# devin with an X-API-Key header: PASS

Run date: 2026-10-12 (UTC). Endpoint: `https://api.sbx.agent-next.com/mcp/v1`. Client: `devin` 3000.11.3, preinstalled in the default template, used in a fresh sandbox only, signed in with an existing devin account. The key was read in-process and never printed or logged.
Setup text: the live [For agents page](https://sbx.agent-next.com/docs/agents/#client-devin), devin section.

## Flow

| step | result |
| --- | --- |
| `devin mcp add --transport http --scope user --header ...` from the page | The config is saved to `~/.config/devin/mcp_config.json`, then the command prints an OAuth URL and waits until stopped (exit 124 under `timeout`). It does the same with a valid key. The page now says to stop it with Ctrl-C |
| `devin mcp list` | PASS: lists `sandbox` and its URL |
| headless run | `devin -p` refuses an untrusted folder; `--respect-workspace-trust false` and `--permission-mode dangerous` let it run unattended (the page now says so) |
| session A: create, `echo ok; exit 3`, write and read `/tmp/hello.txt`, `ls -l /tmp`, `python3 -m http.server 8000` in the background, preview URL, no kill | PASS: exit code 3 and `ok`; file content `hi`; an external fetch of the preview URL returned HTTP 200; an independent MCP read returned `hi`; PID 1 is `tini`, 0 zombies |
| session B (a new devin run): create its own sandbox, then `sandbox_kill` twice | PASS: `killed: true`, then `already_gone: true` |
| session A's sandbox | killed by a raw MCP call (`killed: true`, not by devin); its preview URL then returned 502 |

## Residue (zero)

- The key's sandbox list was 0 at the end.
- `devin mcp remove sandbox` fails with "not in the local project config" for the entry the page added; `devin mcp remove --scope user sandbox` removes it (checked in a second fresh sandbox with the real key), `devin mcp list` is then empty, and a scan of the home directory and `/tmp` for the key found nothing except the test harness's own key file, which went away when the sandbox was destroyed.