Severity: High
This guide covers a sandboxing class vulnerability. Review and apply mitigations before deploying any MCP server to production.
Threat Overview
The Sandboxing threat affects MCP servers at the sandboxing layer. Because MCP servers can execute tools with access to external systems, APIs, and file systems, this class of attack can have significant blast radius if not mitigated.
Attack Surface
- Tool call arguments received from the model layer without validation.
- Resource data returned from external APIs that may contain injected instructions.
- Environment variables and credential files accessible to the server process.
- Network access from the server process to internal services.
Mitigations
Validate all tool arguments against strict input schemas before execution.
Sanitise all external data before including it in model context.
Require human-in-the-loop approval for any destructive or privileged tool call.
Run the server in a sandboxed process with minimal filesystem and network access.
Log every tool invocation with full arguments, timestamps, and user identity.
Apply least-privilege credentials — never use admin tokens for read-only operations.
Rotate all credentials on a documented schedule or immediately after a suspected incident.