lintai docs

Appearance

Rule Reference

SEC397lintai-ai-securitygovernancehardeningstablejsonwarn

MCP config: sandbox disabled

MCP configuration disables sandboxing with `sandbox: false` or `disableSandbox: true`

Public lane
governance
Category
hardening
Provider
lintai-ai-security
Scope
per-file
Surface
json
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message only
How to read this lane

Shared authority and workflow policy review.

How to read this category

Least-privilege, provenance, or operational hygiene signal.

Activation Model

Preset Activation

These presets explain where this rule appears in the product experience.

governancesidecar lane
mcpsurface preset

Lifecycle

Stable Lifecycle Contract

State

stable

Graduation rationale

Matches explicit MCP config booleans that disable sandbox isolation.

Deterministic signal basis

JsonSignals exact boolean detection for `sandbox: false` or `disableSandbox: true` on parsed MCP configuration.

Malicious corpus
mcp-sandbox-disabled
Benign corpus
mcp-sandbox-enabled-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesgovernancehardeningjson
SEC394MCP config: wildcard auto-approveMCP configuration auto-approves all tools with `autoApprove: ["*"]`governancehardeningjson
SEC395MCP config: autoApproveTools trueMCP configuration auto-approves all tools with `autoApproveTools: true`governancehardeningjson
SEC396MCP config: trustTools trueMCP configuration fully trusts tools with `trustTools: true`governancehardeningjson
SEC398MCP config: wildcard capabilitiesMCP configuration grants all capabilities with `capabilities: ["*"]` or `capabilities: "*"`governancehardeningjson
SEC546MCP config: Bash(*) auto-approveMCP configuration auto-approves blanket shell execution with `autoApprove: ["Bash(*)"]`governancehardeningjson

SEC397 / MCP-SANDBOX-DISABLED ​

SEC397 flags MCP client configuration that explicitly disables sandbox isolation through sandbox: false or disableSandbox: true.

Why It Matters ​

Sandbox isolation is one of the clearest trust boundaries in shared MCP config. Disabling it widens what the launched server can do on the host and makes accidental overreach harder to review.

Trigger Shape ​

The rule triggers only when all of these are true:

  • the file is a detected MCP config surface
  • the path is not fixture-like
  • either sandbox is set to the exact boolean false
  • or disableSandbox is set to the exact boolean true

Clean Cases ​

These stay clean:

  • sandbox: true
  • disableSandbox: false
  • MCP configs that do not set either key
  • fixture-like examples under test or fixture paths

Example Trigger ​

json
{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "sandbox": false
    }
  }
}

Safer Example ​

json
{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "sandbox": true
    }
  }
}

How To Fix ​

Re-enable sandboxing and prefer reviewed, least-privilege MCP isolation settings.