Project · AI tooling
MCP Sandboxes
A managed execution environment for hosted MCP tools, with runtime isolation and controlled network access.
- PackageSource archive or repository
- Build checksValidate and audit dependencies
- Sandbox runtimegVisor and resource limits
- Tool interfaceMCP through the gateway
- Outbound trafficEnvoy domain policy
Host tools with explicit boundaries
I built a sandbox workflow for packaging and running MCP servers from uploaded archives or source repositories. The documented architecture combines gVisor runtime isolation, resource limits and an Envoy sidecar for controlled egress.
Configuration includes allowed domains, secrets and CPU or memory limits. Build-time checks validate the package and inspect Python dependencies before the server enters its runtime lifecycle.
Constrain network access
The network design separates sandbox workloads from internal services and disables direct inter-container communication on the sandbox bridge. Container-level rules restrict private-network destinations, while the sidecar enforces the configured domain policy.
The documented hardening also separates user and proxy identities and prevents processes from gaining new privileges. These controls complement the hub’s inspection of tool requests and responses.
Operate the lifecycle
The manager uses lifecycle events, liveness probes and startup reconciliation to detect crashed or orphaned workloads. Resource warnings and audit records make failures visible to the operator.
Explore the MCP Hub and the vulnerability-scanning pipeline.