wiring-sbx-mcp-servers
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The documentation describes the functionality of the
sbx mcp add --commandflag, which allows for the execution of host-side processes. The instructions include security warnings regarding host-run servers, noting they operate outside of sandbox isolation with full host filesystem and network access. - [REMOTE_CODE_EXECUTION]: The skill provides instructions for registering remote MCP endpoints via the
--urlflag, facilitating connections to external servers. - [DATA_EXFILTRATION]: The content outlines best practices for credential management, including the use of
sbx secret setto store OAuth client secrets in the host OS credential store rather than within individual sandboxes. - [INDIRECT_PROMPT_INJECTION]: The documentation describes the attack surface of the dynamic MCP gateway, which allows agents to discover and interact with external tool providers.
- Ingestion points: Data enters the environment via registered MCP server endpoints (
--url) or local packages (--local). - Boundary markers: The document details the use of Cedar policies (e.g.,
permit,forbid) to restrict tool invocation and registration. - Capability inventory: The gateway exposes tools like
mcp-exec,mcp-add, andcode-modefor dynamic tool execution. - Sanitization: Access is managed through identity URLs, OAuth scopes, and Cedar-enforced governance policies.
Audit Metadata