# MCP Server (https://tenki.cloud/docs/sandbox/mcp)

> For the complete documentation index, see [llms.txt](https://tenki.cloud/llms.txt)

Reference for the Tenki Sandbox MCP server covering client setup, authentication, available tools, and the flags that limit what an agent can do.

The Tenki MCP server lets an agent drive sandboxes from any
[Model Context Protocol](https://modelcontextprotocol.io) client — creating a session, running code
in it, and tearing it down as ordinary tool calls. These are the same operations the
[CLI](https://tenki.cloud/docs/sandbox/cli.md) and [SDKs](https://tenki.cloud/docs/sandbox/sdk.md) offer, handed to the agent instead of to you.

The server is published as `@tenkicloud/mcp` and speaks MCP over stdio, so there is nothing to
clone or build — the client launches it on demand.

## Connect a client

For Claude Code:

```bash
claude mcp add tenki --env TENKI_API_KEY=tk_your_api_key -- npx -y @tenkicloud/mcp
```

Claude Desktop and Cursor take the same configuration as JSON, in `claude_desktop_config.json`
and `.cursor/mcp.json` respectively:

```json
{
  "mcpServers": {
    "tenki": {
      "command": "npx",
      "args": ["-y", "@tenkicloud/mcp"],
      "env": { "TENKI_API_KEY": "tk_your_api_key" }
    }
  }
}
```

Codex reads the equivalent `[mcp_servers.tenki]` table from `~/.codex/config.toml`.

Whichever client you use, restart it after editing the config. Until you do, it will not pick the
server up.

## Authenticate

The server reads its credential from its own environment, so the key belongs in the `env` block of
the client config above. Signing in with `tenki login` does not reach it — that credential stays
with the CLI.

Create a workspace [API key](https://tenki.cloud/docs/account/api-keys.md) and set it as `TENKI_API_KEY`.

If `tenki_auth_status` is the only tool the client lists, the server started without a credential.

## What the agent can do

The tools cover session lifecycle (create, pause, resume, terminate), command
execution, file read and write, `git` clone/checkout/diff/log, port exposure and preview URLs,
plus [snapshots](https://tenki.cloud/docs/sandbox/snapshots.md), [volumes](https://tenki.cloud/docs/sandbox/volumes.md), and
[templates](https://tenki.cloud/docs/sandbox/templates.md). `tenki_run_code` covers the common one-shot case — boot a
session, run a script, and tear it down in one call.

For the current tool-by-tool list, see the
[server's README](https://github.com/LuxorLabs/tenki-mcp#tools) — it tracks the API directly.

## Limit what it can do

The server holds an API key, runs arbitrary code, and spends credits, so treat it as a capability
rather than a read-only integration. Two environment variables narrow it:

* `TENKI_MCP_READONLY` — set to `1` to register read tools only, with no create, run, delete, or spend
* `TENKI_MCP_DISABLED_TOOLS` — a comma-separated list of tool names to skip registering

Output from `tenki_run_code`, `tenki_exec`, and `tenki_read_file` comes from code running inside
the sandbox. Treat it as data, not as instructions to act on.

## Related

* [CLI reference](https://tenki.cloud/docs/sandbox/cli.md) and [SDK reference](https://tenki.cloud/docs/sandbox/sdk.md) — the same operations, driven by you
* [Concepts](https://tenki.cloud/docs/sandbox/concepts.md) — sessions, snapshots, volumes, and templates
* [tenki-mcp](https://github.com/LuxorLabs/tenki-mcp) — source, tool list, and security model