Sandbox your MCP servers too, because the agent's sandbox may not cover them
by PaperChaseWebb
A write-up on r/mcp points out that Claude Code's and Codex's own docs say local MCP servers run as ordinary processes outside the agent's sandbox. It walks through a recent paper on narrow tools being steered into reading files outside their job, and gives concrete container and environment settings.
- Price
- Free
- Difficulty
- Intermediate
- Setup
- 30 min
- Format
- .md file
sandbox-your-mcp-servers-too-because-the-agent-s-sandbox-may-not-cover-them.md · 3 KB · direct download, no signup
What you end up with
Approving a tool call approves the call, not everything the process behind it can open.
What you get
- A plain-language summary of the workflow
- A fill-in prompt template
- What to watch out for
- A link to the original source
Who it is for
Builders who already use AI agents and want a proven workflow they can copy into their own project.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: Plain Markdown, so it also pastes into other agents such as Grok Bot, Hermes, OpenClaw or Muse. We list those as compatible by format only, not as tested.
Tools needed
Cost to run: Free with the agent plan you already use.
Time to result: One working session
How it works
List every local MCP server your agent starts and what files and netwo
List every local MCP server your agent starts and what files and network each can reach.
Expected: Done before you move to the next step.
Run servers that only read your project in a container with no network
Run servers that only read your project in a container with no network and one read-only mount, pinned by digest.
Expected: Done before you move to the next step.
Give each server its own narrow token in its own environment block
Give each server its own narrow token in its own environment block.
Expected: Done before you move to the next step.
Strip credentials from the environment that hooks and stdio servers in
Strip credentials from the environment that hooks and stdio servers inherit, or sandbox the whole agent.
Expected: Done before you move to the next step.
Update MCP SDKs and servers to the patched versions
Update MCP SDKs and servers to the patched versions.
Expected: Done before you move to the next step.
Sample prompt from the pack
Apply this workflow to [your project]: 1. List every local MCP server your agent starts and what files and network each can reach. 2. Run servers that only read your project in a container with no network and one read-only mount, pinned by digest. 3. Give each server its own narrow token in its own environment block. 4. Strip credentials from the environment that hooks and stdio servers inherit, or sandbox the whole agent. 5. Update MCP SDKs and servers to the patched versions. Stop and ask me before anything irreversible: deploys, payments, sends or deletes.
Adapted by PaperChaseWebb. Not the original author's prompt.
Free preview of the file
# Sandbox your MCP servers too, because the agent's sandbox may not cover them PaperChase agent use case (free feed entry), version 1.0. Source: [u/SirRobinBlibs on r/mcp](https://www.reddit.com/r/mcp/comments/1xjfmlj/your_agents_sandbox_probably_doesnt_cover_your/), 2026-10-30. ## What they did The author quotes the docs for both agents, summarises an October paper on 'filesystem capability laundering' (for example a git tool tricked into staging a private key, since patched), and is careful with the numbers: 787 of 4,806 servers flagged by a coarse screen, 150 confirmed instances. The suggested fix is running read-only servers in containers with no network, one read-only mount and a pinned image digest, giving each server its own narrow token, scrubbing credentials from subprocess environments, or sandboxing the whole agent. ## Worth knowing Approving a tool call approves the call, not everything the process behind it can open. Check your own agent's current docs, since defaults change, and patch MCP SDKs to the fixed versions named in the post.
Worth knowing
- Approving a tool call approves the call, not everything the process behind it can open. Check your own agent's current docs, since defaults change, and patch MCP SDKs to the fixed versions named in the post.
- Figures are as reported by the original author and were not re-measured by us.
Questions
Where does this come from?
A public post credited to u/SirRobinBlibs on r/mcp. Source: https://www.reddit.com/r/mcp/comments/1xjfmlj/your_agents_sandbox_probably_doesnt_cover_your/
Is it free?
Yes. Feed entries are free to read and download.
Details
Version 1.0 · Updated Oct 30, 2026 · Markdown version of this page
License: Personal and commercial use. Credit the original source when you share the workflow. Download terms
Related
AGENTS.md, CLAUDE.md and Cursor rules starter files
Six fill-in instruction files for coding agents (base, Next.js plus Supabase, FastAPI, browser game, CLAUDE.md pointer, scoped Cursor rules), an Approvals section that makes the agent stop and wait for your yes, a table of what Grok Bot, Claude Code, Codex, Hermes and Cursor each read, a read-only checker for your rule files and 9 prompts to write, trim and test your own.
Ask-first rules for AI agents: hard nos, approval cards and a test set
Paste-in rules that make an agent ask before it sends, spends, posts or deletes, define what a real yes is, and stop retries after a no, plus 12 test scenarios to check it.
Extension Lockfile: pin your editor extensions and check for persistence after a bad update
Write down the editor extensions you trust at the versions you reviewed, turn off silent updates, and check every machine against that list with a read-only script. Take a baseline of SSH keys, startup entries, crontab and shell files on a quiet day, so when the next bad extension update is announced you can see what changed in one command. Includes an indicator file and runbook for the 2026-10-29 Claude Code extension incident.