MCP server that gives any agent a sandbox, browser and GitHub access

Upstash turned its MCP server remote and added Box and Blob to a lineup that already includes Redis, QStash and Vector, letting any local or remote agent gain a sandboxed container with shell, git, Node and Python, GitHub repository access, a headless Chromium browser and file storage. The server handles OAuth consent and installs the Upstash GitHub App on repositories selected in the Upstash Console, so the agent can clone, build, test, push branches and open pull requests without ever holding a GitHub token. A bundled skill, upstash-box-remote-work, triggers on the phrase "use remote work" or when a pull request should include a screenshot or preview URL, and boxes can expose a port on a public URL for live previews.

Give Any Agent a Remote Workspace with One MCP Server Code factories, the hosted agents that turn a task into a pull request, all start the same way: deploy this, install that, connect your repos, bring an API key for the model. What if the factory was an MCP server instead? You add it to whatever agent you already have, local or remote, and that agent gains a remote sandbox, your GitHub repos, a browser and the whole Upstash stack. Then you describe the work and come back to the pull requests, with screenshots of the result in the description and a live URL to the running app while it works. That is what the Upstash MCP server https://upstash.com/docs/agent-resources/mcp turned into. It went remote https://upstash.com/blog/upstash-has-a-remote-mcp-server-now last week, and now Box https://upstash.com/docs/box/overall/quickstart and Blob https://upstash.com/docs/blob/overall/quickstart have joined Redis https://upstash.com/docs/redis , QStash https://upstash.com/docs/qstash and Vector https://upstash.com/docs/vector on it. This post covers how to set it up, how the pieces fit, and what it did for us. Setup The MCP server lives at one URL. Any agent that takes a remote MCP server, a Claude chat, a deployed bot or your own agent, connects to it here: Local agents can install the Upstash plugin https://upstash.com/docs/agent-resources/overview instead. It bundles the same server with the SDK skills. In Claude Code: The agent setup page https://upstash.com/docs/agent-resources/overview has the steps for the other agents. The plugin also ships a skill, upstash-box-remote-work https://github.com/upstash/skills/tree/main/skills/upstash-box-remote-work , that tells the agent when a task belongs in a box and how to run it there end to end: clone, build, preview, screenshot, pull request. It kicks in when you say "use remote work", or when the PR you ask for should come with a screenshot or a preview URL. The first time the agent connects to the MCP server, your browser opens the OAuth consent page to authorize it. Pick the account the agent should work in and switch off read-only , since opening pull requests is a write. Then tell Box which repositories the agent may touch. In the Upstash Console https://console.upstash.com/box?tab=settings , open Box → Settings → GitHub , connect your GitHub account and pick the repositories. This installs the Upstash GitHub App on them. Public and private repositories both work, and you never copy a token. That is the whole setup. Start your agent, give it a task, and read the PRs when they arrive. What the agent gets The MCP server provides the five components that turn any local or remote agent into a code factory with a remote workspace. Together they cover everything between "here is the task" and "here is the PR". A filesystem and a shell. A Box is a sandboxed container with a shell, git, Node and Python. The agent creates one, clones a repository, builds and tests in it, and deletes it when done. A chat in a browser tab gets a filesystem this way, and Claude Code on your laptop gets extra ones. GitHub. Boxes clone the repositories you connected in settings and can push branches and open pull requests on them. The agent never gets a GitHub token. The App installation belongs to your account, and the box uses it. A browser. Every box can come with a headless Chromium, where the agent checks a preview of its change and screenshots it. A box can also expose a port on a public URL https://upstash.com/docs/box/overall/preview , so you can click around the running app yourself while the agent keeps working. File storage. Blob gives the agent a bucket and presigned upload URLs. A screenshot goes from the box to Blob, and its public URL goes into the PR description. Here is a PR opened this way https://github.com/CahidArda/cahidarda.github.io/pull/29 , with the rendered page and the generated Open Graph image embedded as proof. GitHub's CLI can now attach images to a PR https://github.blog/changelog/2026-09-01-github-cli-media-in-issues-pull-requests-and-comments/ itself, but it only accepts tokens from running gh auth login or classic personal access tokens. A box authenticates through a GitHub App, so its images go through Blob instead. The Upstash stack. The same server carries the Redis, QStash, Vector and Search https://upstash.com/docs/search tools. When the change needs a cache, a queue or an index, the agent creates the resource, gets the credentials, wires them into the code and tests against the real thing, in the same session and with no detour through the console. Why you might want the factory as an MCP server Hosted factories run the model on their side, so you bring an API key and pay per token. An MCP server attaches to the agent you already pay for. If that is Claude Code or Codex on a subscription, the factory runs on that subscription, and the tokens are the ones you would have spent anyway. Which agent you attach it to decides what you get out of it. There are two cases. A local agent gets room to run in parallel Claude Code or Codex on your machine already has a filesystem and a shell. What it lacks is room. One task at a time is fine on a laptop and five are not. Each task needs its own checkout, its own installed packages, its own dev server or build and, if it checks the result, its own browser. Five checkouts, five dev servers and five Chromium instances are more than a laptop should carry, and they all compete for the same ports, memory and CPU. With the MCP server added, the agent can send each task to its own box. They run side by side, and everything is deleted once the PR is open. Your machine stays clean and free for the task you are working on yourself. Every point in Alex Lieberman's thread above maps onto a box. The computer per agent is the box, the live URL is the public URL, and "give me irrefutable evidence that this works" is a screenshot in Blob, linked from the PR. The browser is where this shows first. One agent with one dev server and one browser on your laptop is fine. Five agents, each running its own app in dev and driving its own browser against it, are not. I have let a few parallel subagents do exactly that and watched my machine run out of memory and CPU. In a box each agent gets its own app and its own Chromium, and none of them touch your machine. A remote agent gets a workspace An agent that runs somewhere else, Claude on the web, a bot in Slack, an agent inside your own product, has no filesystem of yours, no shell, no browser and no way to open a PR. The same MCP server gives it all of that. I added the server to my Claude account, and plain Claude chats got more than a Claude Code session: a shell, a repository, Redis and QStash, plus a browser that screenshots the change and a preview URL into the running app, all from a chat window. The interface keeps changing. A terminal today, a chat window or a Linear ticket tomorrow, another agent after that. The MCP server works the same behind all of them, because the code never ran on that side anyway. Twelve PRs from one message We recently added three features to Upstash Redis: arrays, vectors and search over streams. Each one needed the same treatment: the TypeScript SDK, the Python SDK, the skills repository and the docs. This is the remote case at work. I told Claude, in a regular chat on the web, which features to add and which repositories to update. It created a box, cloned the four repositories, read the existing code to match conventions, made the changes, checked each branch's diff against main, and opened the pull requests. Twelve of them, three per repository: My part was writing the message and reviewing the PRs. Nothing was cloned, built or installed on my machine. Claude itself was not running on my machine either. It was a chat in a browser tab. Your first PR 1. Add the MCP or install the plugin for your agent https://upstash.com/docs/agent-resources/overview . 2. Connect the agent to the MCP server and approve the OAuth consent it opens, with read-only off. 3. Connect GitHub and pick your repositories under Box → Settings → GitHub . 4. Give the agent a task. Say "use remote work", or ask for a screenshot or a preview URL in the PR, and the skill takes it from there. Come back for the PRs. You already have the agent. Now it has somewhere to work. If something gets in its way, open an issue in the skills repository https://github.com/upstash/skills and we will take a look. Looking for a managed Redis database?Building with an AI agent? It can create a free database instantly with a POST to https://upstash.com/redis https://upstash.com/start-redis - no signup required.Upstash runs Redis as a serverless database - create one in seconds and pay only per request. Explore Upstash Redis →