Docker sbx kit: reShapr MCP server on your host, behind the sbx MCP gateway. API key stays on host.
56
Agent context for a reShapr MCP server running on the host and exposed through the sbx MCP gateway. The API key stays on the host.
| Type | Required | Description | |
|---|---|---|---|
com.docker.sandbox/agent-context@1 | Required | — | |
sbx run <agent> --kit yadayac/reshapr-outside-sbx:0.3.0Run the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbxA Docker Sandboxes (sbx) kit that gives a sandboxed coding agent governed access to your APIs through a reShapr MCP server running on your host.
reShapr turns REST, GraphQL and gRPC APIs into MCP tools, with API-key auth, audit and trimmed responses. The sbx MCP gateway adds the API key on the host, so the key never enters the sandbox.
The kit itself is agent context only: it tells the agent that the reShapr tools appear unprefixed behind mcp-gateway (for example get_v1_forecast), and to prefer them over web search.
On the host, start reShapr and register it with the sbx MCP gateway (set the secret first):
sbx secret set mcp:reshapr:api-key < api-key.txt
sbx mcp add reshapr --url http://localhost:7777/mcp/<org>/<exposition> \
--header 'x-reshapr-key: ${api-key}' --skip-ssrf-check
Create the sandbox with the kit and a v3 workload (Claude, Codex or Copilot):
sbx create docker.io/docker/sbx-kit-claude:2.1.296 --name reshapr-out \
--static-mcp reshapr --kit docker.io/yadayac/reshapr-outside-sbx:0.3.0
sbx run reshapr-out
Codex works best when the prompt says "using the reshapr tool".
sbx kit verify docker.io/yadayac/reshapr-outside-sbx:0.3.0 \
--certificate-identity [email protected] \
--certificate-oidc-issuer https://github.com/login/oauth
reshapr-kit:0.2.0: the hooks, credential and network rule are gone; see the migration note in the repo README.