# Sandbox your MCP servers too, because the agent's sandbox may not cover them

PaperChase agent use case (free feed entry), version 1.0. Source: [u/SirRobinBlibs on r/mcp](https://www.reddit.com/r/mcp/comments/1xjfmlj/your_agents_sandbox_probably_doesnt_cover_your/), 2026-10-30.

## What they did

The author quotes the docs for both agents, summarises an October paper on 'filesystem capability laundering' (for example a git tool tricked into staging a private key, since patched), and is careful with the numbers: 787 of 4,806 servers flagged by a coarse screen, 150 confirmed instances. The suggested fix is running read-only servers in containers with no network, one read-only mount and a pinned image digest, giving each server its own narrow token, scrubbing credentials from subprocess environments, or sandboxing the whole agent.

## Worth knowing

Approving a tool call approves the call, not everything the process behind it can open. Check your own agent's current docs, since defaults change, and patch MCP SDKs to the fixed versions named in the post.

## Workflow template

```text
Apply this workflow to [your project]:
1. List every local MCP server your agent starts and what files and network each can reach.
2. Run servers that only read your project in a container with no network and one read-only mount, pinned by digest.
3. Give each server its own narrow token in its own environment block.
4. Strip credentials from the environment that hooks and stdio servers inherit, or sandbox the whole agent.
5. Update MCP SDKs and servers to the patched versions.
Stop and ask me before anything irreversible: deploys, payments, sends or deletes.
```

## Steps

1. **List every local MCP server your agent starts and what files and netwo.** List every local MCP server your agent starts and what files and network each can reach.
2. **Run servers that only read your project in a container with no network.** Run servers that only read your project in a container with no network and one read-only mount, pinned by digest.
3. **Give each server its own narrow token in its own environment block.** Give each server its own narrow token in its own environment block.
4. **Strip credentials from the environment that hooks and stdio servers in.** Strip credentials from the environment that hooks and stdio servers inherit, or sandbox the whole agent.
5. **Update MCP SDKs and servers to the patched versions.** Update MCP SDKs and servers to the patched versions.

## Credit

Workflow reported by u/SirRobinBlibs on r/mcp: https://www.reddit.com/r/mcp/comments/1xjfmlj/your_agents_sandbox_probably_doesnt_cover_your/
Related: https://medium.com/@r3dtuxedo/what-can-your-agent-actually-touch-6010c17243d9

Summary and template written by PaperChaseWebb in our own words. Questions: mgmt@paperchasewebb.com