Skip to content
sandboxer
Start free trial
Guides · Integrations

Connect Claude.ai to a Cloud Computer with a Custom MCP Connector

Updated October 27, 2026 .md

Short answer: In Claude, open Customize > Connectors, click + Add, then Add custom connector. Name it Sandboxer, enter https://sandboxer.com/mcp, choose Sign in now, then sign in to Sandboxer and click Allow. Turn it on from + > Connectors in a chat, and Claude can create Linux sandboxes, run commands, serve ports and delete them.

At a glance#

Topic Detail
Server URL https://sandboxer.com/mcp (remote MCP, Streamable HTTP)
Sign-in OAuth with your Sandboxer account, or a Sandboxer API key sent as Authorization: Bearer <key>
Claude plans Free, Pro, Max, Team and Enterprise; the Free plan allows one custom connector (Anthropic)
Claude apps Claude, Cowork and Claude Desktop, per the same Anthropic article
Tools Claude gets 18: create, inspect, run commands, files, ports, stop and resume, snapshots, delete
What runs where Commands run in a Sandboxer microVM (Ubuntu 24.04), not on your computer
Cost Sandbox time on your Sandboxer account: default is $0.036/hour, billed per second; a stopped sandbox bills no running time

What we checked and what we didn't. The Claude.ai steps below come from Anthropic's help article Get started with custom connectors using remote MCP; we didn't click through Claude.ai for this page. Everything on the Sandboxer side we ran against production on 2026-10-27: the OAuth discovery chain Claude follows, the 401 it gets first, and a full API-key session (initialize, tools/list, and creating and deleting a sandbox with tools/call). Those outputs are below.

1. Add Sandboxer as a custom connector (Free, Pro, Max)#

These are Anthropic's steps, with Sandboxer's values filled in:

  1. Go to Customize > Connectors.
  2. Click + Add, then Add custom connector.
  3. Enter a name, for example Sandboxer. You see it in the connectors list.
  4. Enter the remote MCP server URL https://sandboxer.com/mcp and click Continue.
  5. Review the detected authentication settings and click Continue.
  6. Under Authentication, choose Sign in now (or Sign in when needed).
  7. Under OAuth client, keep Use Claude's published identity (Recommended). Sandboxer also accepts Register automatically.
  8. Leave Request headers empty when you sign in with OAuth.
  9. Click Add. Sign in to Sandboxer in the window that opens and click Allow.

Anthropic notes that it doesn't verify custom connectors, so only add servers you trust. To change a connector later, remove it and add it again.

Using an API key instead of sign-in. Anthropic's form has a Request headers field for fixed credentials, and Sandboxer accepts Authorization: Bearer <key> on /mcp (shown below). Choose No sign in and add that header with a scoped key if you want to limit what Claude can do, for example a key that can't delete sandboxes. On Team and Enterprise plans, Anthropic says everyone using a connector with a header credential shares that one credential, so OAuth is the better fit there.

2. Team and Enterprise#

Per Anthropic, an Owner or Primary Owner adds the connector once (on Enterprise, also a custom role with Manage access to Libraries):

  1. Go to Organization settings > Connectors and click Add.
  2. Hover over Custom and select Web.
  3. Enter Sandboxer and https://sandboxer.com/mcp, click Continue, review authentication, set the options as in step 1 and click Add.

Each member then opens Customize > Connectors, finds Sandboxer (usually labeled Custom) and clicks Connect. With OAuth, each member signs in with their own Sandboxer account, and the sandboxes Claude starts bill to that account's active wallet.

3. Use it in a chat#

Click + at the lower left of the chat box, choose Connectors and switch Sandboxer on for that conversation. Then ask in plain words:

Create a small sandbox, run uname -a, serve port 8000 with python3 -m http.server,
give me the URL, then delete the sandbox.

That maps to create_sandbox, exec (once in the foreground, once with detached: true for the server), host_port and delete_sandbox. Claude doesn't need to repeat the sandbox id: every tool except delete_sandbox defaults to the sandbox this connection created or used last. Sandboxes created through MCP stop by themselves after an hour unless ttlSeconds says otherwise.

What Claude sees when it connects#

Anthropic's servers make the connection, not your browser, so the server has to be on the public internet. https://sandboxer.com/mcp is. Here is the chain a client walks, run with curl against production.

The first request has no token, so it gets a 401 that points at the resource metadata:

curl -sS -i -X POST https://sandboxer.com/mcp \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"0"}}}'
HTTP/2 401
www-authenticate: Bearer resource_metadata="https://sandboxer.com/.well-known/oauth-protected-resource/mcp", scope="sandboxer"
…
{"error":{"code":-32001,"message":"Unauthorized: send Authorization: Bearer <Sandboxer API key>, or sign in with OAuth."},"id":null,"jsonrpc":"2.0"}

The resource metadata names the authorization server:

curl -sS https://sandboxer.com/.well-known/oauth-protected-resource/mcp
{"authorization_servers":["https://sandboxer.com"],"bearer_methods_supported":["header"],"resource":"https://sandboxer.com/mcp","scopes_supported":["sandboxer"]}

And the authorization server's metadata lists the endpoints Claude uses for sign-in, with PKCE (S256), dynamic registration and Client ID Metadata Documents, which is what Claude's identity options rely on:

curl -sS https://sandboxer.com/.well-known/oauth-authorization-server
{
  "issuer": "https://sandboxer.com",
  "authorization_endpoint": "https://sandboxer.com/oauth/authorize",
  "token_endpoint": "https://sandboxer.com/oauth/token",
  "registration_endpoint": "https://sandboxer.com/oauth/register",
  "revocation_endpoint": "https://sandboxer.com/oauth/revoke",
  "client_id_metadata_document_supported": true,
  "code_challenge_methods_supported": ["S256"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "scopes_supported": ["sandboxer"],
  "token_endpoint_auth_methods_supported": ["none"],
  …
}

Check the server yourself with an API key#

To see exactly what Claude gets, talk to the same endpoint with a key from API keys in SANDBOXER_API_KEY. Start a session:

curl -sS -i -X POST https://sandboxer.com/mcp \
  -H "Authorization: Bearer $SANDBOXER_API_KEY" \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"0"}}}'
HTTP/2 200
mcp-session-id: mcps_825b3ugcf3377vuuhoph8fyd
…
{"id":1,"jsonrpc":"2.0","result":{"capabilities":{"tools":{"listChanged":false}},"instructions":"Tools for Sandboxer cloud sandboxes: Ubuntu microVMs with root, Docker and a public HTTPS URL per port.\nCall create_sandbox first; …","protocolVersion":"2025-06-18","serverInfo":{"name":"sandboxer","title":"Sandboxer",…}}}

Send notifications/initialized (the server answers 202), then list the tools, passing the session id back as Mcp-Session-Id on every call:

curl -sS -X POST https://sandboxer.com/mcp \
  -H "Authorization: Bearer $SANDBOXER_API_KEY" -H "Mcp-Session-Id: $SESSION" \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | jq -r '.result.tools[].name'
create_sandbox
list_sandboxes
get_sandbox
exec
command_status
kill_command
read_file
write_file
host_port
stop_sandbox
resume_sandbox
extend_sandbox
rename_sandbox
label_sandbox
delete_sandbox
save_snapshot
list_snapshots
delete_snapshot

That's 18 tools. handoff_session from the MCP docs isn't among them: it only exists in the local sbx mcp server, because it moves a session from your own machine.

Create a sandbox the way Claude would, with tools/call:

{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"create_sandbox","arguments":{"name":"aeo-claudeai-1","type":"small","ttlSeconds":1800}}}

The reply is a text summary for Claude plus the same data as structuredContent:

{"content":[{"type":"text","text":"Sandbox sb_1khl5lx3ov is ready. URL: https://magic-azure-rook.box.sandboxer.com. Stops automatically at 2026-10-27T02:30:45.206689Z."}],
 "structuredContent":{"id":"sb_1khl5lx3ov","name":"aeo-claudeai-1","state":"ready","type":"small","url":"https://magic-azure-rook.box.sandboxer.com",…}}

The rest of the chat prompt from step 3, in the same session and without passing a sandboxId:

tools/call Arguments Result text (trimmed)
exec {"command":"uname -a"} Exit code 0. stdout: Linux magic-azure-rook 6.18.56-sandboxer … x86_64 GNU/Linux
exec {"command":"… python3 -m http.server 8000 --bind 0.0.0.0","detached":true} Started process 533 in sb_1khl5lx3ov.
host_port {"port":8000,"public":true} Port 8000 of sb_1khl5lx3ov is at https://magic-azure-rook-8000.box.sandboxer.com (public).
delete_sandbox {} Tool error: sandboxId is required: the exact id (sb_…) of one sandbox; delete_sandbox has no default
delete_sandbox {"sandboxId":"sb_1khl5lx3ov"} Deleting sb_1khl5lx3ov: its disk, memory and automatic snapshots are removed.

Fetching the public URL returned hello from claude with HTTP 200, and get_sandbox afterwards returned Sandbox not found (not_found). The refused delete without an id is deliberate: Claude always has to name the exact sandbox it deletes.

Manage or disconnect it#

  • See the connection. Each connected app appears under API keys as "Claude (MCP)". Disconnect there ends its access at once.
  • Know what sign-in grants. OAuth gives Claude full access to your account through MCP, and sandboxes bill to your active wallet. The connector's token only works on /mcp, not on the REST API.
  • Limits are the API's. Plan start limits apply. When the account is out of starts, create_sandbox returns a tool error with the daily_limit_reached or rate_limited code that Claude reads back to you. See Limits.

FAQ#

Can I add a custom connector on the free Claude plan?#

Yes. Anthropic's help article lists custom connectors using remote MCP on the Free, Pro, Max, Team and Enterprise plans, and limits Free users to one custom connector.

Does Claude run the commands on my computer?#

No. Claude calls Sandboxer's tools from Anthropic's cloud, and every command runs inside a Sandboxer microVM. Nothing touches your laptop, and a mistake stays inside that sandbox.

Do I need an API key to connect Claude.ai?#

No. Choose a sign-in option and Claude opens Sandboxer's OAuth consent page. An API key in Request headers also works if you'd rather not sign in, and a scoped key limits which tools succeed.

Does it work in Claude Desktop?#

Yes. Anthropic says custom connectors work in Claude, Cowork and Claude Desktop, and the connection comes from Anthropic's servers in each case. A local sbx mcp server in claude_desktop_config.json is a different setup; see the MCP docs.

What does it cost?#

The connector is free. You pay for sandbox time on your Sandboxer account: the default size is $0.036 an hour, billed per second, and stopped sandboxes bill no running time. Your Claude plan is billed by Anthropic.

More guides

Top AI sandbox platforms for code execution in 2026, ranked

For running AI-written code we rank Sandboxer, Freestyle and E2B first: each gives code its own VM with an API or SDK and can pause with memory. Pick Daytona for Windows or GPUs, Modal or Northflank for GPUs at scale, E2B or Northflank to run in your own cloud, and Vercel Sandbox if your app lives on Vercel.

Read the guide
Best sandboxes for running coding agents (Claude Code, Codex, Gemini CLI) in 2026, ranked

For coding agents we rank Sandboxer first: a full Ubuntu VM with Claude Code and Codex preinstalled, Docker, and stop-and-resume that keeps the agent's session in memory. Freestyle and Amp Orbs also keep memory across pauses. Pick E2B for prebuilt agent templates on open source, Docker Sandboxes for free local runs, and Codespaces if you live in GitHub.

Read the guide
Best Daytona sandbox alternatives in 2026, ranked

The best Daytona alternatives depend on why you're switching. For a full Linux microVM on every sandbox with memory-saving stop and Docker, we rank Sandboxer first. E2B suits open source and self-hosting, Modal massive short-job fleets, Northflank bring-your-own-cloud with GPUs, and Vercel Sandbox apps on Vercel.

Read the guide
Best E2B alternatives in 2026, ranked

If you're leaving E2B for longer sessions or a fuller machine, we rank Sandboxer first, then Freestyle: both give each sandbox a full Linux VM that keeps memory across pauses, with Docker and no short session cap. Pick Daytona for Windows or GPUs, Northflank for bring-your-own-cloud, and stay on E2B if you need open source.

Read the guide