AI导哈

命令沙箱MCP服务器

一款为AI编码代理提供安全bash命令执行环境的MCP服务器，通过白名单校验和沙箱隔离，适用于需要无提示运行命令的开发场景。

  • by gartnera
  • Go
  • 本地部署
  • 3 星标
  • 更新于
在 GitHub 查看 gartnera/lite-sandbox-mcp

使用说明

lite-sandbox-mcp

An MCP (Model Context Protocol) server that gives AI coding agents a bash tool to use instead of their built-in shell. Agents can run commands without a permission prompt for each one. Every command is parsed into an AST, checked against a whitelist, and then run by a shell interpreter that re-checks paths after variable expansion.

Quick start

curl -fsSL https://github.com/gartnera/lite-sandbox/raw/main/install.sh | sh
lite-sandbox install

Restart your agent CLIs after lite-sandbox install. The script downloads the prebuilt binary for Linux or macOS (amd64/arm64) from the latest GitHub release. With a logged-in GitHub CLI (2.67+), it uses gh to download and verify the release's build provenance attestation; otherwise it checks the download against checksums.txt. See docs/installation.md for options. lite-sandbox update upgrades an installed binary to the latest release, and lite-sandbox version shows the current one.

The default is the strictest mode: only whitelisted commands run, and toolchain profiles (Go, Rust, uv, ...) are opt-in. To start looser and tighten over time, see docs/adoption.md.

install detects which supported agent CLIs are installed (Claude Code, OpenAI Codex CLI, opencode, Crush, and Grok Build), by looking for the binary on PATH or the config directory. For each one it registers the MCP server, auto-allows the sandbox tools, blocks the built-in shell tool, and adds a directive telling the agent to use the sandbox for shell commands. Name agents to configure only those:

lite-sandbox install                       # autodetect claude / codex / opencode / crush / grok
lite-sandbox install codex                 # configure only Codex
lite-sandbox install claude opencode       # configure exactly these
lite-sandbox install codex --with-tool-hook # also confine reads/writes (incl. apply_patch) to the sandbox paths
lite-sandbox install grok                  # Grok Build: its file tools are always confined to the sandbox paths

To try the sandbox without changing any agent configuration, use launch. It runs the agent sandboxed for one session and doesn't touch your setup.

lite-sandbox launch claude

All agents share one sandbox config file. See docs/installation.md for manual setup, hook modes, and per-agent caveats.

Documentation

  • Incremental adoption: the other enforcement modes, audit reports, and tightening over time.
  • Installation: getting and updating the binary, automatic and manual agent setup, built-in tool boundaries, and hook modes.
  • Configuration: the config file, CLI management, readable/writable paths, and git support.
  • Toolchain profiles: the built-in sandboxed Python, and enabling Go, pnpm, Rust, Deno, Flutter, Xcode, uv, and the GitHub CLI.
  • AWS & Docker access: brokered AWS credentials and the filtering Docker proxy.
  • SSH access: ssh and sshpass to the hosts you list, and a filtered ssh agent for them and git's remote commands.
  • Background processes: running and managing long-lived commands.
  • Interactive shell: lite-sandbox shell, a shell for you that runs commands under the sandbox's rules.
  • Security model: validation layers, the optional OS sandbox, and known limitations.
  • Development: building, testing, the e2e suite, and the release flow.

相关 MCP