A Runtime sandbox can host MCP servers for your agent. Each server has its own private HTTPS address, and the servers never hold your real API keys. One call starts GitHub, Postgres, a Playwright browser or your own server inside a Firecracker microVM. The sandbox's network rules apply to it (MCP servers in a sandbox).
What a server does
The protocol's documentation describes MCP servers as "programs that expose specific capabilities to AI applications through standardized protocol interfaces". A server offers three kinds of building block. A different party controls each kind:
| Building block | What it is | Controlled by |
|---|---|---|
| Tools | Functions the model decides to call, such as a query | The model |
| Resources | Read-only data for context, such as a file or schema | The application |
| Prompts | Templates a person invokes, such as a slash command | The user |
The client inside an AI application lists a server's tools with tools/list.
It runs one tool with tools/call. The protocol itself is covered in
what is the Model Context Protocol. This
page covers the server end.
How clients connect: stdio or HTTP
| Question | stdio | Streamable HTTP |
|---|---|---|
| Who starts the server | The client, as a subprocess | It runs on its own and serves many clients |
| Wire | Newline-delimited JSON-RPC on stdin and stdout | Each message is an HTTP POST to one MCP endpoint |
| Logs | The server may write them to stderr | Ordinary server logs |
| Replies | One line each on stdout | A JSON object or a request-scoped SSE stream |
| Where it runs | The same machine as the client | Anywhere with an address, such as https://host/mcp |
| Security duties | Those of a local process | Validate Origin, bind to localhost when local, authenticate |
The stdio rules say a server "MUST NOT write anything to its stdout that is not a
valid MCP message". A stray print breaks a stdio server for this reason. A
stdio server runs with its user's permissions on the user's own machine. An
untrusted stdio server is therefore a program that you agreed to run locally.
Host one in a sandbox
Running a server in a sandbox turns a local stdio program into a remote one. Your agent reaches it over HTTP, on a machine that you do not own:
TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();await using sbx = await runtime.sandboxes.create();await sbx.files.write("/workspace/server.py", "# your MCP server, speaking stdio\n");await sbx.mcp.start([ { id: "fetch" }, { name: "mine", command: ["python3", "/workspace/server.py"] },]);const gateway = await sbx.mcp.ready();for (const server of gateway.servers) console.log(server.name, server.url);- Each server gets its own Streamable HTTP URL through a private preview link. Every request also needs the gateway's bearer token.
- A secret setting names a Runtime secret. The server sees a placeholder. The host's proxy adds the value only on HTTPS requests to that secret's hosts (secrets).
- The servers run as the sandbox's user, under its network rules. You can restrict a server that should reach only one API to that API.
runtime.mcp.catalog()lists the ready-made servers with their licenses, pinned versions and the hosts they call.
Runtime is also an MCP server. npx -y withruntime mcp is a stdio bridge to the
remote endpoint https://api.withruntime.com/mcp
(MCP).
Related
Sources
Checked 25 October 2026.
Facts on this page were checked on 25 October 2026.