jamestelfer

Sandy — DevOps skill for Claude Code

DevOps community

Sandboxed TypeScript runtime for AI coding agents to query AWS — full SDK access with in-sandbox aggregation, credentials flow via IMDS and never enter the VM.

How to install Sandy

This entry records only its repository, not the path inside it, so there is no exact command to give. Open jamestelfer/sandy and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Sandy does

Sandboxed TypeScript runtime for AI coding agents to query AWS — full SDK access with in-sandbox aggregation, credentials flow via IMDS and never enter the VM. Ships as a Claude Code plugin (MCP) and a standalone CLI, backed by Shuru microVMs or Docker.

Alternatives in DevOps

Skypilot — Run, manage, and scale AI workloads on any AI infrastructure 9.7k ★
Azure Functions TypeScript — Azure Functions for TypeScript 1.8k ★
GPT Telegram Worker — A multi-model AI Telegram bot powered by Cloudflare Workers, supporting various APIs including OpenAI, Claude 268 ★

README

Sandy

**Sandy runs TypeScript AWS queries inside a disposable sandbox, giving AI coding agents full SDK access and cross-account aggregation with no host credentials exposed.**

Sandy is for AI coding agents — Claude Code and peers — running against multi-account AWS estates, and the humans who drive them. Agents describe an investigation in natural language. Sandy executes the generated TypeScript in a fresh microVM or container. The script uses the full AWS SDK to gather and collate results, then returns only what the agent needs. The sandbox and IMDS flow exist because agents should not hold host-level credentials or reach AWS directly.

flowchart LR
    subgraph AgentBox["Agent sandbox"]
        A["Coding agent"]
    end

    subgraph Host["Host (outside agent sandbox)"]
        direction TB
        CLI["sandy run
(CLI)"]
        MCP["sandy mcp
(MCP server)"]
        IMDS["imds-broker
(MCP)"]
    end

    subgraph Sandbox["Ephemeral sandbox
(Shuru microVM or Docker container)"]
        N["Node.js +
AWS SDK v3"]
    end

    AWS((("AWS APIs")))

    A -- "Bash: sandy run" --> CLI
    A -- "MCP: sandy_run" --> MCP
    A -- "MCP: start_server" --> IMDS
    CLI -- "spawn, mount script" --> N
    MCP -- "spawn, mount script" --> N
    N -- "IMDS: GET credentials" --> IMDS
    N -- "HTTPS to *.amazonaws.com" --> AWS

    classDef consumer fill:#e6f3ff,stroke:#2b6cb0,color:#1a365d
    classDef core fill:#fefcbf,stroke:#b7791f,color:#5f370e
    classDef sandboxed fill:#e9f7ef,stroke:#276749,color:#22543d
    classDef external fill:#fce4ec,stroke:#b83280,color:#702459
    class A consumer
    class CLI,MCP,IMDS core
    class N sandboxed
    class AWS external

How to use it

As an MCP server — sandy mcp, registered automatically by the sandy-mcp Claude Code plugin. Exposes the sandy_image, sandy_check, sandy_run, sandy_create_session, sandy_resume_session, and prime tools, plus embedded `sandy://skills/mcp/.