# Sandbox your MCP servers too, because the agent's sandbox may not cover them

> A write-up on r/mcp points out that Claude Code's and Codex's own docs say local MCP servers run as ordinary processes outside the agent's sandbox. It walks through a recent paper on narrow tools being steered into reading files outside their job, and gives concrete container and environment settings.

- URL: https://paperchasewebb.ai/bots/marketplace/items/sandbox-your-mcp-servers-too-because-the-agent-s-sandbox-may-not-cover-them/
- Type: Agent use case pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex (named in the listing); Plain .md
- Price: Free USD
- Difficulty: Intermediate
- Setup time: 30 min
- Time to result: One working session
- Format: Markdown (.md) file, sandbox-your-mcp-servers-too-because-the-agent-s-sandbox-may-not-cover-them.md
- Version: 1.0, updated 2026-10-30
- License: Personal and commercial use. Credit the original source when you share the workflow.

## What you end up with

Approving a tool call approves the call, not everything the process behind it can open.

## What you get

- A plain-language summary of the workflow
- A fill-in prompt template
- What to watch out for
- A link to the original source

## Who it is for

Builders who already use AI agents and want a proven workflow they can copy into their own project.

## Tools needed

- Claude Code and Codex: agents whose sandbox settings are compared
- Local MCP servers: processes that run with your user's permissions
- Docker or another container: where read-only servers can run
- You need: An AI coding agent or chat model
- You need: A small real task to try it on

Cost to run: Free with the agent plan you already use.

## How it works

1. **List every local MCP server your agent starts and what files and netwo.** List every local MCP server your agent starts and what files and network each can reach. Expected: Done before you move to the next step.
2. **Run servers that only read your project in a container with no network.** Run servers that only read your project in a container with no network and one read-only mount, pinned by digest. Expected: Done before you move to the next step.
3. **Give each server its own narrow token in its own environment block.** Give each server its own narrow token in its own environment block. Expected: Done before you move to the next step.
4. **Strip credentials from the environment that hooks and stdio servers in.** Strip credentials from the environment that hooks and stdio servers inherit, or sandbox the whole agent. Expected: Done before you move to the next step.
5. **Update MCP SDKs and servers to the patched versions.** Update MCP SDKs and servers to the patched versions. Expected: Done before you move to the next step.

## Sample prompt: Workflow template (Claude Code and Codex, Local MCP servers)

```
Apply this workflow to [your project]:
1. List every local MCP server your agent starts and what files and network each can reach.
2. Run servers that only read your project in a container with no network and one read-only mount, pinned by digest.
3. Give each server its own narrow token in its own environment block.
4. Strip credentials from the environment that hooks and stdio servers inherit, or sandbox the whole agent.
5. Update MCP SDKs and servers to the patched versions.
Stop and ask me before anything irreversible: deploys, payments, sends or deletes.
```

Adapted by PaperChaseWebb. Not the original author's prompt.

## Free preview of sandbox-your-mcp-servers-too-because-the-agent-s-sandbox-may-not-cover-them.md

````markdown
# Sandbox your MCP servers too, because the agent's sandbox may not cover them

PaperChase agent use case (free feed entry), version 1.0. Source: [u/SirRobinBlibs on r/mcp](https://www.reddit.com/r/mcp/comments/1xjfmlj/your_agents_sandbox_probably_doesnt_cover_your/), 2026-10-30.

## What they did

The author quotes the docs for both agents, summarises an October paper on 'filesystem capability laundering' (for example a git tool tricked into staging a private key, since patched), and is careful with the numbers: 787 of 4,806 servers flagged by a coarse screen, 150 confirmed instances. The suggested fix is running read-only servers in containers with no network, one read-only mount and a pinned image digest, giving each server its own narrow token, scrubbing credentials from subprocess environments, or sandboxing the whole agent.

## Worth knowing

Approving a tool call approves the call, not everything the process behind it can open. Check your own agent's current docs, since defaults change, and patch MCP SDKs to the fixed versions named in the post.
````

## Worth knowing

- Approving a tool call approves the call, not everything the process behind it can open. Check your own agent's current docs, since defaults change, and patch MCP SDKs to the fixed versions named in the post.
- Figures are as reported by the original author and were not re-measured by us.

## Questions

**Where does this come from?** A public post credited to u/SirRobinBlibs on r/mcp. Source: https://www.reddit.com/r/mcp/comments/1xjfmlj/your_agents_sandbox_probably_doesnt_cover_your/

**Is it free?** Yes. Feed entries are free to read and download.

## How to get it

Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/sandbox-your-mcp-servers-too-because-the-agent-s-sandbox-may-not-cover-them/, no signup.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com