Module mcp_sandbox 

Per-MCP-server sandbox derivation.

§18.4.4 of The Hitchhiker’s Guide to Agentic AI calls for per-tool sandboxing: every code-executing surface needs an isolation profile, an audit trail, and resource limits. Today, MCP servers run as plain child processes (crates/codegen/vtcode-mcp/src/provider.rs::connect_stdio) or as direct HTTP clients (crates/codegen/vtcode-mcp/src/rmcp_client.rs) — only the general-purpose SandboxPolicy protects the harness; MCP servers themselves have no isolation beyond command / endpoint allow-lists.

This module composes a derived SandboxPolicy for each MCP server from the user-supplied parent policy and the per-server configuration. The McpSandboxWrapper type describes the platform-specific command prepending (Seatbelt on macOS, sandbox-executable on Linux) so the runloop can apply it at spawn time.

Structs

McpSandboxOverrides

Per-MCP-server sandbox settings.

McpSandboxWrapper

Description of the per-MCP-server sandbox profile that will be applied at launch time.

Functions

wrap_stdio_command

Apply the per-server sandbox wrapper to a stdio command.