Sandboxed execution
Beta — the MCP Gateway is open source and on npm:
npx -y @mcp-rating/gateway. Source →
Most MCP servers are third-party code you didn't write. The Gateway limits what that code can see. How much it limits depends on the level. The default level protects your environment variables, not your files.
Two levels
| Level | What the server can't reach | What it still can | When |
|---|---|---|---|
| L1 — environment scoping | Environment variables you didn't allow. It gets the MCP SDK's short default set (PATH, HOME, USER and a few more) and the variables its manifest allows, not your whole shell. |
Anything your user can read on disk (~/.ssh, ~/.aws/credentials, .env files), and any host on the network. |
Default for every server. |
| L2 — container isolation | The host filesystem, except paths its manifest declares. With network: none, any network. |
Hosts on its allowlist, via a proxy that proxy-aware clients honour. | Opt-in: set MCP_GATEWAY_CONTAINER_ISOLATION=true for community and unknown-tier servers, or choose it per server with mcp_sandbox. Needs Docker or Podman; falls back to L1 without one. |
If a server could do damage by reading your files, run it at L2.
Capability manifests
Each server has a capability manifest: the environment variables it may see, the network hosts it may reach, and the paths it may mount. Defaults come from the server's trust tier. Override them per server with the mcp_sandbox meta-tool. At L1 only the environment part is enforced, and the connect summary says so.
Example
# Run community and unknown servers in containers
MCP_GATEWAY_CONTAINER_ISOLATION=true npx -y @mcp-rating/gateway
What it doesn't stop
A sandbox limits what a server's code can do. It doesn't limit what a server's words can do. Tool descriptions and tool results go to your model as text, and they can tell it to read a file through another server and send it somewhere. No server's code does anything wrong, so neither level sees it. A November 2026 measurement of this across 12 agent frameworks and 18 models found the model made a call the attacker asked for in 22.9% of runs, from 0.4% to 49.7% depending on the model.
The model can also reach the sandbox itself, through mcp_sandbox and mcp_connect. Since 0.5.0 widening a server's limits or starting a raw command goes to you, through your client, and the model can't see or answer the question. If your client can't ask, the gateway refuses, unless you turn this off with MCP_GATEWAY_HUMAN_APPROVAL=off.
Since 0.6.0 so does a secret the model read, when it turns up in a later tool call's arguments: a value from a file like .env, or anything shaped like a credential. That check compares data, so the wording of the request doesn't matter. It misses a secret in a file nothing marks out, one the model has rewritten some other way, and anything your client's own file tools read. What counts as a secret has the details.
See also
- Egress allowlist — the network half of L2.
- Access types — which servers can be sandboxed and how.