Implementation guide
OWASP AISVS v1.01
Model Context Protocol (MCP) Security · Component Integrity
Sandbox local MCP servers
Verify that locally launched MCP servers run in a least-privilege sandbox with restricted file system, network, and system access.
OWASP AISVS v1.01, requirement 10.1.3
In plain English
A local MCP server normally starts as a child process with all of the user's rights: their files, their SSH keys, their network. Run local servers in a sandbox that limits file, network and system access to what the server needs.
What good looks like
- Local servers run with least privilege and never as an administrator.
- File access is limited to named folders.
- Network access is limited to the destinations the server needs, or switched off.
- The server does not inherit the user's full environment, including secrets held in environment variables.
How teams usually do it
- Run the server in a container with only the needed directories mounted and a restricted network.
- Operating system sandboxing: seccomp, Landlock or bubblewrap on Linux, the sandbox facilities on macOS, or AppContainer on Windows.
- Use the sandboxing features of the MCP client where it has them, and pass only the environment variables the server needs.
Suggested evidence
- Sandbox configuration for each local server.
- A test showing the server cannot read files outside its folders or reach unapproved hosts.
Common mistakes
- Running a local server as the user, with their whole home folder in reach.
- Passing the entire shell environment, cloud credentials included, to the server process.
- Mounting the Docker socket into the server's container.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.