MCP server providing programmatic control over Windows Sandbox on Windows 11 24H2 or later
Windows Sandbox MCP has clear tool names and basic descriptions, but suffers from critical gaps in schema completeness, parameter documentation, and error handling. Most tools lack structured output schemas, responses are plain strings rather than typed objects. Parameter descriptions exist but are minimal (avg ~40 chars, well below the 72-char baseline). No enum constraints on constrained inputs (e.g., 'runAs' accepts free-form strings instead of an enum). Error messages are generic strings rather than actionable recovery guidance. The server exposes Windows-specific functionality with reasonable naming (StartSandbox, ExecuteInSandbox, StopSandbox), but lacks the structured, LLM-optimized definitions expected of production tools.
Adds a shared folder to the running Sandbox.
Executes a command in the running Sandbox.
Gets network information for the running Sandbox.
Checks if the Sandbox remote session window is currently opened.
Checks if a Sandbox is currently running.
Opens a window that accesses the currently running Windows Sandbox session.
Starts a new Windows Sandbox. Only one sandbox can run at a time.
Stops the running Sandbox.
No structured output schemas documented. All tools return plain strings ('Sandbox started successfully.', 'Command execution request sent in sandbox.') instead of typed objects with fields. LLMs cannot extract structured data or chain results to downstream tools.
Parameter 'runAs' in ExecuteInSandbox accepts free-form strings ('ExistingLogin' or 'System') but is not declared as an enum. LLMs may hallucinate invalid values like 'Admin' or 'User'. Should be: enum=['ExistingLogin', 'System'].
Error responses are generic strings without recovery guidance. E.g., 'No running sandbox found. Please start a sandbox first.' does not tell the LLM to call StartSandbox. Should be: 'No running sandbox found. Call StartSandbox() first to initialize.'
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 47 | 2026-07-28+ | v2 |
Tool name 'OpenSandboxRemoteSessionWindowAsync' violates verb_noun convention and is 40+ chars (baseline p90=27). Rename to 'open_sandbox_session' or 'connect_to_sandbox'. Async suffix should not appear in tool names, it's an implementation detail.
Parameter descriptions are minimal (avg ~40 chars vs. 72-char baseline). E.g., 'Whether to enable vGPU' lacks context on when to use it or what impact it has. Expand to: 'Enable GPU virtualization for graphics-intensive tasks. Requires compatible hardware. Default: disabled.'