sandbox-mcp

sandbox-mcp is an open-source MCP server and CLI (sbx) created by Scott Hanselman. It automates Windows Sandbox so an AI agent or a person can boot a clean Windows 11 machine, deploy an app, drive its UI, collect evidence and then delete the machine. The latest listed release is v1.2.0, a portable Windows x64 ZIP that bundles Node.js.

What It Is

sandbox-mcp wraps the Windows Sandbox feature (Windows 11 24H2 or later, Pro, Enterprise or Education) in an engine that adds app deployment, UI Automation, screenshots, recordings and reports. The sbx CLI is the complete standalone interface. The MCP adapter is optional and exposes the same engine as discoverable tools with inline screenshots, for clients such as GitHub Copilot, Claude, Cursor and VS Code.

Core Workflows

• Clean-machine app tests: sbx run copies in an app, launches it, can run a PowerShell test script that uses UI Automation, and reports failures such as a missing VC++ redistributable. It also accepts MSIX and Appx packages.
• Installer testing: sbx install-test snapshots a fresh guest, installs, uninstalls, and lists files, registry keys, services, scheduled tasks and autoruns left behind.
• Untrusted files: sbx detonate runs a file with no network or a blocking firewall and reports processes, name lookups, connection attempts and persistence. The docs describe findings as heuristics, not a verdict.
• Warm inner loop: sbx start and sbx deploy push only changed files into a running sandbox, with SHA256 verification.

Evidence and Control

Each run keeps screenshots, reports, copied-out files and an audit log on the host after the guest is destroyed. Recording produces an HTML viewer and an MP4 when host ffmpeg is available. Network modes are on, firewall, or off, where off means no network adapter and control goes through an encrypted shared-folder mailbox. Dependency diagnosis (sbx deps) is a static host scan. Runtime provisioning is opt-in only and reports mark such runs as not clean-machine tests.

Limits to Know

Only one sandbox can run at a time, a logged-in Windows x64 host is required, and hosted CI runners cannot boot one. Not every Windows app or hardware-dependent workload will run. The project advises a dedicated machine for real malware analysis, since the isolation is strong but not a guarantee.