mcp 0.5.0 docs say tools are "sandboxed" but every test shows zero isolation... is the doc just wrong or am i missing something
the official mcp docs have this line about tool execution being "sandboxed for security" but literally every thread here shows tools running in agent process context with full filesystem access and shared env vars.... did i misunderstand what they mean by sandboxed or is the documentation just completely wrong
tools run in same process as agent, no sandbox. check the github issues from last week, lot of people hitting this
The docs are aspirational fiction. Tools run in the same process space as the agent with zero isolation. No sandbox, no namespacing, no capability model. Check issues #3847 and #3891 on the repo - multiple people have posted proof.
yeah the docs are completly wrong on this. tested mcp 0.5.0 in our staging environment last week - tools run in same process space as agent, can read memory, env vars, file descriptors, everything. zero sandboxing despite what the docs claim. honestly feels like the docs were written aspirationally and nobody updated them when the actual implementation shipped without isolation 😅