Sign in Book a demo
Back to Tools
Developer Tools API Key
Build Your Agent View Daytona Docs
daytona logo

Daytona MCP Tools for AI Agents

Let an agent create isolated sandboxes, run commands, edit files, inspect ports, and manage Git branches and commits.

Available Tools

65 tools available in this integration

Daytona.ArchiveSandbox

Archive a stopped sandbox to reduce storage costs.

Daytona.CheckoutBranch

Switch to a branch, tag, or commit.

Daytona.CloneRepository

Clone a Git repository into the sandbox.

Daytona.CommitChanges

Commit staged changes.

Daytona.ConfigureSandboxAuto

Configure auto-stop, auto-archive, and/or auto-delete intervals.

Daytona.CreateBranch

Create a new branch and switch to it.

Daytona.CreateFolder

Create a folder (with parent directories) in the sandbox.

Daytona.CreateSandbox

Create a new isolated sandbox for code execution.

Daytona.CreateSession

Create a persistent background session for long-running processes.

Daytona.CreateSnapshot

Create a new sandbox snapshot (image template).

Daytona.CreateSshAccess

Create SSH access credentials for the sandbox.

Daytona.DeleteBranch

Delete a local branch.

Daytona.DeleteFile

Delete a file or empty directory.

Daytona.DeleteSandbox

Permanently delete a sandbox and all its contents.

Daytona.DownloadFile

Read file contents from the sandbox.

Daytona.FindFiles

Search for files by name pattern (glob).

Daytona.GetFileInfo

Get metadata about a file: size, permissions, modified time, type.

Daytona.GetFileMetadata

Get metadata about a file: size, permissions, modified time, type.

Daytona.GetPortPreviewUrl

Get a preview URL for a web service running in the sandbox.

Daytona.GetRepositoryStatus

Get repository status: branch, staged/modified/untracked files, ahead/behind counts.

Daytona.GetSandbox

Get detailed information about a sandbox.

Daytona.GetSessionCommandLog

Get output logs from a command running in a session.

Daytona.GetSessionCommandLogs

Get output logs from a command running in a session.

Daytona.GetSnapshot

Get detailed information about a snapshot.

Daytona.GitAdd

Stage files for the next commit.

Daytona.GitBranches

List all branches.

Daytona.GitCheckout

Switch to a branch, tag, or commit.

Daytona.GitClone

Clone a Git repository into the sandbox.

Daytona.GitCommit

Commit staged changes.

Daytona.GitCreateBranch

Create a new branch and switch to it.

Daytona.GitDeleteBranch

Delete a local branch.

Daytona.GitLog

Get commit history.

Daytona.GitPull

Pull latest changes from the remote repository.

Daytona.GitPush

Push local commits to the remote repository.

Daytona.GitStatus

Get repository status: branch, staged/modified/untracked files, ahead/behind counts.

Daytona.ListBranches

List all branches.

Daytona.ListCommits

Get commit history.

Daytona.ListFiles

List files and directories.

Daytona.ListPorts

List active ports in the sandbox.

Daytona.ListRegions

List available regions for sandbox creation.

Daytona.ListSandboxes

List sandboxes with optional filtering.

Daytona.ListSessions

List all active sessions in a sandbox with their status and recent commands.

Daytona.ListSnapshots

List available snapshots with their status and creation date.

Daytona.MoveFile

Move or rename a file or directory.

Daytona.PullCommits

Pull latest changes from the remote repository.

Daytona.PushCommits

Push local commits to the remote repository.

Daytona.ReadFile

Read file contents from the sandbox.

Daytona.ReplaceFileContent

Find and replace text across multiple files.

Daytona.ReplaceInFiles

Find and replace text across multiple files.

Daytona.ResizeSandbox

Resize sandbox resources.

Daytona.RunCode

Execute code directly in the sandbox.

Daytona.RunCommand

Execute a shell command in the sandbox.

Daytona.RunSessionCommand

Execute a command inside an existing session.

Daytona.SaveFile

Write content to a file in the sandbox.

Daytona.ScaleSandbox

Resize sandbox resources.

Daytona.SearchContent

Search file contents for a text pattern.

Daytona.SearchFiles

Search for files by name pattern (glob).

Daytona.SendSessionInput

Send input to a running interactive command in a session.

Daytona.SetSandboxLabels

Replace all labels on a sandbox.

Daytona.StageFiles

Stage files for the next commit.

Daytona.StartSandbox

Start a stopped or archived sandbox.

Daytona.StopSandbox

Stop a running sandbox, preserving its state for later restart.

Daytona.UpdateSandboxSettings

Configure auto-stop, auto-archive, and/or auto-delete intervals.

Daytona.WhoAmI

Get the authenticated user's profile.

Daytona.WriteFile

Write content to a file in the sandbox.

Why agent-optimized tools matter

Built for intent, not API schemas

Ask the agent to "create a sandbox, run the tests, and report the failing files." Arcade picks the right Daytona actions without making the agent discover sandbox, session, or command identifiers first.

Up to 100x fewer tokens

Daytona reads return focused file, repository, sandbox, and session metadata before the agent fetches file contents or command logs, so it can choose the next step without loading whole workspaces.

Complete the workflow end to end

Create a sandbox, clone the repository, inspect its status, edit files, run tests, commit the fix, and push the branch through one toolkit designed around the complete development task.

Make actions predictable and controlled

Arcade tools return structured results and useful errors across users and runs. Teams can apply scope restrictions, redaction, and approval policies so agents follow the same controls every time.

Securing Daytona

The more capabilities agents get, the more useful they are. However, more capabilities bring more risks of undesired effects such as data loss and exfiltration.

This is why Arcade provides you with contextual rules that dictate how and when a tool is allowed to run. Arcade’s contextual access lets you govern tool visibility and behavior at every stage of execution and control who can see a tool, what inputs are allowed, and what comes back.

Learn about Contextual Access Policies

For Daytona, you can implement some of these policies:

Access when tools are listed for a user
  • Hide Daytona.DeleteSandbox from agents unless the roles your IDP marks as sandbox administrators are active, so a routine coding agent cannot permanently erase an environment.
  • Restrict Daytona.CreateSshAccess to agents operating under your infrastructure-admin role, so unreviewed automation cannot create a new path into a sandbox.
  • Deny Daytona.GitPush to agents without your release-engineering role, so an agent cannot publish local commits to a shared repository.
  • Hide Daytona.DeleteBranch from agents unless the roles your IDP marks as branch administrators are active, so routine automation cannot remove a shared branch.
  • Restrict Daytona.CommitChanges to agents operating under your repository-maintainer role, so unreviewed automation cannot create commits in a shared codebase.
  • Deny Daytona.UpdateSandboxSettings to agents without your infrastructure-admin role, so a coding agent cannot change retention settings and cause unexpected storage or compute costs.
Pre-execution before each tool call
  • Require human approval before Daytona.DeleteFile runs with recursive deletion or against a production sandbox, so an agent cannot remove a directory tree without review.
  • Block Daytona.GitPush when the target branch is protected or the commit includes files matching your secrets and credentials patterns, so an agent cannot publish unreviewed code or exposed keys.
  • Ask for human approval before Daytona.ResizeSandbox increases CPU, memory, or storage beyond your approved sandbox limits, so an agent cannot create unexpected infrastructure costs.
  • Require human approval before Daytona.CloneRepository uses a repository outside your approved source-control organizations, so untrusted code cannot enter a sandbox without review.
  • Block Daytona.ReplaceFileContent when a target path matches your deployment manifests, lockfiles, or protected configuration files, so an agent cannot make broad changes to release-critical files.
  • Ask for human approval before Daytona.SaveFile writes outside the assigned workspace or overwrites an existing file, so an agent cannot alter unrelated project data.
Post-execution after the tool returns
  • Deny Daytona.ReadFile results for paths matching your private-key, credential, or environment-file patterns, so secrets never reach the model.
  • Redact Daytona.SearchContent matches for API keys, access tokens, passwords, and private keys before the model sees search output.
  • Strip credentials, tokens, cookies, and command arguments containing secrets from Daytona.GetSessionCommandLogs results before they reach the model.
  • Deny Daytona.DownloadFile results for paths matching customer exports, production backups, or legal-hold directories, so private records never reach the model.
  • Redact Daytona.GetRepositoryStatus output that contains remote URLs with embedded credentials or tokens before the model sees repository details.
  • Strip email addresses, access tokens, and customer identifiers from Daytona.ListCommits messages before they reach the model, while preserving commit history needed for investigation.

How to use Daytona with your agent

Connect Daytona to an MCP client with one shared API key, then give your agent a sandbox to inspect, edit, and run code. Follow the setup from credential configuration to your first prompt.

Your questions, answered

A Daytona MCP server exposes sandbox and development capabilities as structured tools that an AI agent can call through the Model Context Protocol. The agent can create and manage sandboxes, inspect files and repositories, run commands, manage sessions, and make Git changes when authorized.

Arcade provides Daytona access through its MCP gateway and tool APIs, with a shared credential configured once for most actions. Arcade also adds agent-optimized workflows, approval policies, response redaction, and tool visibility controls; repository actions that use GitHub authorization can send the user through GitHub OAuth.

Arcade agents can create, start, stop, archive, resize, label, and delete sandboxes; create snapshots and sessions; inspect files, ports, repository status, branches, and commits; run code and shell commands; edit files; and clone, pull, commit, and push repository changes. They can also search workspace contents, retrieve preview URLs, and manage long-running interactive processes.

Most Daytona actions require the shared API key or secret configured for the integration. Clone, pull, push, and related repository actions can additionally require the user's GitHub OAuth authorization, so grant the API credential and GitHub permissions needed for the workflow rather than treating GitHub OAuth as the credential for every Daytona action.

No. A shared Daytona API key or secret is configured once and used for the integration, rather than having every user connect a separate Daytona account. Six repository actions can additionally send the user through GitHub OAuth when access to a GitHub account is required.

Yes. Contextual Access policies can require human approval before consequential Daytona actions such as deleting a sandbox, deleting a branch, pushing commits, running a command, or changing files. The call proceeds only after the policy's conditions have been satisfied.

Arcade proxies Daytona API calls and does not persist your content as part of normal tool execution. Credentials are brokered and stored encrypted at rest, and the model never receives them.

Any framework or client that can connect to Arcade's MCP gateway or tool APIs works, including LangChain, OpenAI Agents, CrewAI, Claude Desktop, Claude Code, Cursor, Visual Studio Code, Microsoft Copilot Studio, and GitHub Copilot.

Arcade refreshes access while the configured credential remains valid. If the Daytona key or secret is revoked or rotated, calls stop until it is reconnected; repository actions using GitHub OAuth likewise stop until the user reconnects or reauthorizes GitHub access.

Daytona's own API, sandbox, and GitHub limits still apply to actions performed through Arcade. No separate Daytona rate limit or quota is specified here, so workflows should handle throttling and command or session limits returned by the underlying services.

Ready to actually ship your agent?

Connect your agent to Daytona with a shared API key, agent-optimized tools and approval controls for consequential actions.

Build Your Agent Read the Daytona Quickstart