Function wrap_stdio_command 

pub fn wrap_stdio_command(
    command: Command,
    sandbox_policy: &SandboxPolicy,
) -> Result<Command>

Apply the per-server sandbox wrapper to a stdio command.

This delegates to the same crate::sandboxing::SandboxManager used by command execution. Unsupported platforms, missing Linux helpers, external policies, and policies whose network rules cannot be enforced exactly all return an error; MCP is never silently launched without its requested boundary.

stdio configuration is inherited by default — callers that need to redirect stdin/stdout/stderr should configure the returned command after this call.