에이전트 강화
게시자의 자체 명령입니다. PlugMCP 엔드포인트가 아닙니다.
Host a copy with our keys and logs.
docker run -i --rm ghcr.io/hrrodan/agent-workspace-mcp:1.4.141Claude Code에는 로컬 명령용 설치 링크가 없습니다. 아래 명령을 복사해 터미널에서 실행합니다.
claude mcp add io.github.hrrodan-agent-workspace-mcp -- docker run -i --rm ghcr.io/hrrodan/agent-workspace-mcp:1.4.141터미널에서 실행합니다.
{ "mcpServers": { "io.github.hrrodan-agent-workspace-mcp": { "command": "docker", "args": [ "run", "-i", "--rm", "ghcr.io/hrrodan/agent-workspace-mcp:1.4.141" ] } }}claude_desktop_config.json
원격 URL인가요, 내 컴퓨터에서 실행하는 명령인가요? 두 설치 방식의 차이
PlugMCP에서 실행
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
실행게시자 제공
A unified Model Context Protocol (MCP) server providing a highly secure, containerized workspace for Large Language Models (LLMs). It acts as an isolated "agentic playground" where agents can autonomously code, test, and debug without risking the host machine.
A sandboxed, agentic workspace providing secure filesystem, bash, and uv-powered Python execution.
uv init, manage dependencies with uv add, and execute via uv run.run_bash outputs (like ls, git, and test runners), saving 60-90% of LLM context tokens.search_and_replace with fuzzy whitespace matching, indentation preservation, dry-run support, and syntax validation for Python, JSON, JSONL, TOML, and YAML.flowchart TD
Client["MCP Client (Claude / Cursor)"] -- "stdio (JSON-RPC)" --> FastMCP["FastMCP Server"]
subgraph Sandbox ["Docker Sandbox Container (mcpuser)"]
direction TB
FastMCP -. "Intercepts accidental prints" .-> StdioGuard["StdoutRedirector"]
FastMCP -. "Application Logs" .-> Logger["Dual Logger (stderr & .mcp/server.log)"]
FastMCP -- "Tool Calls" --> SecurityGuard["Security & Path Validator"]
subgraph Toolset ["Tool Modules"]
direction TB
SecurityGuard --> FSTools["Filesystem (read, write, list, search)"]
SecurityGuard --> EditTools["Editing (search_and_replace)"]
SecurityGuard --> ExecTools["Execution (run_bash)"]
end
EditTools -- "AST Verification" --> Validator["Syntax Validations (Python, JSON, JSONL, TOML, YAML)"]
ExecTools -- "Process Group (Timeout=60s)" --> Shell["/bin/sh Subprocess"]
Shell -- "Package Mgt & Checks" --> UV["uv Environment / Ruff"]
FSTools -- "Secure I/O" --> Workspace["/workspace Directory"]
EditTools -- "Atomic Writes" --> Workspace
Shell -- "Executes within" --> Workspace
end
Workspace <--"Volume Mount"--> HostFS["User Host Filesystem"]
# Pull from GHCR
docker pull ghcr.io/hrrodan/agent-workspace-mcp:latest
# OR: Build locally with your host's UID/GID for optimal permissions
docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g) -t agent-workspace-mcp .
Here is a quick boilerplate showing how to use the containerized workspace programmatically using the standard openai-agents SDK:
import asyncio
from agents import Agent, Runner
from agents.mcp import MCPServerStdio
async def main():
# 1. Configure the MCP Server to run via Docker
server = MCPServerStdio(
name="Sandboxed Workspace",
params={
"command": "docker",
"args": [
"run", "-i", "--rm", "--init",
# "--network", "none", # Network Isolation (optional) - see below
"--memory=2g", "--cpus=2.0",
"--pids-limit=256",
"--cap-drop=ALL", "--security-opt=no-new-privileges:true",
"--read-only",
"--tmpfs", "/tmp:size=64m",
"--tmpfs", "/home/mcpuser/.cache:size=512m",
"--user", "1000:1000", # Replace with your host UID:GID
"-v", "/path/to/your/projects:/workspace",
"ghcr.io/hrrodan/agent-workspace-mcp:latest",
],
},
client_session_timeout_seconds=60.0,
)
# 2. Attach server to the Agent and load the skill instructions (optional)
with open("skills/agent-workspace-mcp/SKILL.md", "r") as f:
skill_instructions = f.read()
agent = Agent(
name="WorkspaceAgent",
instructions=f"You are a coding agent with access to a secure workspace.\n\n{skill_instructions}",
mcp_servers=[server],
)
# 3. Execute a workflow
async with server:
result = await Runner.run(
agent,
"Create a python script in the workspace to print the first 10 Fibonacci numbers, then run it."
)
print(f"Agent's Final Output:\n{result.final_output}")
if __name__ == "__main__":
asyncio.run(main())
Add the following configuration to your claude_desktop_config.json or Cursor settings.
{
"mcpServers": {
"agent-workspace-mcp": {
"command": "docker",
"args": [
"run", "-i", "--rm", "--init",
// "--network", "none", // Network Isolation (optional) - see below
"--memory=2g", "--cpus=2.0",
"--pids-limit=256",
"--cap-drop=ALL", "--security-opt=no-new-privileges:true",
"--read-only",
"--tmpfs", "/tmp:size=64m",
"--tmpfs", "/home/mcpuser/.cache:size=512m",
"--user", "1000:1000",
"-v", "/path/to/your/projects:/workspace",
"ghcr.io/hrrodan/agent-workspace-mcp:latest"
]
}
}
}
[!IMPORTANT] Linux Users: Replace
1000:1000with your actual UID:GID (runid -uandid -g). Claude Desktop does not expand environment variables. Signal Handling: The--initflag is essential for proper signal forwarding and zombie process reaping.
The server supports the following environment variables (passed via Docker --env):
This server employs a defense-in-depth strategy, explicitly separating strict security boundaries from developer experience and operational reliability features.
These features are designed to protect the host system and enforce strict isolation boundaries.
--cap-drop=ALL), neutralizing privilege escalation vectors./app directory containing the server source and its virtual environment is owned by root and read-only for the mcpuser. This prevents the server from modifying itself or being tampered with via run_bash.no-new-privileges:true to prevent any process from gaining elevated rights./workspace.Features focused on seamless integration, usability, and reducing friction during agentic workflows.
mcpuser with UID/GID customizable at build time, eliminating tedious file permission conflicts on host volume mounts.run_bash are transparently rewritten through RTK to provide ultra-compact, LLM-friendly output without altering underlying command behavior..git, .venv) are automatically ignored to keep context windows lean and relevant.--rm), guaranteeing a clean, predictable slate for every new session without state leaking across connections.Features ensuring the structural integrity of the workspace and providing observability.
write_file and search_and_replace perform in-memory syntax validation for Python, JSON, JSONL, TOML, and YAML before persisting changes, preventing broken code states.write_file blocks accidental overwrites of existing files by default and enforces a 5MB size guard to prevent workspace flooding.By default, the container has full network access via Docker's bridge network. For maximum isolation, you can completely disable the network stack using --network none:
docker run -i --rm --init \
--network none \
--memory=2g --cpus=2.0 --pids-limit=256 \
--cap-drop=ALL --security-opt=no-new-privileges:true \
--read-only \
--tmpfs /tmp:size=64m \
--tmpfs /home/mcpuser/.cache:size=512m \
--user 1000:1000 \
-v /path/to/your/projects:/workspace \
ghcr.io/hrrodan/agent-workspace-mcp:latest
This creates a fully air-gapped sandbox — only the loopback interface exists inside the container. All outbound connections (curl, DNS, uv add, etc.) will fail immediately, eliminating data exfiltration and lateral movement risks entirely.
[!NOTE] With
--network none, the agent cannot install packages at runtime. All dependencies must be pre-installed in a custom image or pre-populated in the mounted workspace volume.
uv syncuv run ruff check .uv run pytest tests/ --ignore=tests/integration/OPENROUTER_API_KEY and run uv run pytest tests/integration/© 2026 HrRodan. Licensed under MIT.
A sandboxed, agentic workspace providing secure filesystem, bash, and uv-powered Python execution.
{ "mcpServers": { "io.github.hrrodan-agent-workspace-mcp": { "command": "docker", "args": [ "run", "-i", "--rm", "ghcr.io/hrrodan/agent-workspace-mcp:1.4.141" ] } }}도구
아직 도구 목록이 없습니다. 원격 서버는 첫 상태 확인 후에 도구 목록이 생깁니다.
FAQ
이 페이지에서 Cursor, Claude Desktop, Claude Code 또는 VS Code용 stdio 설정을 복사합니다. PlugMCP 프록시가 아니라 게시자의 설치 방식을 사용합니다.
이 레코드에는 필수 환경 변수가 등록되어 있지 않습니다.
Agent Workspace MCP은(는) stdio를 통해 로컬에서 실행됩니다.
마지막 확인: 2026-11-15. A sandboxed, agentic workspace providing secure filesystem, bash, and uv-powered Python execution.