Ovrin MCP server

An MCP server that gives MCP-capable clients (Claude Desktop, Claude Code, Cursor, VS Code, …) a real Linux computer on Ovrin: create a sandbox, run shell commands, execute stateful code, and read and write files — from the model.

It is a thin tool layer over the ovrin Python SDK, so accounts, quota, and metering all apply.

Install

pip install ovrin-mcp

Configure

Create a sandboxes-scoped API key in the console (Keys → Create key). A scoped key can only touch /sandboxes/*, so a leaked client config cannot read usage, mint keys, or touch billing.

export OVRIN_API_KEY="ovrin_..."

Claude Desktop / Claude Code

{
  "mcpServers": {
    "ovrin": {
      "command": "ovrin-mcp",
      "env": { "OVRIN_API_KEY": "ovrin_..." }
    }
  }
}

Cursor and VS Code use the same command + env shape.

Tools

Options

ovrin-mcp --help
  --api-key            Ovrin API key (default: OVRIN_API_KEY)
  --base-url           Control plane URL (default: OVRIN_BASE_URL)
  --transport          stdio (default) | sse | streamable-http
  --host               Bind host for sse/streamable-http (default: 127.0.0.1)
  --port               Bind port for sse/streamable-http (default: 8000)
  --default-template   Template when sandbox_create omits one (default: python)
  --default-timeout    Lifetime in seconds when omitted (default: 3600)
  --max-sandboxes      Session cap (default: 5)
  --keep-sandboxes     Do not terminate session-created sandboxes on exit

Remote transport

stdio is the default and what local clients use. To serve multiple clients over the network, run the HTTP transports:

ovrin-mcp --transport streamable-http --host 0.0.0.0 --port 8000
# MCP endpoint: http://<host>:8000/mcp

ovrin-mcp --transport sse --host 0.0.0.0 --port 8000
# SSE endpoint:  http://<host>:8000/sse

Put it behind TLS and an authenticating proxy before exposing it. Each session still holds one OVRIN_API_KEY (the process key), and the session cap and cleanup-on-exit apply per process.

On exit the server terminates the sandboxes it created this session (--keep-sandboxes disables that). Sandboxes you created elsewhere are left alone.