Tenki MCP: Your Agent Gets the Sandbox as Native Tools

Tenki Cloudengineering

Get Started
1. Get an API Key
2. Add the Server
3. Confirm It Connected
Prerequisites
Built to Be Locked Down
Run Tenki MCP

Tenki sandboxes have been available through the CLI since day one. The problem with driving a CLI from an agent is that the agent has to work out how first — read the docs, assemble a command, guess at a flag, get it wrong. Then it gets terminal text back and has to decide what that text meant.

Tenki MCP removes both steps. The sandbox arrives as tools your agent calls directly, and results come back structured.

Boot and tear down microVMs (~2 seconds, billed per second)
Run code in shell, Python, or JavaScript
Read and write files
Run git: clone, checkout, diff, log
Expose live preview URLs

That's the short list. The server is 85 tools at parity with the Tenki API: snapshots, volumes, custom templates, a private image registry, SSH certs, signed URLs for binary transfer. 84 are held at parity by a CI audit, so the MCP can't drift behind the platform.

Get Started

1. Get an API Key

You may already have one. Tenki creates your first key during Sandbox onboarding.

To make another: sign in at app.tenki.cloud, select Tenki Sandbox, then open API Keys → Create API Key. Name it, optionally set an expiration, and copy the key.

View Tenki's API documentation →

2. Add the Server

Run this once, with your key substituted:

claude mcp add tenki --env TENKI_API_KEY=<tk_your_key> -- npx -y @tenkicloud/mcp

Cursor and Codex take a JSON config block rather than a command. Both snippets are in the README.

3. Confirm It Connected

In a fresh session, try:

Run print(2+2) in a fresh Tenki sandbox

That's all it takes.

Prerequisites

A Tenki account. Sign up free. Starter includes $10 in credits every month, not a one-time trial. Sandbox onboarding issues your first API key.
Node.js 22 or later. Check with node --version.

Built to Be Locked Down

This server holds an API key and can run code and spend credits, so we treated it as a capability from the start. Every tool is annotated read-only or destructive. TENKI_MCP_READONLY=1 gives you an inspection-only server. TENKI_MCP_DISABLED_TOOLS drops specific tools. TENKI_MCP_AUDIT=1 logs every call. The optional HTTP transport binds to loopback only and refuses to start on a public interface without a bearer token.

The full threat model, mapped to the CSA MCP Server Top-10, is in SECURITY.md.