MCP Sandboxing

declaw mcp wraps any stdio-based MCP server in a Declaw sandbox. Add declaw mcp -- before your existing server command in your MCP client config and the server runs inside a Firecracker microVM with:

Network deny-all by default — outbound traffic is blocked unless you explicitly allowlist domains with --network-allow.
Filesystem isolation — the server cannot read your host files (~/.ssh, ~/.aws, .env, etc.).
Environment forwarding — pass only the credentials the server needs with --env.
File upload — send local files into the sandbox with --file.
Automatic cleanup — the sandbox is destroyed when the MCP client disconnects (stdin closes).

Why sandbox MCP servers?

MCP servers run with the same permissions as your IDE. A malicious or compromised server can:

Read credentials from ~/.ssh/, ~/.aws/, ~/.npmrc, .env
Exfiltrate data to external endpoints
Modify files on your machine
Access cloud metadata services

declaw mcp eliminates these risks by running the server in an ephemeral microVM that has no access to your host filesystem or network.

Quick start

Prefix your MCP server command with declaw mcp --:

# Before (runs on your machine with full access)
npx -y @modelcontextprotocol/server-github

# After (runs in an isolated sandbox)
declaw mcp -- npx -y @modelcontextprotocol/server-github

Client configuration

Configure your MCP client to use declaw as the command. The -- separator separates Declaw flags from the MCP server command.

Cursor
Claude Desktop
Claude Code
Windsurf

Edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "github": {
      "command": "declaw",
      "args": [
        "mcp",
        "--env", "GITHUB_PERSONAL_ACCESS_TOKEN",
        "--network-allow", "registry.npmjs.org,api.github.com,github.com,codeload.github.com",
        "--", "npx", "-y", "@modelcontextprotocol/server-github"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_..."
      }
    }
  }
}

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "github": {
      "command": "declaw",
      "args": [
        "mcp",
        "--env", "GITHUB_PERSONAL_ACCESS_TOKEN",
        "--network-allow", "registry.npmjs.org,api.github.com,github.com,codeload.github.com",
        "--", "npx", "-y", "@modelcontextprotocol/server-github"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_..."
      }
    }
  }
}

Add to your project’s .mcp.json or ~/.claude/mcp.json:

{
  "mcpServers": {
    "github": {
      "command": "declaw",
      "args": [
        "mcp",
        "--env", "GITHUB_PERSONAL_ACCESS_TOKEN",
        "--network-allow", "registry.npmjs.org,api.github.com,github.com,codeload.github.com",
        "--", "npx", "-y", "@modelcontextprotocol/server-github"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_..."
      }
    }
  }
}

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "github": {
      "command": "declaw",
      "args": [
        "mcp",
        "--env", "GITHUB_PERSONAL_ACCESS_TOKEN",
        "--network-allow", "registry.npmjs.org,api.github.com,github.com,codeload.github.com",
        "--", "npx", "-y", "@modelcontextprotocol/server-github"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_..."
      }
    }
  }
}

CLI flags

Flag	Short	Description
`--template`	`-t`	Sandbox template (default: `mcp-server` — includes Node.js + Python)
`--timeout`		Sandbox timeout in seconds (default: `3600` / 1 hour)
`--env`	`-e`	Forward environment variable into sandbox (`KEY` or `KEY=VAL`, repeatable)
`--file`	`-f`	Upload local file into sandbox (`LOCAL_PATH:REMOTE_PATH`, repeatable, max 100 MB)
`--network-allow`		Allowed outbound domains (comma-separated). Without this flag, all outbound traffic is blocked.
`--verbose`	`-v`	Print diagnostic logs to stderr

Environment forwarding

Use --env KEY to forward a variable from your shell environment into the sandbox. The MCP client’s env block sets variables in the process that launches declaw, and --env passes them through to the sandboxed server.

{
  "command": "declaw",
  "args": ["mcp", "--env", "API_KEY", "--", "my-server"],
  "env": { "API_KEY": "sk-..." }
}

You can also set a value directly with --env KEY=VAL:

declaw mcp --env MY_VAR=hello -- my-server

Network allowlist

Without --network-allow, all outbound traffic is blocked (deny-all) and an informational message is printed to stderr: [declaw] network: deny-all (use --network-allow to permit outbound hosts). Specify only the domains the server needs:

declaw mcp \
  --network-allow "api.github.com,github.com,codeload.github.com" \
  -- npx -y @modelcontextprotocol/server-github

Multiple domains are comma-separated in a single flag value.

File upload

Upload local files into the sandbox before the server starts. Useful for single-file MCP servers (e.g. FastMCP scripts):

{
  "command": "declaw",
  "args": [
    "mcp",
    "-f", "/path/to/server.py:/tmp/server.py",
    "--", "python3", "/tmp/server.py"
  ]
}

The format is LOCAL_PATH:REMOTE_PATH. The flag is repeatable for multiple files. Maximum file size is 100 MB.

How it works

declaw mcp creates a Firecracker microVM, starts your MCP server command inside it via stdio, and bridges stdin/stdout between your MCP client and the sandboxed process:

┌──────────────┐  stdin/stdout  ┌─────────────────┐  Declaw API  ┌──────────────────────┐
│  MCP Client  │ ◄────────────► │  declaw mcp CLI │ ◄──────────► │  Firecracker microVM │
│  (Cursor,    │                │  (local process) │              │                      │
│   Claude,    │                │                  │              │  ┌────────────────┐  │
│   etc.)      │                │                  │              │  │  MCP Server    │  │
└──────────────┘                └─────────────────┘              │  │  (your command) │  │
                                                                 │  └────────────────┘  │
                                                                 │  Network: deny-all   │
                                                                 └──────────────────────┘

Sandbox creation — boots a microVM with the mcp-server template (Node.js + Python pre-installed).
File upload — if --file flags are present, files are uploaded before the server starts.
Stdio bridge — the CLI starts the server command via the stdio API and pipes local stdin/stdout to the remote process. MCP JSON-RPC messages flow transparently.
Network enforcement — all outbound traffic is blocked by default. --network-allow adds domain-level exceptions via the L7 TCP proxy.
Cleanup — when the MCP client disconnects (stdin closes), the CLI terminates the sandbox.

Examples

GitHub MCP server with scoped network access

declaw mcp \
  --env GITHUB_PERSONAL_ACCESS_TOKEN \
  --network-allow "registry.npmjs.org,api.github.com,github.com,codeload.github.com" \
  -- npx -y @modelcontextprotocol/server-github

Custom FastMCP server (single file)

declaw mcp \
  -f ./my_tools.py:/tmp/my_tools.py \
  -- python3 /tmp/my_tools.py

Filesystem MCP server (no network needed)

declaw mcp -- npx -y @modelcontextprotocol/server-filesystem /tmp

Verbose mode for debugging

declaw mcp -v \
  --network-allow "api.example.com" \
  -- node server.js

Diagnostic output goes to stderr (invisible to the MCP client).

Next steps

CLI overview — install the CLI, authenticate, and explore all commands
Network policies — domain allowlists, IP/CIDR rules, enforcement details
Stdio — the transport layer declaw mcp uses under the hood
Security overview — PII scanning, prompt injection defense, audit logging
Cookbook: MCP server in sandbox — run MCP servers via the SDK

Getting Started

Core Features

CLI

Security

Platform

Deployment

Architecture

MCP Sandboxing

Why sandbox MCP servers?

Quick start

Client configuration

CLI flags

Environment forwarding

Network allowlist

File upload

How it works

Examples

GitHub MCP server with scoped network access

Custom FastMCP server (single file)

Filesystem MCP server (no network needed)

Verbose mode for debugging

Next steps

​Why sandbox MCP servers?

​Quick start

​Client configuration

​CLI flags

​Environment forwarding

​Network allowlist

​File upload

​How it works

​Examples

​GitHub MCP server with scoped network access

​Custom FastMCP server (single file)

​Filesystem MCP server (no network needed)

​Verbose mode for debugging

​Next steps

Why sandbox MCP servers?

Quick start

Client configuration

CLI flags

Environment forwarding

Network allowlist

File upload

How it works

Examples

GitHub MCP server with scoped network access

Custom FastMCP server (single file)

Filesystem MCP server (no network needed)

Verbose mode for debugging

Next steps