Secure Grid Genesis Execution

An open-source, lightweight, and ultra-secure Model Context Protocol (MCP) Server designed to run arbitrary Python, JavaScript (Node.js), and Bash code in a highly restricted local Docker container.

This repository allows AI agents (like Claude Desktop, Antigravity, or Cursor) to test and run code locally without risking damage to the host system.

---

🔒 Security Features (Strict Sandbox Isolation)

When an AI agent requests to execute code, the server:

1. Air-Gaps Execution: Disables all network access (network_mode="none") inside the container to prevent data exfiltration, reverse shells, or local network scanning.
2. Mounts Read-Only Workspace: Mounts the host directory as a read-only (ro) volume, ensuring that scripts can read workspace context but cannot delete, rewrite, or modify host files.
3. Applies CPU & Memory Caps: Caps memory consumption to 256MB and restricts compute resources to 1 CPU core to prevent denial-of-service (DoS) exploits or memory leaks.
4. Runs as Non-Root User: Forces execution as a restricted user (sandboxuser with UID 10001) inside the container to prevent container breakout vulnerabilities.

---

🚀 Setup & Installation

1. Prerequisites

• Python 3.10+
• Docker Desktop (Make sure the Docker daemon is running on your system)

2. Clone and Install Dependencies

git clone https://github.com/yourusername/secure-grid-genesis-execution.git
cd secure-grid-genesis-execution
pip install -r requirements.txt

3. Build the Sandbox Container

Build the isolated environment image:

docker build -t secure-grid-sandbox -f Dockerfile.sandbox .

4. Run Automated Containment Tests

Run the test script to verify that the sandbox correctly blocks file writes and network connections:

python test_sandbox.py

---

🛠️ Registering the MCP Server

Add the following to your AI client's configuration file to register the server.

For Claude Desktop

Add this to %APPDATA%\Claude\claude_desktop_config.json (Windows) or ~/Library/Application Support/Claude/claude_desktop_config.json (macOS):

{
  "mcpServers": {
    "secure-grid-genesis-execution": {
      "command": "python",
      "args": [
        "C:\\path\\to\\secure-grid-genesis-execution\\secure_executor.py"
      ]
    }
  }
}

(Make sure to replace the path with the absolute path where you cloned the repo)

For Google Antigravity

Add this to ~/.gemini/config/mcp_config.json:

{
  "mcpServers": {
    "secure-grid-genesis-execution": {
      "command": "python",
      "args": [
        "C:\\path\\to\\secure-grid-genesis-execution\\secure_executor.py"
      ]
    }
  }
}

---

🛠️ Exposed MCP Tools

The server exposes three tools to the AI agent:

1. execute_python(code): Safely executes a Python snippet.
2. execute_node(code): Safely executes JavaScript code inside Node.js.
3. execute_bash(command): Runs shell commands in a sandboxed Linux environment.