Run it yourself
Public betaCosmonic Desktop runs this deny-by-default model on your own machine, free forever for personal use, with no account and no cloud, and it's in public beta now. The docs walk through every step above.
Run untrusted server code with zero authority, then grant back only what it needs.
In this hands-on walkthrough, you'll take a real MCP server, run it in a sandbox where it can reach one host and nothing else, see why a planted attack has nowhere to go, and call it from your coding agent. About five minutes, all on your own machine.
Before you start
You'll sandbox Who's in Space, a small MCP server that reports who is currently in orbit. It reaches one host, api.open-notify.org, and nothing else, which makes the sandbox boundary easy to see. The same four steps sandbox a database or GitHub server.
Step 1
Desktop is the host that enforces the sandbox. It runs each MCP server as a component that starts with no authority at all: no access to your files, network, or environment, and able to reach only what you grant. Everything runs on your machine. Nothing routes through a cloud.
Cosmonic Desktop is in public beta now. Download it and follow along.
Step 2
In Desktop, open the Launchpad, the built-in catalog of ready-made, sandboxed servers. Find Who's in Space MCP and click Review before launch. Desktop shows you the manifest first: what the server says it needs and the one host it is allowed to reach, before a line of its code runs.
Click Deploy. The server reaches Running in under a second. Because it declares itself an MCP server, its row gains an MCP Inspector button in the Tools column.
Step 3
Select the server and click Inspect in its detail panel. The server holds one outbound host and nothing more.
Suppose the server were poisoned and its code told to read ~/.ssh/id_rsa and post it somewhere: it has no filesystem grant to read the key, and no network beyond that one host to send it out. The injection would fire and land on the wall you can see above.
For more detail, see MCP server security.
Step 4
Open the MCP Inspector from the server's row and run the who_is_in_space tool. You'll get the live answer, proof the server works inside its boundary before any agent touches it.
Now connect it. Click Coding agents in the server's row, pick your agent (Claude Code, Cursor, and others), and Desktop registers the sandboxed server for you. Ask your agent "who's in space right now?" and it calls the tool through the same boundary you just inspected. Whatever the server's tools are told to do, the code your agent runs still reaches one host and no more.
What you did
In four steps you ran untrusted server code with zero authority, granted it exactly one host, confirmed the boundary in Inspect, and let your coding agent call it, all on your own machine. A malicious version of that server is held to what you granted and can reach nothing else.
That is how you sandbox an MCP server: get a host, launch the server, grant least authority, and verify the boundary before your agent calls it.
Common questions
Cosmonic Desktop runs this deny-by-default model on your own machine, free forever for personal use, with no account and no cloud, and it's in public beta now. The docs walk through every step above.
Go deeper