MCP server category
Code execution MCP servers: comparison and full list
The Code execution category lists 32 open-source MCP servers, checked on GitHub. The best scored on our grid are Container use, LLM Sandbox, and Tidewave Phoenix. 72% received a commit in the last three months.
What Code execution MCP servers are for
Code execution MCP servers let an AI agent run programs, tests, or analyses in an available runtime. They serve developers, researchers, and people who want to check an answer through computation. MATLAB MCP Server connects coding agents to MATLAB for code execution, testing, and analysis. LLM Sandbox offers execution in isolated containers. Superserve supports creating and managing Firecracker microVMs. You might ask: “Run this script against the sample files, explain the error, and test the proposed fix in the same environment.” The useful result includes both the program’s output and enough execution context for you to assess what happened.
Example uses:
- Run a script against sample data to check its output before applying it to real files.
- Execute a project’s tests after a change and report failures relevant to the debugging task.
- Reproduce an exception in an isolated environment to inspect the behavior of the affected program.
- Perform a MATLAB analysis and retain the outputs needed to review the agent’s interpretation of results.
The category in figures
Of the 32 servers in the category (1% of the directory), 3 are official vendor implementations, 78% declare a licence, 3 offer a remote server and 8 need at least one API key or token according to the MCP registry. The median repository has 78 stars.
All Code execution MCP servers
Click a header to sort. Score out of 100: adoption, maintenance and framework (licence, registry, official status); risk: system access, secrets, licence, abandonment.
| Server | Stars | Last commit | Licence | Risk | Score |
|---|---|---|---|---|---|
| Container use Containerized environments for coding agents: each agent works in its own fresh container and git branch, with execution history and termina | 4,079 | Sep 21, 2026 | Apache-2.0 | moderate | 76 |
| MATLAB MCP Server Connect AI coding agents to MATLAB. Run code, tests, and analysis via MCP. | 1,716 | Oct 15, 2026 | — | high | 67 |
| LLM Sandbox Securely run LLM-generated code in isolated containers across 7 languages and 3 container backends. | 1,137 | Oct 24, 2026 | MIT | moderate | 76 |
| Tidewave Phoenix Runtime-level MCP server for Phoenix development: run code, read logs, query the DB, read docs. | 858 | Oct 23, 2026 | Apache-2.0 | moderate | 74 |
| Tidewave Rails Runtime-level MCP server for Rails development: run code, read logs, query the DB, read docs. | 476 | Sep 15, 2026 | Apache-2.0 | moderate | 67 |
| Superserve MCP server for Superserve sandboxes: create, exec, and manage Firecracker microVMs | 466 | Oct 24, 2026 | Apache-2.0 | high | 72 |
| IPhone Use Drive a real iPhone from a Mac: read the screen as text, tap, type, scroll, replay saved flows. | 345 | Oct 24, 2026 | — | high | 60 |
| OrcaReplay Read, replay and fork recorded coding-agent runs. | 281 | Oct 1, 2026 | Apache-2.0 | moderate | 69 |
| MCP server code runner Code Runner MCP Server which can run code in various programming languages. | 242 | Feb 5, 2026 | MIT | moderate | 49 |
| Openapi MCP Access any API through its existing OpenAPI documentation. | 198 | Mar 21, 2026 | — | high | 38 |
| Argon Versioned MongoDB sandboxes for AI agents: branch, time-travel, merge, and undo over MCP. | 176 | Oct 19, 2026 | MIT | moderate | 67 |
| Node code sandbox MCP Run JavaScript snippets in isolated Docker sandboxes with on-the-fly npm dependency installation and clean teardown. | 158 | Nov 24, 2025 | — | high | 37 |
| Imap MCP server IMAP/SMTP MCP server to search, read, organize, send, reply & forward email for AI assistants | 112 | Oct 22, 2026 | MIT | moderate | 65 |
| Flow nexus Cloud-powered AI platform with multi-agent swarms, sandboxes, and workflow automation | 106 | Sep 10, 2025 | — | high | 27 |
| Godot MCP enhanced Enhanced Godot 4.5-4.7 MCP: headless+editor+bridge, secure GDScript sandbox, closed-loop AI dev. | 103 | Oct 23, 2026 | — | high | 55 |
| ExecBro Gives AI agents eyes and hands into running React Native apps: logs, REPL, tap, screenshots | 80 | Oct 22, 2026 | — | high | 60 |
| Ipybox Unified execution environment for Python code, shell commands, and programmatic MCP tool calls | 76 | Jun 11, 2026 | Apache-2.0 | moderate | 52 |
| Workflowy Create, update, complete nodes, search & replace with regex and dry run, usage reports, transforms | 72 | Aug 14, 2026 | MIT | high | 59 |
| Mailtrap Official MCP Server for Mailtrap | 66 | Oct 21, 2026 | MIT | high | 69 |
| MCP v8 JavaScript sandbox that uses V8 isolation to run AI-generated code locally, with heap snapshotting for persistent sessions. | 62 | Oct 23, 2026 | AGPL-3.0 | moderate | 68 |
| Chatroost — unofficial Telegram MCP server Unofficial Telegram MCP server — read, search, reply and react in your own Telegram account. | 56 | Oct 21, 2026 | MIT | high | 62 |
| Sema MCP tools for Sema — eval, compile, build, format, and docs for a Lisp with LLM primitives. | 55 | Oct 22, 2026 | MIT | moderate | 68 |
| MCP server js ◆ Run LLM-generated code in a YepCode sandbox and create custom MCP tools in JavaScript or Python with npm and PyPI packages. | 47 | Mar 17, 2026 | MIT | moderate | 52 |
| Outsource MCP Delegate tasks to other AI providers' models, e.g. ask OpenAI to generate an image. | 30 | May 28, 2025 | MIT | high | 32 |
| Srunx Submit SLURM jobs, run YAML workflows, monitor GPU resources, manage SSH profiles and sync files with local or SSH-remote HPC clusters. | 24 | Sep 13, 2026 | Apache-2.0 | moderate | 54 |
| Edict Agent-oriented programming language: agents emit a JSON AST that the compiler validates, type- and effect-checks, verifies with Z3/SMT and c | 13 | Oct 17, 2026 | MIT | moderate | 61 |
| Prolog Reasoner SWI-Prolog execution for LLMs with CLP(FD), negation as failure and recursion. | 12 | May 1, 2026 | MIT | moderate | 49 |
| Piston MCP Execute code through the Piston remote code execution engine. | 9 | Feb 22, 2026 | MIT | moderate | 35 |
| Codecalc Code and logic calculator with an offline core: run code, exact symbolic math, SMT/logic and complexity analysis, with optional gVisor/AppCo | 5 | Oct 24, 2026 | Apache-2.0 | moderate | 57 |
| Jobd Self-hostable GPU-aware job broker: dispatch long-running or GPU jobs that outlive the session, route them by VRAM tier and monitor them acr | 5 | Oct 24, 2026 | MIT | high | 57 |
| Reachpad MCP ◆ Persistent cloud dev environments for coding agents: create, run commands, checkpoint and fork, with files, services and terminal state kept | 3 | Sep 4, 2026 | MIT | high | 60 |
| Sandbox as a Service ◆ Dedicated Linux VM sandboxes for untrusted, model-generated code: run commands, move files, expose a preview URL and destroy the VM. | 0 | Sep 8, 2026 | MIT | high | 55 |
Official servers
Published by the service's own vendor (per the awesome-mcp-servers list): they usually track the API closely and are better maintained.
- MCP server js 47 ★
- Reachpad MCP 3 ★
- Sandbox as a Service 0 ★
Choosing and securing
Check support for the languages, dependencies, and tools your tasks require. Examine isolation mechanisms, mounted directories, network access, and resource limits. Compare local and hosted execution against file confidentiality requirements. Review maintenance, licensing, and cleanup behavior. Readable logs and documented runtime details help you understand outputs and reproduce failures. Also check whether environments persist between calls, since retained state can affect subsequent runs and expose earlier data.
Executed code may read files, contact external services, or change its environment. Isolation offers limited protection when secrets, sensitive mounts, or excessive privileges remain available. Use test data, restrict resources, and control outbound connections. Project scripts and dependencies may contain malicious behavior. Require approval for sensitive external access, and check how temporary environments are removed. Avoid assuming that an environment called a sandbox has a particular security configuration.
Before connecting a server to an agent with access to your data, run the AI agent security check.
Most recent
- OrcaReplay created August 29, 2026
- Sandbox as a Service created August 22, 2026
- Reachpad MCP created August 12, 2026
- Codecalc created August 7, 2026
- IPhone Use created June 9, 2026
Other categories
Learn more
Frequently asked questions
What is the best Code execution MCP server?
On our grid (adoption, maintenance, framework), Container use (76/100), LLM Sandbox (76/100), and Tidewave Phoenix (74/100) come first. The right choice mostly depends on the service you need and the rights you are willing to grant.
Are these servers free?
78% declare an open-source licence and are free to use. 8 need an API key: the connected service may be paid.
Does using a container make arbitrary code safe?
A container provides separation, but its configuration determines the actual protection. Mounted files, elevated privileges, and network connections may still expose your environment. Inspect what the code can reach and use test data. Choose isolation based on how much you trust the code and the consequences of a failure.
Will the agent get the same result as my computer?
Not necessarily. Library versions, environment variables, available files, and runtime settings can change results. Ask for relevant execution details when the server provides them. To reproduce a problem, align dependencies and configuration with the target environment, then check the observed behavior rather than relying only on successful execution.
Related articles
- Build your own MCP server in 30 minutesOctober 24, 2026
- Automate your inbox with an AI agentOctober 18, 2026
- MCP, A2A, and tool calling: agent protocols explainedOctober 17, 2026
- Build an AI agent with n8n, without codingOctober 16, 2026
Neutrality. No affiliate links. No vendor pays to be reviewed, rated or ranked. Reviews are directed by François Chollet, neutral and factual, and every data point is dated and sourced. How we score