sandbox-mcp
Give your AI agent a brand-new Windows PC. Then throw it away.
Not your desktop. Not a container pretending to be Windows. A real, disposable Windows 11 machine:
boot it, deploy your app, drive the controls, catch the crash, keep the evidence, delete the PC.
Run it directly with sbx; the optional MCP adapter exposes discoverable tools and inline images for clients that want them.
Both interfaces use the same engine. The measured GUI samples take roughly 40-50 seconds end to end.
See the website.
Real app, real guest: Haptics Everywhere's self-contained WPF/WinForms desktop app in a fresh, network-off Sandbox.
UIA selects the Inspector, the guest switches light to dark, the app relaunches and exits, then the guest is destroyed.
10-second, 183 KB edited footage: light Inspector slowed for readability, repeated dark frames trimmed.
Boot/teardown title cards summarize actual logs, not filmed boot/shutdown.
No guest runtime installation or haptic-hardware claim. Fresh dark lab screenshot ·
Earlier light-theme inspector.
🤖 Let your agent set it up
Give this to your bot. It checks the PC, verifies the download and asks before admin changes or a restart.
The CLI works on its own; configure MCP only if your agent needs that interface:
Set up the sandbox-mcp CLI by following:
https://raw.githubusercontent.com/shanselman/sandbox-mcp/main/docs/agent-setup.md
Install the latest verified release. The CLI must work without MCP; configure the optional MCP adapter only if my agent needs it. Ask before admin changes or a restart.
Download v1.2.0: portable CLI + optional MCP server,
bundled Node.js, guest agent and setup instructions. No Node/npm installation needed.
“Works on my machine.” Caught in 30 seconds.
The dev box had Visual C++ installed. The fresh, network-off customer PC did not:
FAIL NativeProof.exe on a fresh Windows Sandbox (29.8s)
why exited with code -1073741515; Missing dependency: VC++ redistributable.
Opt in to the verified runtime install, then repeat on another fresh guest:
PASS NativeProof.exe on a fresh Windows Sandbox (30.9s)
baseline PROVISIONED (not a clean-machine pass): VC++ redistributable x64
process exited with code 0
Those are actual measured results, not illustrative output.
The installer was Microsoft-signed 14.51.36247.0, downloaded and verified on the host. Guest networking stayed
off. sbx deps app.exe diagnoses; sbx run app.exe --provision auto installs only when explicitly requested.
What your agent gets
| A clean customer PC | A real desktop to drive | Evidence that survives |
|---|
| Fresh on every boot; no implicit app-runtime installs | Native UIA: inspect, type, click, toggle, wait | PNGs, bounded recordings, self-contained HTML, optional MP4 |
| Dependency diagnosis; explicit verified provisioning | WinUI, WPF, WinForms, Win32; MSIX/AUMID activation | Process state, exit codes, crash events, reports |
| Network off / firewall / on | CLI + MCP share state; verified warm incremental deploy | Installer/uninstaller diffs; detonation observations |
Same clean-machine loop, different frameworks:
| WinUI 3, packaged | WPF, self-contained | Native Win32, packaged |
|---|
| | |
These are real offline-guest screenshots, not host mockups. WinUI/WPF were refreshed against the final integrated
source; the full matrix covers seven configurations. Exact builds, timings, startup defects
found and remaining coverage gaps are in the compatibility evidence.
Download/setup · Agent setup guide ·
Measured compatibility and honest limits · CLI and MCP interfaces
This 138 KB animation comes from a new 74-frame guest recording: UIA changes the text, invokes buttons and
increments the counter. The guest was stopped afterward; the HTML viewer, MP4 and frames remained on the host.
No synthetic screenshots. This small fixture proves the automation path; the rich app above shows the real-app use case.
Why
A Windows Sandbox showcase, not a framework gate. WinUI 3 is welcome, but the entry point is a Windows
executable or package, not a particular UI framework. Bring an app that can run in Sandbox and its prerequisites:
Win32, WinForms, WPF, WinUI, console, PyInstaller or Electron builds use the same clean-machine workflow.
Installers and untrusted files have their own audit/detonation workflows. This is not a promise that every
Windows app or hardware-dependent workload works in Sandbox. See the measured compatibility matrix
and small source samples in this matching checkout for the configurations actually exercised.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
