MCP Jail: confine local MCP servers to the files their tools declare

The basic layer is taken. Anthropic's srt, nono, landrun, mcpproxy-go and MCP Cage already wrap a local MCP server in Landlock or Seatbelt. Docker's MCP Gateway already sells central Cedar policies with allow/deny audit logs. A plain wrapper CLI or an audit-log team tier would struggle to stand out, especially with Anthropic shipping its own sandbox. What I didn't find is anyone deriving a per-server allowlist automatically from tool schemas and declared paths, and none of the tools I saw rewrites .mcp.json and Claude Desktop configs in one step. I also found no tool that checks what a server says it does against what it actually does. Today's scanners (mcp-scan, Cisco mcp-scanner) only look at tool descriptions for prompt injection. None of them trace real filesystem calls under hostile path arguments, and none issue a "confined" badge that server authors could show. The most defensible entry is the Laundering Scan, run as a verification and badge service with a public registry of confinement results. The jail CLI would then be the free way users adopt it, preferably built on srt or nono rather than competing with them. The risk is that Anthropic, Docker or Invariant/Snyk could add the same check fairly easily.

• Anthropic Sandbox Runtime (srt)

  Anthropic's open-source CLI for macOS and Linux. It wraps a command in OS-level filesystem and network limits, and its docs explicitly cover sandboxing local MCP servers. It is deny-by-default with allowlists you add. It is still a beta research preview. This is the closest direct overlap with the mcpjail CLI, and it comes from the vendor whose clients the idea targets.

• nono

  An open-source Rust sandbox using Landlock on Linux and Seatbelt on macOS. Its permissions are set at launch and can't be widened afterwards. It is aimed at agents like Claude Code and, according to its AUR listing, MCP servers too. It also has a network proxy. It is early alpha.

• landrun

  A general-purpose Landlock wrapper that needs no root and no containers. It controls filesystem, TCP and Unix socket access, and people already use it to wrap stdio MCP servers. It is Linux only.

• mcpproxy-go sandbox

  An MCP proxy that confines stdio MCP servers with Landlock through a re-exec wrapper, as a lighter option where Docker isn't available.

• MCP Cage (smcp)

  Describes itself as the execution sandbox for MCP servers. It checks package integrity, applies Landlock and network namespaces, sets resource limits, redacts secrets and logs activity. It is tied to a hub platform that pre-screens packages.

• declaw CLI

  Runs any stdio MCP server in a Firecracker microVM when you prefix the server command with 'declaw mcp'. Network access is deny-by-default, and only environment variables you forward get in.

• Docker MCP Gateway / Enterprise Gateway

  Runs MCP servers in containers with only the mounts you grant. Organizations write policies in Cedar, can restrict servers that run directly on the host, and get structured audit events for each allow or deny. This already covers the paid shared-policies-plus-audit-logs tier.

• Invariant Labs mcp-scan

  The most widely cited scanner for MCP configs. It covers tool poisoning, rug pulls and toxic flows, in static and runtime modes. It focuses on tool descriptions, not on comparing declared file access with actual syscalls.

• Cisco mcp-scanner

  Scans tool descriptions and schemas with YARA rules. It is a static, description-level check with no runtime filesystem tracing.

• Snyk (labs guidance on tool poisoning)

  Snyk Labs has written up how to detect MCP tool poisoning and recommends running mcp-scan. It shows a large security vendor is already working in the MCP-scanning category.

Checked 2026-10-16