[KoLDXr00T]

box mcp can now front other machines running box, and its tools use fewer of the agent's tokens.

Remote hosts

List them in ~/.box/hosts.yaml and box mcp routes to them alongside the local box. A sandbox there is host/name. Without the file, nothing changes.

hosts:
  - name: gpu1
    ssh: me@gpu1.example.com
    max_up: 8          # optional placement cap

• Transport: ssh only, no new network listener. The router runs box __ensure-serve on the host. That starts the host's own box serve (idle limit 30m) and prints its socket. One ssh -L per host then forwards that owner-only socket into a 0700 directory here.
• Names. A bare name means the local sandbox, else the only host that has it. When several remote hosts have it, up and run are placed: where it is already up or warm, then the least loaded host under max_up. diff, fork, apply and discard must name the host, since each copy has its own state.
• Failures. An unreachable host is reported (/v1/hosts, box hosts) rather than failing the list, and is retried after a pause. After a quiet spell a host is pinged before use, because its box serve exits when idle or upgraded.
• Hardening. The host list is validated before ssh sees it: no destination that ssh could read as an option (-oProxyCommand=…), and no shell metacharacters in the remote binary path. ssh runs in BatchMode, and host-key checking is left to the user's ssh config. SECURITY.md has a new section on this.

Fewer tokens

• Command output has ANSI escapes and \r progress redraws removed and repeated lines collapsed. It is then cut to its first and last lines: 8 KiB per stream by default (--output-budget), replacing the 64 KiB head-only clip. The cut is marked with an id, and the new output tool returns any slice by line range or regex. Full outputs are kept in memory only, capped at 64 MiB per session.
• "unchanged" reads. read_file, diff and list_sandboxes answer unchanged when the fresh result is identical to what the agent already has, including a file it just wrote. Every read still reaches the sandbox, so the answer is never stale, and full: true shows it again.
• The sandbox list is one line per sandbox instead of indented JSON.

Code

• internal/router: the router is an http.Handler speaking the same /v1 API, so mcp.New takes it in place of server.NewHandler. hosts.go has the config and the ssh transport.
• internal/mcp: compact.go (cleaning, clipping, the spool, the output tool) and seen.go. mcp.New now takes Options.
• internal/cli: new box hosts, the hidden box __ensure-serve, and new box mcp flags --hosts, --local-only, --output-budget.

Checked

• CI on the fork (check, vulncheck, three fuzz targets): https://github.com/KoLDXr00T/bluebox/actions/runs/39481149641
• Router and transport tests use fake hosts and a fake ssh (the test binary forwarding the socket in Go), under -race. They cover name resolution, placement and max_up, forks staying on their host, a down host, a server that exits and comes back, and config validation.
• End to end with the real binary, through a stand-in ssh and a second box home: box hosts, remote box serve autostart and reuse, qualified listing, bare-name resolution to the remote host, an "unchanged" re-list, and remote error passthrough.
• Escape suite, firecracker backend, strict and standard: no escapes, run on a GitHub-hosted runner, because no self-hosted kvm runner is registered upstream (A self-hosted KVM runner for the nightly escape suite #31): https://github.com/KoLDXr00T/bluebox/actions/runs/39482571791. podman/krun not covered (stock Ubuntu crun lacks libkrun).

Not checked: real exec output through the new compaction (unit tests only; no KVM where this was written) and a real ssh login (stand-in only). Trying ssh: localhost on a host with sshd and KVM would close both.

Not in this PR

• Creating or building sandboxes on a remote host. Placement only picks among existing copies.
• SDK access to the router.
• Found while running the escape suite, to be fixed separately: RuntimeIdentity requires krun on PATH whatever the backend, so box up fails on a firecracker-only host. The isolation-proof cache is also shared across backends, so one backend's proof lets another skip its check. The hosted run above worked around the first with a krun -> crun symlink.