Module mcp_sandbox 

Per-MCP-server sandbox derivation.

§18.4.4 of The Hitchhiker’s Guide to Agentic AI calls for per-tool sandboxing: every code-executing surface needs an isolation profile, an audit trail, and resource limits. Today, MCP servers run as plain child processes (crates/codegen/vtcode-mcp/src/provider.rs::connect_stdio) or as direct HTTP clients (crates/codegen/vtcode-mcp/src/rmcp_client.rs) — only the general-purpose SandboxPolicy protects the harness; MCP servers themselves have no isolation beyond command / endpoint allow-lists.

This module composes a derived SandboxPolicy for each MCP server from the user-supplied parent policy and the per-server configuration. The The stdio wrapper delegates to the canonical sandbox manager so the runloop cannot accidentally launch an MCP server outside the requested boundary.

Structs

McpSandboxOverrides

Per-MCP-server sandbox settings.

Functions

wrap_stdio_command

Apply the per-server sandbox wrapper to a stdio command.