Best Code Execution MCP Servers for AI agents.

Every execution server sits somewhere on a line from 'cannot hurt you' to 'can do anything you can'. At the safe end, runno — the category's most-starred listing at 767 — wraps the Runno sandbox, giving agents a contained place to run code with no access to the host. code-runner extends the multi-language runner pattern across various programming languages.

The middle ground is containers: podman-mcp-server drives Podman and Docker runtimes, so each agent task gets a disposable, resource-limited environment — the isolation model most production deployments land on. At the open end sits Shell Exec, which runs bash with background job support: maximally useful, minimally protected, appropriate only where the agent is trusted like a colleague with your terminal.

Some of the most interesting listings execute somewhere unusual. mcp-server-colab-exec runs Python on Google Colab's T4 and L4 GPU runtimes from any MCP client — an agent can train a small model or run CUDA workloads without you owning a GPU. The Qiskit IBM Runtime server goes further afield, submitting quantum circuits to IBM's hardware.

Execution also turns out to be a substrate for non-coding domains: build123d MCP executes parametric CAD code and renders, measures, and exports geometry; cesium-mcp-runtime drives a CesiumJS 3D globe for spatial analysis. The pattern is the same loop — write code, run it, inspect the result — pointed at solids and maps instead of test suites.

Decide on the blast radius first and the feature list second. Untrusted or experimental agents get a sandbox (runno) or a container (podman-mcp-server); only well-supervised workflows on dev machines earn direct shell access. Statefulness is the next question: RLM Tools provides a persistent Python sandbox, which keeps variables and loaded data alive across calls — far more token-efficient for iterative exploration than re-running setup code every invocation.

For regulated environments, this category even includes its own compliance layer: the Vaara servers produce tamper-evident, EU AI Act-oriented runtime evidence for MCP activity, useful when 'the agent ran code' needs an audit trail.

Execution is the category where per-call pricing is most literal: every invocation consumes measurable CPU, GPU, or sandbox time. Self-hosting the open-source servers here costs only your own hardware, but hosted execution — especially GPU-backed — is a metered product by nature. On Loomal, maintainers who claim their listing can attach x402 pricing from $0.01 per call; agents pay in USDC before the handler runs, settlement hits Base in about two seconds, and receipts are Ed25519-signed. Loomal's 5% fee on settled transactions is currently waived.

All 33 Code Execution listings: loomal.ai/marketplace?category=Code%20Execution.