MCP server that runs code in an E2B sandbox and kills it after every call. Drop-in replacement for the archived @e2b/mcp-server, which creates a sandbox per call and never kills it.
Single tool 'run_code' has a clear, well-written description (169 chars) that explicitly states the stateless, per-call sandbox behavior and irreversible nature. Input schema is properly defined via Zod with type validation. However, the parameter 'code' lacks a description in the schema (only the tool description mentions it), and there is no documented output schema structure. Error handling is minimal, no guidance on recovery or categorization. The tool follows verb_noun naming ('run_code') correctly but lacks composition patterns (no batch variants, no pagination). Overall solid for a single-purpose tool but missing documentation depth expected of production-grade servers.
Run Python code in a fresh, secure E2B sandbox (Jupyter Notebook syntax). The sandbox is created per call and KILLED right after — state does NOT persist between calls, so each snippet must be self-contained.
Parameter 'code' has no description in the input schema. The Zod schema defines it as z.string() but provides no guidance on format, length limits, or constraints. LLMs cannot infer what constitutes valid Python code or whether there are restrictions on imports, execution time, or resource usage.
Output schema is not documented. The tool returns JSON with 'results' and 'logs' fields, but the structure, types, and meaning of these fields are not formally specified. LLMs cannot plan downstream operations or extract data reliably without knowing the response shape.
Error handling lacks recovery guidance. If sandbox creation fails, the API key is invalid, or code execution times out, the error response does not tell the LLM what to do next (e.g., 'Check E2B_API_KEY', 'Reduce code complexity', 'Retry with smaller timeout'). Raw error messages provide no actionable path forward.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
No input validation or constraint documentation. The tool accepts any string as 'code' but does not document limits on code length, execution time, memory usage, or forbidden operations (e.g., network access, file system writes). LLMs may pass code that violates sandbox policies without clear feedback.
No confirmation or dry-run pattern for an irreversible operation. The tool description marks the operation as IRREVERSIBLE (code execution has side effects), but there is no mechanism for the agent to preview results or confirm before execution. This is acceptable for a code interpreter but should be noted as a design trade-off.