Every sandbox was created privileged under the daemon's default runtime, and the setting that would have changed it defaulted to an empty string that silently meant runc. For a service whose whole premise is running code somebody else wrote, that is not a boundary. An org sets its isolation and the create request carries it, so a sandbox records what it was made with: changing the policy moves new sandboxes and leaves running ones alone. gvisor is the default. firecracker is delivered through kata's shim, which is why it is one name rather than two. runc is refused unless the runner names that org, and an empty list names nobody. Absent means the default, unknown is a refusal, and a runtime the daemon does not have is a refusal. Nothing substitutes quietly. The runner took an organization in a field called UserId with a note beside it saying so. Deciding who may have runc through a field named after something else is not reviewable. Privileged is replaced by dropping everything and granting the eight the daemon uses. Nothing the sandbox does broke; what stopped working is mount, mknod, raw sockets, chroot, writing to proc, and seeing the host's disks. AUDIT_WRITE is among them because without it sudo works and complains every time. The creation histogram's lowest bucket was a tenth of a second, so the metric could not observe the claim the product makes about its own speed. It can now, and it carries the isolation, so comparing them is a query. Co-authored-by: Hanzo Dev <[email protected]>
Runtime MCP (Model Context Protocol) Server
Runtime MCP Server allows AI agents to utilize:
- Hanzo Runtime Sandbox Management (Create, Destroy)
- Execute commands in Hanzo Runtime Sandboxes
- File Operations in Runtime sandboxes
- Generate preview links for web applications running in Hanzo Runtime Sandboxes
Prerequisites
- Runtime account
- Runtime CLI installed
- A compatible AI agent (Claude Desktop App, Claude Code, Cursor, Windsurf)
Steps to Integrate Runtime MCP Server with an AI Agent
- Install the Runtime CLI:
Mac/Linux
brew install hanzoai/cli/runtime
Windows
powershell -Command "irm https://get.hanzo.ai/windows | iex"
- Log in to your Runtime account:
runtime login
- Initialize the Runtime MCP server with Claude Desktop/Claude Code/Cursor/Windsurf:
runtime mcp init [claude/cursor/windsurf]
- Open Agent App
Integrating with Other AI Agents Apps
Run the following command to get a JSON Runtime MCP configuration which you can c/p to your agent configuration:
runtime mcp config
Command outputs the following:
{
"mcpServers": {
"runtime-mcp": {
"command": "runtime",
"args": ["mcp", "start"],
"env": {
"HOME": "${HOME}",
"PATH": "${HOME}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin"
},
"logFile": "${HOME}/Library/Logs/runtime/runtime-mcp-server.log"
}
}
}
Note: if you are running Runtime MCP Server on Windows OS, add the following to the env field of the configuration:
"APPDATA": "${APPDATA}"
Finally, open or restart your AI agent
Available Tools
Sandbox Management
-
create_sandbox: Create a new sandbox with Runtime- Parameters:
id(optional): Sandbox ID - if provided, an existing sandbox will be used, new one will be created otherwisetarget(default: "us"): Target region of the sandboximage: Image of the sandbox (optional)auto_stop_interval(default: "15"): Auto-stop interval in minutes (0 means disabled)auto_archive_interval(default: "10080"): Auto-archive interval in minutes (0 means the maximum interval will be used)auto_delete_interval(default: "-1"): Auto-delete interval in minutes (negative value means disabled, 0 means delete immediately upon stopping)
- Parameters:
-
destroy_sandbox: Destroy a sandbox with Runtime
File Operations
-
upload_file: Upload a file to the Runtime sandbox- Files can be text or base64-encoded binary content
- Creates necessary parent directories automatically
- Files persist during the session and have appropriate permissions
- Supports overwrite controls and maintains original files formats
- Parameters:
id(optional): Sandbox IDfile_path: Path to the file to uploadcontent: Content of the file to uploadencoding: Encoding of the file to uploadoverwrite: Overwrite the file if it already exists
-
download_file: Download a file from the Runtime sandbox- Returns file content as text or base64 encoded image
- Handles special cases like matplotlib plots stored as JSON
- Parameters:
id(optional): Sandbox IDfile_path: Path to the file to download
-
create_folder: Create a new folder in the Runtime sandbox- Parameters:
id(optional): Sandbox IDfolder_path: Path to the folder to createmode: Mode of the folder to create (defaults to 0755)
- Parameters:
-
get_file_info: Get information about a file in the Runtime sandbox- Parameters:
id(optional): Sandbox IDfile_path: Path to the file to get information about
- Parameters:
-
list_files: List files in a directory in the Runtime sandbox- Parameters:
id(optional): Sandbox IDpath: Path to the directory to list files from (defaults to current directory)
- Parameters:
-
move_file: Move or rename a file in the Runtime sandbox- Parameters:
id(optional): Sandbox IDsource_path: Source path of the file to movedest_path: Destination path where to move the file
- Parameters:
-
delete_file: Delete a file or directory in the Runtime sandbox- Parameters:
id(optional): Sandbox IDfile_path: Path to the file or directory to delete
- Parameters:
Git Operations
-
git_clone: Clone a Git repository into the Runtime sandbox- Parameters:
id(optional): Sandbox IDurl: URL of the Git repository to clonepath: Directory to clone the repository into (defaults to current directory)branch: Branch to clonecommit_id: Commit ID to cloneusername: Username to clone the repository withpassword: Password to clone the repository with
- Parameters:
Command Execution
-
execute_command: Execute shell commands in the ephemeral Runtime Linux environment- Returns full stdout and stderr output with exit codes
- Commands have sandbox user permissions
- Parameters:
id(optional): Sandbox IDcommand: Command to execute
Preview
-
preview_link: Generate accessible preview URLs for web applications running in the Runtime sandbox- Creates a secure tunnel to expose local ports externally without configuration
- Validates if a server is actually running on the specified port
- Provides diagnostic information for troubleshooting
- Supports custom descriptions and metadata for better organization of multiple services
- Parameters:
id(optional): Sandbox IDport: Port to exposedescription: Description of the servicecheck_server: Check if a server is running
Troubleshooting
- Authentication issues: Run
runtime loginto refresh your credentials - Connection errors: Ensure that the Runtime MCP Server is properly configured
- Sandbox errors: Check sandbox status with
runtime sandbox list
Support
For more information, visit hanzo.ai or contact support at [email protected].