Use case · MCP servers · Updated 2026-10-31
Run each MCP server in its own microVM, behind one gateway.
An MCP server sandbox stops a tool server you downloaded from reading your files, keys and network. kosa8 runs each registered MCP server as a container in its own microVM with the network rule you give it, and puts one gateway, kosa8 mcp serve, between those servers and your AI client. The gateway pins each tool's definition, checks calls against your rules and writes every call to an audit log.
01Why do MCP servers need a sandbox?
An MCP server started the usual way, with npx, uvx or pip, runs as you, with your files, SSH keys and network. The MCP specification's security best practices list arbitrary code execution, data exfiltration and data loss as risks of local servers, and recommend sandboxing them with minimal default privileges.
The words are a risk too. A tool's description is text the model follows, so a poisoned description, or one that changes after you approved it, can steer your assistant into calling other tools.
02One microVM per server
Register a server with its image, the only hosts it may reach and the tools to expose. Registration writes an entry to ~/.kosa8/mcp-servers.json; the gateway boots each server in a sandbox named mcp-NAME when it starts. Without --egress or --egress-allow the default is any, unless your organisation's policy sets default_egress, so name the hosts.
kosa8 mcp add github --image node:22-alpine \ --egress-allow api.github.com --egress-allow registry.npmjs.org \ -e GITHUB_TOKEN=... --allow-tool list_issues --allow-tool create_issue \ -- npx -y @modelcontextprotocol/server-github kosa8 mcp ls
03One gateway for every client
Your client configures a single MCP server, kosa8 mcp serve, over stdio, or over HTTP with a bearer token. In Claude Code:
The same gateway serves 30 tools that drive kosa8 itself, so an assistant can create its own sandbox, checkpoint it and rewind it. kosa8 mcp tools lists them.
04Pinned tool definitions
The first time the gateway sees a server it records a SHA-256 digest over each tool's name, title, description, schemas and annotations. A tool whose definition later changes, or a new tool, is withheld from the model until a person approves it at a terminal; run from a script or pipe, approve refuses.
kosa8 mcp pins diff github kosa8 mcp pins approve github
05Rules on arguments: allow, deny or ask
A tool list says which tools an agent may use; rules say what for. Rules in a signed MCP policy look at each call's arguments and answer allow, deny or ask a person first, and deny beats ask beats allow. Test a call against the installed policy:
Held calls wait for kosa8 mcp asks and kosa8 mcp approve ID.
06Every call on the record
Each call to a third-party server is written to the hash-chained audit log as an mcp.decision entry, and an allowed call also gets an mcp.result entry. Arguments and results are recorded by SHA-256 digest, not stored.
kosa8 audit ls kosa8 audit verify
07How to start
Install kosa8 and start its daemon.
Register a server with
kosa8 mcp add, then point your client at the gateway.
08Questions
What does the kosa8 MCP sandbox isolate?
Each registered server runs as a container in its own kosa8 microVM, with its own kernel and the network rule you gave it. It cannot see your files, the other servers, or kosa8's own state.
What happens when an MCP server changes a tool's description?
The gateway withholds that tool from the model and says so. A person reviews the change with kosa8 mcp pins diff and accepts it with kosa8 mcp pins approve at a terminal.
Does the sandbox protect secrets I pass to a server with -e?
Only partly. A value passed with -e is in the server's environment, so it can be sent to any host the server is allowed to reach. Keep each server's --egress-allow list short.
Which MCP clients can use the kosa8 gateway?
Any MCP client. kosa8's docs show Claude Code, and test the AI SDK's MCP client, LangChain.js MCP adapters and Mastra against kosa8 mcp serve.
09Guides and articles
- How do I run MCP servers in a sandbox?
- How do I require human approval before an AI agent runs a risky command?
- How do I restrict an AI agent's network access to an allow-list?
- MCP tool poisoning and rug pulls, explained
- What is an MCP gateway, and do you need one?
- What an audit log for AI agents should record
10Sources
11Try it on your own machine
Install kosa8, register your MCP servers, and give your client one gateway instead of many processes running as you.
Updated 2026-10-31