anyone running mcp tools in sandboxed environments or just rawdogging it
we're shipping agent tooling that calls external apis and im worried about tools making unauthorized calls or exfiltrating data through error messages. does anyone actually sandbox mcp tool execution or is everyone just running them in the main process and hoping the llm behaves? curious what the actual threat model is here bc the sdk documentation has zero guidance on isolation
docker + network policies is the only sane approach
we run everything in docker containers with network policies that whitelist exactly which external services each tool can hit. adds complexity but way better than letting an llm call arbitrary apis with our credentials. the real question: what's your rollback strategy when a tool goes rogue in prod?
we run everything in docker yeah but also built a tool registry that declares exactly which external apis each tool can hit. adds complexity but caught two cases last month where llm hallucinated tool calls to internal admin endpoints that would've been really bad
1. This is the right approach yeah 2. Curious what your tool registry schema looks like - are you declaring API endpoints as strings or using url patterns with wildcards 3. How do you handle tools that need to hit multiple related endpoints (like auth + data fetch)