Let an agent run code. Know what it can touch before it runs.

Coding agents ask for permission so often that people stop reading the prompts. Koschei moves the decision to one place: a policy you set once, checked by a compiler.

How it works

1. You start the Koschei MCP server and say what programs may touch.
2. The agent writes a small Koschei program instead of a shell command or a Python script.
3. The compiler lists every directory, network origin and environment variable the program asks for.
4. If the list fits your policy, the program runs. If not, it is rejected and none of its code executes.

Set the policy once

uvx koschei-lang --allow-read /srv/reports --allow-net https://api.example.com

With no options, programs can only compute. The agent cannot change the policy.

What the agent sees

A program that stays inside the policy runs, and the result says what it used:

Ran successfully.

Capability manifest:
- Disk: /srv/reports (read-only), line 2; uses read

Output:
Q3 revenue: 418200

A program that reaches further is stopped before its first line:

BLOCKED before running. The program asks for authority this server does not allow:
- Disk read of /home/me/.ssh (line 2) is outside the allowed paths
Nothing was executed. Allowed: disk read under /srv/reports; clock; random.

Why a language, and not only a sandbox

• A sandbox tells you what a program did. Koschei tells you what it can do, before it runs.
• The list is exact. Code has no way to reach the disk or the network except through a token the compiler can see.
• The runtime holds each token to its scope: no .., no symbolic links that point outside.
• Models can write it. In our test, two models that had never seen Koschei wrote 10 small programs each from the language guide alone; all 20 compiled and printed the expected output on the first attempt.

Connect it

Add the server to your MCP client. uvx downloads Koschei from PyPI and starts it; nothing else to install.

{
  "mcpServers": {
    "koschei": {
      "command": "uvx",
      "args": ["koschei-lang", "--allow-read", "/srv/reports"]
    }
  }
}

Or install it yourself with pip install koschei-lang and use ks-mcp as the command. Needs Python 3.12 or newer. Source and docs: github.com/bugsbuny243/koschei-lang.

The server offers three tools: a language reference for the agent, a check that never runs code, and a run under your policy.

Try the language in your browser →

Koschei is pre-1.0. The MCP server runs on Unix-like systems and suits scripts that compute, read and write files, and call HTTP APIs; the standard library is small. The per-run process limits are a backstop, not a container. Koschei is source-available: free for personal use, with a commercial license for commercial use.