lintai docs

Appearance

Rule Reference

SEC397lintai-ai-securitystablejsonwarn

MCP config: sandbox disabled

MCP configuration disables sandboxing with `sandbox: false` or `disableSandbox: true`

Provider
lintai-ai-security
Surface
json
Scope
per_file
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership
mcpmembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Matches explicit MCP config booleans that disable sandbox isolation.

Deterministic signal basis

JsonSignals exact boolean detection for `sandbox: false` or `disableSandbox: true` on parsed MCP configuration.

Malicious corpus
mcp-sandbox-disabled
Benign corpus
mcp-sandbox-enabled-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cjsonstable
SEC302Config: insecure HTTP endpointConfiguration contains an insecure http:// endpointjsonstable
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesjsonstable
SEC304Config: TLS verification disabledConfiguration disables TLS or certificate verificationjsonstable
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuejsonstable
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesjsonstable

SEC397 / MCP-SANDBOX-DISABLED ​

SEC397 flags MCP client configuration that explicitly disables sandbox isolation through sandbox: false or disableSandbox: true.

Why It Matters ​

Sandbox isolation is one of the clearest trust boundaries in shared MCP config. Disabling it widens what the launched server can do on the host and makes accidental overreach harder to review.

Trigger Shape ​

The rule triggers only when all of these are true:

  • the file is a detected MCP config surface
  • the path is not fixture-like
  • either sandbox is set to the exact boolean false
  • or disableSandbox is set to the exact boolean true

Clean Cases ​

These stay clean:

  • sandbox: true
  • disableSandbox: false
  • MCP configs that do not set either key
  • fixture-like examples under test or fixture paths

Example Trigger ​

json
{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "sandbox": false
    }
  }
}

Safer Example ​

json
{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "sandbox": true
    }
  }
}

How To Fix ​

Re-enable sandboxing and prefer reviewed, least-privilege MCP isolation settings.