A Runtime sandbox can host your own MCP server for your agent, at a private HTTPS address. Start the server as a process inside a Firecracker microVM and share its port with a preview. The sandbox's network rules apply to it (MCP servers in a sandbox).
What a server does
The protocol's documentation describes MCP servers as "programs that expose specific capabilities to AI applications through standardized protocol interfaces". A server offers three kinds of building block. A different party controls each kind:
| Building block | What it is | Controlled by |
|---|---|---|
| Tools | Functions the model decides to call, such as a query | The model |
| Resources | Read-only data for context, such as a file or schema | The application |
| Prompts | Templates a person invokes, such as a slash command | The user |
The client inside an AI application lists a server's tools with tools/list.
It runs one tool with tools/call. The protocol itself is covered in
what is the Model Context Protocol. This
page covers the server end.
How clients connect: stdio or HTTP
| Question | stdio | Streamable HTTP |
|---|---|---|
| Who starts the server | The client, as a subprocess | It runs on its own and serves many clients |
| Wire | Newline-delimited JSON-RPC on stdin and stdout | Each message is an HTTP POST to one MCP endpoint |
| Logs | The server may write them to stderr | Ordinary server logs |
| Replies | One line each on stdout | A JSON object or a request-scoped SSE stream |
| Where it runs | The same machine as the client | Anywhere with an address, such as https://host/mcp |
| Security duties | Those of a local process | Validate Origin, bind to localhost when local, authenticate |
The stdio rules say a server "MUST NOT write anything to its stdout that is not a
valid MCP message". A stray print breaks a stdio server for this reason. A
stdio server runs with its user's permissions on the user's own machine. An
untrusted stdio server is therefore a program that you agreed to run locally.
Host one in a sandbox
Running a server in a sandbox puts it on a machine that you do not own. Your agent reaches it over HTTP. The server must serve MCP over Streamable HTTP:
TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();await using sbx = await runtime.sandboxes.create();await sbx.spawn("python3 /workspace/server.py --port 8000");const preview = await sbx.previews.create(8000);console.log(preview.url, preview.token); // send the token as x-runtime-preview-token- The preview is private. Every request needs its token.
- The server can use a Runtime secret. It sees a placeholder. The host's proxy adds the value only on HTTPS requests to that secret's hosts (secrets).
- The server runs as the sandbox's user, under its network rules. You can restrict a server that should reach only one API to that API.
Runtime is also an MCP server. npx -y withruntime mcp is a stdio bridge to the
remote endpoint https://api.withruntime.com/mcp
(MCP).
Related
Sources
Checked 25 October 2026.
Facts on this page were checked on 25 October 2026.