Runtime

Linux sandboxes for AI agents, each a Firecracker microVM with its own kernel.

От сообществаРаботаетБез входаГлобальныйБесплатноМожет изменять данные

Что умеет

  • Runtime Docs Read: Read a Runtime documentation page as Markdown: the same text as https://withruntime.com/docs. Topics include start, javascript, python, cli, mcp, api, sandbox-environment, migrate,
  • Runtime Sandbox Create: Create a Linux sandbox (Ubuntu with python3, node, bun, git, gcc and sudo). funding "trial" runs a free first one; omitted funding can use paid credit after the trial. Defaults
  • Runtime Sandbox List: List your sandboxes (live ones and stopped persistent ones unless includeStopped), filtered by state, name or label (key:value), 50 a page; pass nextCursor back as cursor. Give i

Какие данные видит

Нужен ли аккаунт

Не нужен: сервер работает без входа

Linux sandboxes for AI agents, each a Firecracker microVM with its own kernel. A new sandbox is running in about 100 ms, and typical agent work costs 42–88% less than on other sandbox providers. Run commands, read and write files, manage processes, pause and wake with memory kept, snapshot and fork. Sign up free at withruntime.com: no card, 100 free hours.

Как подключить

Как подключить Runtime к Claude

Адрес сервера, который нужно вставить в настройках Claude:

https://runtime--withruntime.run.tools

  1. Откройте Claude (сайт claude.ai или приложение для компьютера).
  2. Перейдите в Настройки → Коннекторы (в английском интерфейсе: Settings → Connectors).
  3. Нажмите Добавить пользовательский коннектор (Add custom connector).
  4. Вставьте адрес сервера, скопированный ниже, в поле URL удалённого MCP-сервера и нажмите Добавить.
  5. В чате нажмите + → Коннекторы и включите новый коннектор.

Пользовательские коннекторы доступны на тарифах Free, Pro, Max, Team и Enterprise. На Free можно добавить только один. В Team и Enterprise коннектор сначала добавляет владелец организации в Настройки организации → Коннекторы.

Авторизация

После нажатия Добавить откроется окно входа в сервис. Войдите под своим аккаунтом и подтвердите доступ. Пароль Claude не видит.

Как подключить Runtime к ChatGPT

Адрес сервера, который нужно вставить в настройках ChatGPT:

https://runtime--withruntime.run.tools

  1. Откройте ChatGPT в браузере (chatgpt.com). Нужен тариф Plus, Pro, Business, Enterprise или Edu.
  2. Один раз включите режим разработчика: Настройки → Приложения → Дополнительные настройки → Режим разработчика (Settings → Apps → Advanced settings → Developer mode).
  3. Откройте Настройки → Коннекторы и нажмите Создать (Create).
  4. Заполните форму: Название (любое), Описание (одна фраза, что делает сервис), URL MCP-сервера (скопируйте ниже).
  5. В поле Аутентификация выберите OAuth, если сервис требует вход, иначе Нет. Нажмите Создать.
  6. В новом чате откройте + → Приложения/Коннекторы и включите коннектор.

Название раздела у OpenAI менялось (Connectors → Apps/Plugins). Если пункт называется иначе, ищите «режим разработчика» в настройках. В рабочих пространствах Business/Enterprise администратор должен разрешить пользовательские коннекторы.

Авторизация

При первом использовании ChatGPT откроет окно входа в сервис. Войдите и подтвердите доступ.

Как подключить Runtime к Cursor

Адрес сервера, который нужно вставить в настройках Cursor:

https://runtime--withruntime.run.tools

Быстрый способ: нажмите кнопку Открыть в Cursor ниже, Cursor сам предложит добавить сервер.

Вручную:

  1. В Cursor откройте Settings → Cursor Settings → MCP и нажмите Add new global MCP server.
  2. Вставьте JSON, скопированный ниже, в открывшийся файл ~/.cursor/mcp.json (для одного проекта: .cursor/mcp.json в корне проекта).
  3. Сохраните файл. Сервер появится в списке MCP; при необходимости пройдите авторизацию по кнопке рядом с ним.

Авторизация

Если сервис требует вход, рядом с сервером в списке MCP появится кнопка авторизации.

Список инструментов сервера (46)

Технические названия из tools/list. Нужны только разработчикам.

runtime_docs_readRead a Runtime documentation page as Markdown: the same text as https://withruntime.com/docs. Topics include start, javascript, python, cli, mcp, api, sandbox-environment, migrate, pricing and troubleshooting.
runtime_sandbox_createCreate a Linux sandbox (Ubuntu with python3, node, bun, git, gcc and sudo). funding "trial" runs a free first one; omitted funding can use paid credit after the trial. Defaults: 2 vCPU / 4096 MiB / 4096 MiB disk for 30 minutes. Waits up to 60 seconds and returns its state; run commands once it is running. Trial: 100 free hours, 8 running sandboxes at once (a paused one holds no slot), each up to 2 vCPU / 4 GiB.
runtime_sandbox_listList your sandboxes (live ones and stopped persistent ones unless includeStopped), filtered by state, name or label (key:value), 50 a page; pass nextCursor back as cursor. Give id to read one.
runtime_sandbox_managestop: end it and its compute charges. delete: stop it, delete its disk and paused memory, revoke its previews and ports, and remove it from lists for good (its snapshots stay). pause: keep memory and disk, stop compute charges. wake: continue a paused one (seconds: its new lease; no_capacity means retry); a paused one with autoWake also wakes by itself on the next exec, file, terminal or preview request. extend: seconds more. retention: days (1 to 365) a paused one is kept. persist: policy {persistent, maxTotalCostMicros?} keeps it running while credit lasts and keeps its disk after a stop. restart: start a stopped persistent one from its disk. switch-image: move it to image, keeping only /workspace (its home), volumes, env, name and previews; processes restart and everything else on its disk is lost, so keep must be "workspace" (snapshot first to keep everything); undone if anything fails. update: change name, labels, env (a value sets a variable, null removes it; values are never shown again), autoWake or idlePauseSeconds (0 never; otherwise 10 to 86400, counted from the last activity). Waits until done.
runtime_sandbox_forkStart count (1 to 10) running copies of a sandbox, with its files, memory and processes, on its host. Copies keep its size and CPU, and its funding unless funding is given. Returns {sandboxes, snapshot}; on an error, details.startedSandboxIds names copies that started. fork_unavailable means forks are switched off; do not retry it.
runtime_sandbox_execRun a shell command (bash -c) or an argv in a sandbox and get exitCode, stdout and stderr. Output over 16,000 characters in all keeps each stream's first line and its end, with outputCut and a note on reading the rest from a file. Waits for a sandbox that is still starting. A timeout returns timedOut: true with the output so far. background: true returns a processId at once, for servers, watchers and interactive programs; runtime_sandbox_process reads and controls it. Runs as the sandbox user with passwordless sudo, HOME=/workspace. env sets environment variables and keeps their values out of the command line.
runtime_sandbox_processWork with a process started by runtime_sandbox_exec background: true. action read: output after cursor (pass the returned nextCursor next time; waitMs up to 8000 holds the call until there is output), with state and exitCode. write: send input text (the process needs stdinMode pipe or a pty). signal: SIGTERM by default, SIGKILL for the whole tree. list: every running and recent process in the sandbox.
runtime_sandbox_files_readRead a file in a sandbox as text (UTF-8) or base64. Text reads can take a line range (startLine, lineCount) so large files come in pieces; the reply says the total line count. At most 1 MiB per read; any path the sandbox user may read.
runtime_sandbox_files_writeCreate or replace a file in a sandbox, atomically, making parent directories. content is text unless encoding is base64. Up to 1 MiB; for bigger files use the SDK or `npx withruntime sandbox cp`.
runtime_sandbox_files_listList a directory in a sandbox (default /workspace): name, path, type, size, mode, modifiedAt. depth goes deeper (up to 10); glob filters (e.g. **/*.py). At most 2,000 entries; truncated says when there were more.
runtime_sandbox_files_managestat: whether a path exists and what it is. mkdir: make a directory and its parents. rename: move from path to 'to' (overwrite to replace). remove: delete a file or link, or a directory with recursive. Missing paths are not errors for remove and mkdir.
runtime_sandbox_files_watchWatch a sandbox file or directory for changes. start (path, recursive, events, include and exclude globs, timeoutMs, webhook: true to have Runtime send the changes to the account's webhooks) returns the watch and a cursor; read (watchId, cursor, waitMs) returns the events since it, repeated writes folded with a count, and nextCursor; list; stop (watchId). Access events are opt-in. At most 4 watches per sandbox; a watch ends after timeoutMs (1 h by default, zero until stopped). Reading never wakes a paused sandbox.
runtime_sandbox_interpreter_runRun code in a stateful interpreter inside a running sandbox: variables and imports persist per context, like notebook cells (Go keeps declarations, not values). Returns stdout, stderr, results (text, HTML, PNG charts, tables for DataFrames) and any error with its traceback; values over 48 KiB come back as refs to files. For data analysis, charts and quick computations; runtime_sandbox_exec runs shell commands. timeoutMs defaults to 300000.
runtime_sandbox_interpreter_contextsList, create, restart, interrupt or remove a sandbox's interpreter contexts, each an isolated interpreter with its own variables. restart clears a context's variables; interrupt stops the running cell and keeps them.
runtime_image_buildBuild a sandbox image with your dependencies preinstalled, from exactly one of: `image` (a public or private image such as python:3.12-slim or ghcr.io/you/app:1), `dockerfile` (any Dockerfile: multi-stage, COPY --from, ARG, heredocs; COPY reads `files`), or `recipe` ({base, apt, pip, npm, commands, files, env}). Each build of a `name` is its next version, tagged latest (or `tags`). `start` sets what a sandbox from it runs and when its create answers; a Dockerfile's CMD and HEALTHCHECK fill it in. Returns the image queued; runtime_image action get says when it is ready, and sandboxes start from its id or name:tag. A rebuild reuses unchanged steps.
runtime_image_registriesList, store or forget the credentials builds use to pull private images. set: {registry, username, password} (Google: username _json_key, the key as password) or {registry, accessKeyId, secretAccessKey} for Amazon ECR. Never returned.
runtime_sandbox_desktop_recordRecord a sandbox's desktop to an MP4 file. start returns the recording id; stop (recordingId) finishes the file at path in the sandbox; list; delete (recordingId). Download it with runtime sandbox desktop <id> record fetch. One at a time; at most 8192 MiB kept per sandbox; it stops before the disk fills.
runtime_sandbox_desktop_screenshotA screenshot of a sandbox's desktop, as base64 image data. Needs a started desktop (runtime_sandbox_desktop_act action start).
runtime_sandbox_desktop_actDrive a sandbox's Linux desktop like a person: start (width,height) returns a live view URL; move/click/drag/scroll the mouse by pixel coordinates; type text; press keys (xdotool names like ctrl+l, Return); list or focus windows; open a URL in Firefox; launch a program. Take runtime_sandbox_desktop_screenshot to see the result.
runtime_sandbox_mcpRun well-known MCP servers in a sandbox. catalog lists them (GitHub, Postgres, Playwright browser, filesystem, fetch, git, Notion, search...) with their settings and the hosts they call. start returns each one's URL and Authorization header; get shows their state and fresh URLs; stop ends them. Secret settings name Runtime secrets (runtime_secrets), so a server never holds the value, and servers keep to the sandbox's network rules.
runtime_switching_recordRecord that this organization is switching from a rival, so its first top-up is matched, up to $100, once the payment settles. Once per organization, before its first top-up; a referral matching the same top-up applies instead, never both.
runtime_sandbox_metricsA sandbox's measured CPU (percent of its vCPUs, and cores), resident memory, CPU wait and memory stalls over a range (15m, 1h, 6h, 24h, 7d, 30d; 1h when omitted), with the latest reading: to size a sandbox, see whether a process is busy or waiting, or find what drove a bill. Waiting is the measured wall-time percentage; null where the host did not provide complete same-run readings.
runtime_events_listRecent lifecycle events of your sandboxes, snapshots and volumes, newest first: created, running, paused, woken, stopped, start_failed and the rest, each with the resource as it was (stopReason says why a sandbox stopped). Pass resourceId for one sandbox's history. Kept 14 days.
runtime_webhooks_manageThe account's webhooks, which POST signed lifecycle events to an https URL. create returns the signing secret once; keep it. update changes url, events, description or enabled; rotate_secret can keep the old one keepPreviousSeconds; test sends a signed webhook.test and returns your endpoint's answer; deliveries lists recent ones; retry takes a deliveryId. Verify signatures with verifyWebhook from the withruntime SDK.
runtime_otel_manageExports that push sandbox events (OTLP logs) and CPU and memory (OTLP metrics) to an OpenTelemetry endpoint over OTLP/HTTP JSON. create takes endpoint, the OTLP base URL, headers for its authentication and signals (both by default); flush pushes now. Header values are never shown back.
runtime_audit_listThe account's audit log, newest first: members, keys, connections, credit, network rules, secrets and deletions, with the time, client address and request id. action filters by an action or a group ending in a dot. Page with before. Needs an owner or admin key.
runtime_addressYour organization's dedicated outbound addresses, for allow-lists. list: The organization's reserved addresses. reserve(family?): Every sandbox of the organization then sends from its own address; family 4 (default) or 6. Paid accounts only. release(addressId): Give one back by addressId; sandboxes send from the shared addresses again at once.
runtime_domainServe a sandbox port at your own hostname with automatic HTTPS. add(hostname, sandboxId, port): Returns the DNS records to set: a TXT record proving ownership and a CNAME (an A record for an apex). Paid accounts only. verify(hostname): Check the TXT record now and activate the domain when it matches; also says whether the name points at Runtime yet. list: Each domain with its state and DNS records. remove(hostname): Stop serving it, open connections included, before this answers; remove its DNS records at your DNS provider too.
runtime_portPublic address:port pairs for raw TCP to a sandbox (databases, game servers, anything not HTTP). open(sandboxId, port): Returns the public address:port. Idempotent per sandbox and port. Paid accounts only. list(sandboxId?): The open ports, or one sandbox's. close(portId): Close one by portId; its open connections are closed before this answers.
runtime_tunnelA WireGuard private network from your own network into your sandboxes. create(subnet?): Create it; subnet defaults to 10.250.0.0/16. Paid accounts only. get: Its endpoint, gateway key, peers and each sandbox's private address. add_peer(name, publicKey?, routes?): Add a machine or router of yours and get its wg-quick config; without publicKey Runtime generates the pair and the private key is in config, shown once. rotate_peer(peerId, publicKey?): A new key and config; the old key stops working within seconds. remove_peer(peerId): Revoke a peer; its tunnel and connections end within seconds.
runtime_network_upstream_proxySend the organization's sandboxes' outbound connections through your own HTTP or HTTPS proxy. get: The proxy in use, if any. set(url, secret?, hosts?): Paid accounts only. A proxy that fails fails the connection; nothing goes around it. remove: Connections leave directly again, within seconds.
runtime_sandbox_networkA sandbox's internet access and its allow, deny and connect rules. get(id): The rules, whether the sandbox's host enforces the latest version, and whether host:port reach is open to this organization. set(id, internet, allow?, deny?, connect?): Applies at once, to open connections too. A paid sandbox of an organization with a paid purchase reaches every port and a trial one ports 80 and 443; allow and deny narrow every port, and connect adds host:port pairs. Private addresses are always refused.
runtime_sandbox_previewsHTTPS addresses for ports inside a sandbox, https://<port>-<sandbox>.<domain>/. create(id, port, visibility?, ttlSeconds?, expiresAt?, embedOrigins?): private (default) needs the token as the x-runtime-preview-token header, or urlWithToken; public (paid only) needs none and shows browsers a one-time warning. WebSockets work. embedOrigins limits which sites may show it in an iframe. Idempotent per port. list(id): Each shared port, with a fresh token if private. rotate(id, port): A new token; the old ones stop working, as when a link leaked. delete(id, port): Stop sharing the port. session_create(id, sessionSeconds?, origins?): A web page's token for this sandbox's commands, files and previews; shown once. session_list(id): Without tokens. session_revoke(id, sessionId): Ends it now.
runtime_sandbox_mountsS3, Cloudflare R2 and Google Cloud Storage buckets mounted in a running sandbox. mount(id, provider, bucket, path, prefix?, region?, endpoint?, accountId?, secret?, readOnly?): Mount a bucket at path; secret keeps the key out of the sandbox. list(id): Each mount and whether it is mounted now. unmount(id, path): What was written stays in the bucket.
runtime_sandbox_tailscaleJoin a paid sandbox to your Tailscale network with your auth key, see its addresses there, or take it off. up(id, authKeySecret?, hostname?, tags?): Paid sandboxes. authKeySecret names a job secret holding a Tailscale auth key. status(id): Whether it is on one, and its tailnet addresses. down(id): Logs the machine out; it leaves the tailnet at once.
runtime_imageList, read, tag and delete the images sandboxes start from; runtime_image_build makes them. list(cursor?, limit?, state?, name?): Your images, newest first, each as get gives it without the log. name gives that name's versions. Pass nextCursor back as cursor. get(id, logsAfter?): State (queued, building, ready, failed), version, tags, size, error and the last build log lines. tag(id, tag, remove?): Point a tag (prod, v2) at one version, moving it, or take it off with remove: true. delete(id): Delete a version and its tags; sandboxes started from it keep running.
runtime_volumePersistent disks that outlive sandboxes, attached at create with volumes: [{volumeId, path}]. create(sizeMiB?, fromBackup?, name?, region?): Give sizeMiB, or fromBackup to restore one. One sandbox at a time mounts it read-write; mode "snapshot" gives any number a read-only copy as it is now. It is backed up off its host daily unless turned off; backedUp is true once a checked copy is off the host. list(cursor?, limit?, state?, name?): Your volumes, newest first, each as get gives it. Pass nextCursor back as cursor. get(id): Its state, size, space used, attachments and backups. delete(id): Delete it and all its data; refused while a sandbox holds it. Its backups are kept for their retention.
runtime_volume_backupCrash-consistent backups of a volume, kept off its host. create(volumeId, name?, retentionDays?): Back it up now, kept retentionDays (the volume's retention, 7 unless set); waits up to a minute. Restore with runtime_volume action create and fromBackup. list(volumeId?, cursor?, limit?, state?): Your backups, newest first, each as get gives it; volumeId gives one volume's. Pass nextCursor back as cursor. get(id): Its state, size, stored bytes and expiry. policy(volumeId, daily?, retentionDays?): Turn daily backups on or off and set how many days each is kept. delete(id): Delete it and its copy off the host.
runtime_snapshotKept copies of a paused sandbox's files, memory and processes, to start copies from. create(sandboxId, mode?, name?, retentionDays?): Keep a paused sandbox, also copied off its host. A sandbox with volumes cannot be snapshotted; an image, not a snapshot, is the way to preinstall dependencies. fork_unavailable means snapshots are switched off; do not retry it. list(cursor?, limit?, state?, name?, sandboxId?): Your snapshots, newest first, each as get gives it; sandboxId gives one sandbox's. Pass nextCursor back as cursor. get(id): Its state, shape, stored bytes and expiry. update(id, name?, labels?, ifLabels?): Replace the supplied labels or change the name; omitted fields stay unchanged. Null clears the name. Captured bytes and billing are unchanged. delete(id): Delete it and free its storage; sandboxes started from it keep running.
runtime_secretsSecrets such as API keys: sandboxes see a placeholder, and the egress proxy adds the value on HTTPS to the hosts you name. set(name, value, hosts, header?, format?, rules?): Store or replace one. Sandboxes see a placeholder in the environment variable of this name; the egress proxy swaps in the value on HTTPS requests to hosts (URL and headers), or sets header on each. rules (paid accounts) limit it by method and path. The value is never returned. list: Names, hosts, header and placeholder; never values. delete(name): Erase one by name; its placeholder stops being replaced. It does not revoke the key at its provider. jobs_ actions: the copy a scheduled job puts in its run's environment. Bind one with runtime_job create input.secrets: [{name: ENV_NAME, secretId}]. It belongs to the person whose key stored it and is versioned; a deleted name cannot be reused. put stores a new name; rotate replaces the value (expectedVersion); delete stops future use, not the provider's token; reveal shows a value and needs its own permission, so prefer binding.
runtime_accountRead the account. Money is integer microdollars (1,000,000 = $1). get: Who you are (organization, agent, credential) and the account's usage: balance, open holds, free-trial time left and per-resource charges. limits: Whether this key is read-only; the daily spending limit an owner set on your agent (the limit, what you committed in the last 24 hours and what is left; owners set it at https://withruntime.com/account/keys); and the account's free trial time in milliseconds (total, used, reserved by trial sandboxes that have not ended, available), or null with no trial. referrals: The referral link, the companies that signed up with it and the credit each earned. compare(provider, days?): What this key's sandboxes would have cost at a rival (e2b, daytona, vercel, modal, cloudflare, fly-sprites, fly-machines, blaxel, codesandbox, morph, northflank, runloop, lambda-microvms, freestyle, prime, fly for Sprites): the account's settled usage over the last `days` (default 30), priced at Runtime's rates (trial sandboxes at the standard rates) and at the rival's published list rates, with the date they were checked. Returns the saving, a 30-day projection, a `note` on what was left out and the switching credit's state; with no usage yet, a stated example workload is priced. sso: Identity providers (OIDC or SAML), the email domains they answer for and whether each is proven, the role new people join with, whether SSO is required, and SCIM sync. Needs an owner or admin key; changed on the website.
runtime_supportRuntime's support agent, for an error, a sandbox that will not start, billing or a how-to; it can escalate to a person. message(conversationId?, message?, approveActionId?, approveInputHash?, denyActionId?): Start with message; continue with the returned conversationId. While status is working, the reply arrives within about a minute through read. A proposed action runs only when approveActionId is passed with its approveInputHash; denyActionId declines it. read(conversationId): A conversation's status, newest reply and any actions awaiting approval.
runtime_feedbackReports go straight to the Runtime team, and whoever asked is told when a fix ships. submit(kind, summary, detail?, competitor?, resourceId?, requestId?, context?): A bug, a limit or missing feature, a workaround, unclear docs, something slow, or something another provider does better; praise too. Give what was tried, what happened and the requestId, never credentials, private files or user data. Duplicates merge. list(limit?): This organization's reports, newest first, with the status (new, planned, shipped, declined) and ship note of the item each merged into; one not yet sorted is waiting to be sorted, which runs every hour.
runtime_jobJobs run a command in a fresh sandbox, once or on a cron schedule. Each run is a paid sandbox at the sandbox rates, within your spending limits; the trial's hours do not fund jobs. An unknown outcome is never retried by itself. A run that cannot start says why in blockedReason (credits, capacity, cost_cap, permission) and tries again every 30 seconds. create(input), list, get, pause, resume and cancel(id), runs(id): a job's attempts, run(id): one attempt, logs(id of a run, cursor?): its output.
runtime_noticesAccount notices: pause expiry, unpaid storage, deletion deadlines. get does not mark one read; read does, keeping the first read time.
runtime_sandbox_inspectOne aspect of a sandbox. storage: reserved disk, price and charges. paused_storage: what a paused one occupies and costs. lifetime: persistence, spending cap and retained-data deadline. recovery: the latest file recovery point.