# MCP server (agent integration)

A Sandbox host **MAY** expose itself as a **Model Context Protocol** server so
that agents (Claude Code, Cursor, Codex, and any MCP client) can run untrusted
code in the sandbox as a tool call. An MCP server is table stakes for an agent
sandbox; the distinguishing feature here is the tool **result**.

## The differentiator: an attested result

Every other agent sandbox returns the program's output. A Sandbox MCP server
returns the output **and a signed, energy-metered receipt of the run**: the
per-device joule receipt (JCR-1), the Ed25519 attestation, and a RATS EAT
(`spec/eat.md`). The agent — or whoever audits it later — gets a verifiable
record of *what ran, at what isolation tier, and what it cost in joules*, signed
by the host. That binding (attested joules per run, delivered through the agent
tool surface) is what no other sandbox tool emits.

## Tools (reference)

`sandbox-mcp` (newline-delimited JSON-RPC 2.0 over stdio) exposes:

- **`run_wasm`** — run a WebAssembly unit (`run: () -> i32`) at tier **S2** under
  explicit capability grants (`cpu_time_ms`, `memory_bytes`, `energy_budget_uj`,
  `kv`, `clock`, `storage_read`/`storage_write` globs, `max_iops`). Agent-supplied
  code is untrusted, so it minimizes to S2. The result is the attested receipt:
  tier, outcome, per-device energy with provenance, `receipt_id`,
  `attestation_id`, the EAT (hex + profile + tier), the metered storage line, and
  the host's verifying keys. The server **verifies** the receipt, attestation,
  and EAT before returning — it hands back nothing it has not checked.
- **`verify_eat`** — verify a Sandbox EAT against a public key and return the
  recovered claims.

The result carries both a human-readable `text` block and MCP
`structuredContent`, so a client can render the receipt or consume it
programmatically.

## Capability mapping

The MCP tool input *is* the capability grant: a field that is not set is not
granted (deny-by-default, SPEC §5). There is no ambient authority — an agent
cannot reach the network, the filesystem, or a subprocess unless the tool call
named it, and whatever it does name is metered and attested.