Sprites
by Sprites
Give your AI agent a persistent, hardware-isolated Linux sandbox it can create, run commands in, checkpoint and destroy. 18 tools, OAuth sign-in with a name-prefix-restricted token, from Fly.io.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Sprites via MCP
https://sprites.dev/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Sprites Tools & Capabilities (18)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Frequently asked questions
Can the Sprites MCP connector run arbitrary code on my machine?
No. The exec tool runs commands inside a Sprite, which Fly.io describes as a hardware-isolated Firecracker microVM in its cloud, not on your computer. Nothing executes locally, and the connector reaches only Sprites owned by the Fly.io organization you pick during the OAuth flow.
What can a Sprite reach on the network by default?
Anything. Sprites documents outbound access as unrestricted by default, so a fresh Sprite can resolve and reach any domain. Tightening it is opt-in through a network policy, a DNS-based allowlist applied from outside the Sprite. The policy_network_update tool is how the connector applies that restriction.
Can the connector make my code publicly reachable on the internet?
Not by itself. Every Sprite has an HTTPS URL, but Sprites documents it as private by default and reachable only by members of your organization. Switching a URL to public is a separate sprite config update command, and no tool in the connector's 18 published names performs that switch.
Is destroying a Sprite reversible?
No. Sprites states plainly that destroy_sprite permanently deletes a Sprite and its data with no undo. Checkpoints protect against a bad command inside a surviving Sprite, not against the Sprite being removed. Restrict the connector token to a name prefix so it can only reach Sprites you created for it.
What does a checkpoint actually save?
The writable filesystem overlay. Sprites lists files, directories, installed packages, config files and on-disk databases as captured, and running processes, in-memory state and open network connections as not captured. Restoring replaces your current filesystem with the saved one, and the state you overwrite is not backed up for you.
Can I stop the connector from touching my existing Sprites?
Yes, and the default already does. Sprites issues a restricted token that can only create Sprites whose names begin with mcp- and caps how many. The consent screen lets you change the prefix, raise or lower the cap, or switch to full access across the organization. Sprites recommends staying restricted.
Does creating Sprites through Claude cost money?
Yes, while they run. Sprites bills compute per second and only while a Sprite is active, so an idle Sprite costs no compute. Storage is billed on bytes actually written against a 100 GB per-Sprite ceiling, and kept checkpoint blocks bill separately. Fly.io publishes no pricing page in the Sprites documentation.
Why does a tool call fail while a Sprite is starting?
The Sprite was cold and is still waking. Sprites documents cold wakes as taking one to two seconds, and its troubleshooting tells you to wait a few seconds and run the same tool again. A warm Sprite resumes in 100 to 500 milliseconds instead, with running processes preserved.
Sources
- Sprites Remote MCP Server documentation, for the endpoint, the OAuth sign-in flow, the organization selection step, the restricted default token with its
mcp-name prefix and count cap, the organization-tool table with its read-only and destructive labels, the Sprite-tool categories, the safety-model notes on destroy, exec, restore and network policy, and the troubleshooting rows used in the FAQ (retrieved 2026-08-18 as Markdown via the.mdsuffix) · retrieved 2026-08-18 - Sprites Networking, for the unrestricted-by-default egress, the DNS-based allowlist model, the
defaultspreset bundle, raw-IP and private-range blocking, live policy reload, the read-only in-Sprite policy file, the per-Sprite HTTPS URL, and the org-private-by-default URL auth with its public switch (retrieved 2026-08-18) · retrieved 2026-08-18 - Sprites Checkpoints, for what a checkpoint captures and does not capture, copy-on-write creation, sequential IDs, the restore semantics and the absence of a backup for overwritten state, automatic checkpoints, and the not-version-control framing (retrieved 2026-08-18) · retrieved 2026-08-18
- Sprites Lifecycle and Persistence, for the warm and cold pause model with its 100–500ms and 1–2s wake figures, the persist-versus-drop table, the 8 vCPU / 100 GB / platform-managed-memory resources, the no-autoscale storage note, and per-second compute billing (retrieved 2026-08-18) · retrieved 2026-08-18
- Sprites Services, for service ownership by the runtime, cold-boot and crash restart behaviour, the single-HTTP-port rule and its 409, sticky stop versus signalled restart, the log file location, and the treat-every-service-as-internet-facing warning (retrieved 2026-08-18) · retrieved 2026-08-18
- Sprites Overview, for the Firecracker hardware-isolation claim, the serverless comparison table, and the untrusted-code and LLM-generated-code use cases (retrieved 2026-08-18) · retrieved 2026-08-18
- Sprites CLI Authentication, for the Fly.io account requirement, the
sprite auth setup --tokenCI path and the account page as the token source (retrieved 2026-08-18) · retrieved 2026-08-18 - Sprites Keeping a Sprite Running, for the Tasks API and the forgotten-heartbeat billing warning (retrieved 2026-08-18) · retrieved 2026-08-18
- Live auth posture check against
https://sprites.dev/mcp— an anonymous GET returned HTTP 401 with body{"error":"authentication failed"}and noWWW-Authenticateheader. The RFC 9728 descriptor athttps://sprites.dev/.well-known/oauth-protected-resourcereturned HTTP 200 naming the endpoint as its resource,headeras the only bearer method,https://sprites.devas its own authorization server, andsprites:readplussprites:writeas the two supported scopes. The RFC 9728 path-insert and path-append forms both returned 404. RFC 8414 metadata athttps://sprites.dev/.well-known/oauth-authorization-serverreturned HTTP 200 withauthorization_codeandrefresh_tokengrants, PKCES256, a dynamic client registration endpoint and the same two scopes; its/mcp-suffixed form returned 404 (2026-08-18) · retrieved 2026-08-18 docs.sprites.dev/robots.txtallows all crawlers, namessitemap-index.xml, and carries noContent-Signalheader on any axis.sprites.dev/robots.txtis entirely commented out. The documentation host servesllms.txtandllms-full.txt, and appending.mdto any docs URL returns clean Markdown. The sitemap lists 39 URLs and contains no pricing page;sprites.dev/pricingreturns 404 (all checked 2026-08-18) · retrieved 2026-08-18- Anthropic Connectors Directory entry, for the 18 tool names, the partner tier, the two categories, the empty
prompt_namesarray, the Fly.io author attribution and the prosepermissionsparagraph (snapshot 2026-08-16) · retrieved 2026-08-16 - Fly.io support — · Privacy
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- Sprites
- Tools
- 18
- Domain
- sprites.dev
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.