MCP Server Sandbox with gVisor

How to run MCP (Model Context Protocol) servers in a sandboxed environment using gVisor — the userspace kernel that powers Google Cloud Run.

Why sandbox MCP servers?

Every MCP server you install gets access to:

• Your filesystem (~/.ssh/id_rsa, ~/.aws/credentials)
• Your network (exfiltrate data, SSRF)
• Process spawning (run arbitrary commands)
• Environment variables (API keys, tokens)

There's no sandboxing built into MCP. You're trusting the author.

The gVisor sandbox config

docker run --rm \
  --runtime=runsc \
  --network none \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --memory 256m \
  --memory-swap 0 \
  --cpus 0.5 \
  --pids-limit 64 \
  --tmpfs /tmp:rw,size=64m \
  mcp-audit-target

What gVisor catches

• ptrace() attempts — process inspection
• bpf() attempts — eBPF kernel exploits
• mount() attempts — filesystem escapes
• kexec_load() — kernel replacement
• clone3() — namespace creation
• Container escapes via kernel vulnerabilities

Enhanced seccomp fallback

When gVisor isn't available, we use a strict seccomp profile that blocks 30+ dangerous syscalls.

Try it

We've audited 8,764 MCP servers with this sandbox. Results are public.