Your MCP skills need a security sandbox — here's the 10-minute setup that prevents disasters

MCP skills are the new npm packages — incredibly powerful, completely unvetted, and one bad install away from owning your entire system.

Unlike npm though, MCP skills don't just access your filesystem. They get your agent's context, your API keys, your browser sessions, and whatever permissions you've granted. A malicious skill doesn't need to escape a sandbox — you invited it inside the fortress.

Here's the security model most people are running:

{
  "mcpServers": {
    "cool-new-skill": {
      "command": "npx",
      "args": ["some-random-github-repo"]
    }
  }
}

That skill now has:

• Network access to exfiltrate your conversations
• Filesystem access to read your SSH keys
• Process spawning to install backdoors
• Environment variable access to steal API tokens

The fix isn't to stop using MCP skills — they're too useful. The fix is to run them in a proper security boundary.

Method 1: Docker Isolation (Recommended)

Wrap every untrusted MCP skill in a Docker container with minimal permissions:

{
  "mcpServers": {
    "untrusted-skill": {
      "command": "docker",
      "args": [
        "run", "--rm", 
        "--network=none",
        "--read-only",
        "--tmpfs=/tmp:noexec",
        "--user=1000:1000",
        "skill-container",
        "node", "skill.js"
      ]
    }
  }
}

This gives the skill zero network access, zero write access, and zero ability to persist changes.

Method 2: Dedicated User Account

If Docker feels heavy, create a restricted user account for MCP skills:

# Create restricted user
sudo useradd -m -s /bin/false mcp-sandbox
sudo chmod 700 /home/mcp-sandbox

# Run skills as this user
{
  "command": "sudo",
  "args": [
    "-u", "mcp-sandbox",
    "node", "/path/to/skill.js"
  ]
}

Method 3: Network-Level Isolation

Use a firewall rule to block MCP processes from network access:

# Block network for MCP user
sudo iptables -A OUTPUT -m owner --uid-owner mcp-sandbox -j DROP
sudo iptables -A OUTPUT -m owner --uid-owner mcp-sandbox -d 127.0.0.1 -j ACCEPT

Pro tip: Create a "trusted" and "sandbox" config. Trusted skills (ones you've audited) get full access. Everything else goes in the sandbox first.

The MCP ecosystem is exploding right now. New skills appear daily, and most look legitimately useful. But "useful" and "safe" aren't the same thing. A skill that can "help manage your files" can also steal your SSH keys. A skill that "integrates with your calendar" can exfiltrate your meeting notes.

Security boundaries aren't paranoia — they're basic operational hygiene. Your agent is becoming more powerful every week. Make sure you're the only one controlling that power.