Skip to main content

Sandbox MCP Servers

The MCP servers your agents call are network services executing third-party code, wired directly into a model's tool-use loop—which makes them precisely the code that belongs in a sandbox. Cosmonic Desktop runs MCP servers as ordinary workloads, with the platform's security defaults doing the containment. (Desktop also works in the other direction—your coding agent driving Desktop itself—see Connect Coding Agents.)

Diagram of the two MCP directions. A "Coding agent" box (Claude Code, Gemini CLI, any MCP client) sends arrow 1, labeled "drives Desktop", to the cosmonicd MCP server inside a Cosmonic Desktop box — with cosmonic_* tools for inspect, deploy, logs, and status. Arrow 2, labeled "calls sandboxed tools", goes to "your MCP server", drawn with a dashed border as a Wasm workload that is sandboxed with egress denied by default. This page covers direction 2.

Why sandbox a tool server?​

A tool server sits at the most exposed point in an agentic system: it receives model-shaped input (including whatever a prompt injection persuaded the model to send), it often holds credentials, and it can usually reach the network. Conventional deployment gives it ambient authority—whatever the process can reach, a compromised or over-curious server can reach too. The capability-bounds argument applies in full: the structural defense is a boundary the model can't widen.

As a Desktop workload, an MCP server:

  • starts with no outbound network access—every host it may call is allow-listed in its spec (allowedHosts), per workload, so exfiltration has nowhere to go;
  • is digest-pinned and signature-checked on every start, so the tool you reviewed is the tool that runs;
  • reads its secrets as references resolved by the host at start—plaintext never appears in its config, the YAML, or the UI.

Run an MCP server​

Any MCP server compiled as a Wasm component uses the standard flow: paste its OCI reference into Start workload, review the draft—the review step shows exactly the network reach and capabilities you're granting—and deploy. It appears in the Workloads view like anything else, with its logs in the Logs view.

Starting points:

From one machine to the team​

The same spec deploys to Cosmonic Control when you want sandboxed MCP servers on Kubernetes for the whole team—same deny-by-default egress, same verification, now under your platform's governance. From Laptop to Cluster walks the mechanics.

Next steps​

Last updated on by Liam Randall