet, so clients that require it will not connect.
One command plus a key — npx -y @superserve/mcp, then supply credentials