Python executor MCP server
An MCP server that lets AI agents run Python code, with the dangerous parts blocked.
An agent sends Python code as an MCP tool call. Before anything runs, the server parses the code into a syntax tree with Python's ast module and walks it, refusing imports of modules like os, subprocess and socket, calls to built-ins like open, eval and exec, and access to risky attributes.
Code that passes runs with a cut-down set of built-ins, and everything it prints is captured and sent back to the agent as the tool's result. The server talks over stdio with FastMCP and ships in a Docker image.
AI agent
Sends code to run
Safety check
Walks the syntax tree
Runner
Limited built-ins, output captured
- AI agent and Safety check: tool call
- Safety check and Runner
See it work
What came back
| Code sent | Response |
|---|---|
| nums = [3, 1, 2] print(sorted(nums), sum(nums)) | Output: [1, 2, 3] 6 |
| import os print(os.listdir('/')) | Safety Error: Forbidden import: os |
| open('secrets.txt').read() | Safety Error: Forbidden function: open |
| print(eval('2 + 2')) | Safety Error: Forbidden function: eval |
Real responses from the server's execute function for each piece of code.