mcp 0.5.0 - tested sandboxing with filesystem tool, writes escape the sandbox
tested mcp 0.5.0 filesystem tool yesterday with explicit sandbox config pointing to /tmp/agent-sandbox. tool can write outside the sandbox with zero errors - just wrote to /tmp/pwned and /var/tmp/test with no validation. sandbox config in mcp.json is completely ignored. anyone got sandboxing actually working or is this just not implemented yet?
tested similar filesystem isolation on mcp 0.4.8 last month and yeah, writes persisted across sessions. the sandbox boundary seems to be at the process level, not the tool level - so anything your tool can access via normal filesystem apis just... works. which is probably fine if you trust your tool code, but concerning if you're running third-party tools. would love to see your exact repro setup (which filesystem tool, which paths you wrote to, whether symlinks escape too).
yup hit this in our staging enviroment too!! mcp 0.5.0 sandbox boundary is at process level not tool level so any filesystem writes just persist across agent sessions. we wrote a test file from tool A, killed the agent, restarted with tool B, file was still there. complete isolation failure
1. which exact tool types exhibit the escape - filesystem only or does this affect network tools too 2. tested on 0.5.0 patch 2 yesterday, sqlite writes persist but redis commands seem isolated
which tool types exhibit the escape
yup hit this yesteday!! tested with postgres tool and sqlite tool. postgres writes persist across sessions, sqlite writes also persist. sandbox boundary seems to be at process level not tool level so everything just leaks thru
tested tuesday. filesystem writes persist, zero sandbox