MCP tools don't respect sandboxing.
What version of Codex is running?
0.65.0
What subscription do you have?
Pro
Which model were you using?
_No response_
What platform is your computer?
_No response_
What issue are you seeing?
While building the dictator, i noticed that tools can bypass sandbox restriction.
A tool can do network call or write in the file system even when codex is in read-only mode.
What steps can reproduce the bug?
1) use a MCP that can do modify or do network calls.
2) assure you are in read-only approval mode
3) Ask llm to use the tool
4) File system change.
What is the expected behavior?
the MCP i linked above is a pre-linter, it has 2 tools. the diagnostic one should work in readonly, but the autofixer should not.
The agent should not be able to by pass sandboxing with tools.
Additional information
I already fixed this locally by modifying codex to remove any tool that has destructive annotation or no annotation.
In short, anything that is suspect should not be provided agent. MCP server authors should upgrade their spec to support annotation.
If no body is working on it, i can open a PR.
6 Comments
Yes, MCP servers are not run in the codex sandbox. This is by design. You'll find the same is true with other coding agent harnesses. The MCP server can receive information about the sandbox mode that's in effect if it specifies that it supports the "codex/sandbox-state" capability.
The mcp server have annotations in tools which show they it destructive, and support the "codex/sandbox-state".
When sandbox-state is received, the tool does remove the destructive tools from the manifest.
However Codex do not refresh it list and keep using the tools.
Claude code suffer from the same problem.
However Crush does not => it does refresh the tools when it receive the notification.
All this follow the MCP spec. I'm not asking for experimental feature.
If you'd like to see a new feature or capability, please open an enhancement request.
In my initial post, i said that i can open a PR with the fix/enhancement .
I just want to know if you consider that as a bug or it is part of CLI design.
The CLI is working as designed currently, so I don't consider it a bug.
That is really unfortuante!
Built in JS REPL tool has write access to filesystem that bypass sandboxing! It is run as regualr process outside of sandbox and it have all capabilities to spawn new processes etc.