Sign in Book a demo
Back to Tools
Developer Tools API Key
Build Your Agent View Daytona Documentation
daytona logo

Daytona MCP Tools for AI Agents

Let an agent create isolated sandboxes, write and run code, inspect files, manage sessions, and work with Git repositories.

Available Tools

46 tools available in this integration

Daytona.ArchiveSandbox

Archive a stopped sandbox to reduce storage costs.

Daytona.ConfigureSandboxAuto

Configure auto-stop, auto-archive, and/or auto-delete intervals.

Daytona.CreateFolder

Create a folder (with parent directories) in the sandbox.

Daytona.CreateSandbox

Create a new isolated sandbox for code execution.

Daytona.CreateSession

Create a persistent background session for long-running processes.

Daytona.CreateSnapshot

Create a new sandbox snapshot (image template).

Daytona.CreateSshAccess

Create SSH access credentials for the sandbox.

Daytona.DeleteFile

Delete a file or empty directory.

Daytona.DeleteSandbox

Permanently delete a sandbox and all its contents.

Daytona.FindFiles

Search for files by name pattern (glob).

Daytona.GetFileInfo

Get metadata about a file: size, permissions, modified time, type.

Daytona.GetPortPreviewUrl

Get a preview URL for a web service running in the sandbox.

Daytona.GetSandbox

Get detailed information about a sandbox.

Daytona.GetSessionCommandLogs

Get output logs from a command running in a session.

Daytona.GetSnapshot

Get detailed information about a snapshot.

Daytona.GitAdd

Stage files for the next commit.

Daytona.GitBranches

List all branches.

Daytona.GitCheckout

Switch to a branch, tag, or commit.

Daytona.GitClone

Clone a Git repository into the sandbox.

Daytona.GitCommit

Commit staged changes.

Daytona.GitCreateBranch

Create a new branch and switch to it.

Daytona.GitDeleteBranch

Delete a local branch.

Daytona.GitLog

Get commit history.

Daytona.GitPull

Pull latest changes from the remote repository.

Daytona.GitPush

Push local commits to the remote repository.

Daytona.GitStatus

Get repository status: branch, staged/modified/untracked files, ahead/behind counts.

Daytona.ListFiles

List files and directories.

Daytona.ListPorts

List active ports in the sandbox.

Daytona.ListRegions

List available regions for sandbox creation.

Daytona.ListSandboxes

List sandboxes with optional filtering.

Daytona.ListSessions

List all active sessions in a sandbox with their status and recent commands.

Daytona.ListSnapshots

List available snapshots with their status and creation date.

Daytona.MoveFile

Move or rename a file or directory.

Daytona.ReadFile

Read file contents from the sandbox.

Daytona.ReplaceInFiles

Find and replace text across multiple files.

Daytona.ResizeSandbox

Resize sandbox resources.

Daytona.RunCode

Execute code directly in the sandbox.

Daytona.RunCommand

Execute a shell command in the sandbox.

Daytona.RunSessionCommand

Execute a command inside an existing session.

Daytona.SearchContent

Search file contents for a text pattern.

Daytona.SendSessionInput

Send input to a running interactive command in a session.

Daytona.SetSandboxLabels

Replace all labels on a sandbox.

Daytona.StartSandbox

Start a stopped or archived sandbox.

Daytona.StopSandbox

Stop a running sandbox, preserving its state for later restart.

Daytona.WhoAmI

Get the authenticated user's profile.

Daytona.WriteFile

Write content to a file in the sandbox.

Why agent-optimized tools matter

Built for intent, not API schemas

Ask the agent to "create a sandbox, run the tests, and explain the failures." Arcade picks the right Daytona tools without guessing sandbox IDs or session IDs.

Up to 100x fewer tokens

Daytona reads return focused sandbox, file, session, and repository metadata, so the agent can inspect state without loading full files or command logs into the model.

Complete the workflow end to end

Create a sandbox, clone a repository, run commands, inspect logs, commit changes, and push a branch through one toolkit designed around the complete code-execution task.

Make actions predictable and controlled

Arcade tools return structured results and useful errors across users and runs. Teams can apply scope restrictions, redaction, and approval policies so agents follow the same controls every time.

Securing Daytona

The more capabilities agents get, the more useful they are. However, more capabilities bring more risks of undesired effects such as data loss and exfiltration.

This is why Arcade provides you with contextual rules that dictate how and when a tool is allowed to run. Arcade’s contextual access lets you govern tool visibility and behavior at every stage of execution and control who can see a tool, what inputs are allowed, and what comes back.

Learn about Contextual Access Policies

For Daytona, you can implement some of these policies:

Access when tools are listed for a user
  • Hide Daytona.DeleteSandbox from agents unless the roles your IDP marks as sandbox administrators are active, so a routine coding agent cannot permanently erase an environment.
  • Restrict Daytona.CreateSshAccess to agents operating under your infrastructure-admin role, so unreviewed automation cannot create a new path into a sandbox.
  • Deny Daytona.GitPush to agents without your release-engineering role, so an agent cannot publish local commits to a shared repository.
Pre-execution before each tool call
  • Require human approval before Daytona.DeleteFile runs with recursive deletion or against a production sandbox, so an agent cannot remove a directory tree without review.
  • Block Daytona.GitPush when the target branch is protected or the commit includes files matching your secrets and credentials patterns, so an agent cannot publish unreviewed code or exposed keys.
  • Ask for human approval before Daytona.ResizeSandbox increases CPU, memory, or storage beyond your approved sandbox limits, so an agent cannot create unexpected infrastructure costs.
Post-execution after the tool returns
  • Deny Daytona.ReadFile results for paths matching your private-key, credential, or environment-file patterns, so secrets never reach the model.
  • Redact Daytona.SearchContent matches for API keys, access tokens, passwords, and private keys before the model sees search output.
  • Strip credentials, tokens, cookies, and command arguments containing secrets from Daytona.GetSessionCommandLogs results before they reach the model.

How to use Daytona with your agent

Connect Daytona to your MCP client and give an agent a sandbox for coding, testing, and repository work. Follow the walkthrough to configure access and try prompts end to end.

Your questions, answered

A Daytona MCP server exposes sandbox, file, session, command, snapshot, and Git operations as structured tools an AI agent can call through the Model Context Protocol. An agent can create an isolated environment, run code, inspect results, and manage repository changes.

Daytona's own MCP server, if used, is separate from Arcade. Arcade provides an agent-optimized Daytona integration with a shared credential, a consistent runtime across clients, approval and redaction policies, and brokered credentials that are not exposed to the model.

Arcade agents can create, start, stop, archive, resize, label, and delete sandboxes; create snapshots and sessions; read, write, search, move, and delete files; run code and shell commands; inspect logs and ports; and clone, branch, commit, pull, and push Git repositories. They can also configure sandbox lifecycle rules and create SSH access.

Most Daytona actions use one shared API key or secret configured for the integration. Cloning, pulling, and pushing through Git additionally send the user through GitHub OAuth; the required access is therefore the Daytona credential plus the GitHub authorization needed for those repository actions.

No. Daytona uses a shared API key or secret configured once rather than requiring every user to connect a separate Daytona account. Git clone, pull, and push are the exception: those actions send the user through GitHub OAuth for repository access.

Yes. Contextual Access policies can require human approval before consequential Daytona actions such as deleting a sandbox or file, writing files, running commands, pushing commits, or changing sandbox resources. The call proceeds only after the policy's conditions are satisfied.

Arcade proxies Daytona API calls and does not persist sandbox content as part of normal tool execution. Credentials are brokered and stored encrypted at rest, and the model never receives the raw Daytona or GitHub credentials.

Any framework or client that can connect to Arcade's MCP gateway or tool APIs works with Arcade Daytona, including LangChain, OpenAI Agents, CrewAI, Claude Desktop, Claude Code, Cursor, Visual Studio Code, Microsoft Copilot Studio, and GitHub Copilot.

Arcade refreshes access while the configured credential or GitHub authorization remains valid. If the Daytona credential is revoked or rotated, or GitHub access can no longer be refreshed, affected calls stop until the credential or authorization is reconnected.

Daytona service limits apply to sandbox, storage, execution, and API activity, while Git operations also remain subject to GitHub's limits. Calls through Arcade do not remove those underlying service constraints.

Ready to actually ship your agent?

Connect your agent to Daytona with a shared API key, agent-optimized tools and approval controls for consequential actions.

Build Your Agent Read the Daytona Quickstart