Sandbox
Sandbox Playground
Onboard an MCP server and run it inside MCP Sentinel's measured jail — a container where network egress is denied and captured and the host filesystem is confined, both observed before anything is spawned. Because the artifact is our own fetched copy running in our own container with no third party reachable, every tool may be exercised and the server is judged by witnessed behavior, not just what it declares. That is the contrast with the ad-hoc scanner, which reads source and metadata statically and, for a live URL, only enumerates read-only.
Sandboxed runs happen only where this deployment can actually build a confining jail. Where it cannot, the run is refused honestly (a service-unavailable response), never reported as a clean pass — refused is not clean.
Sandboxed execution — the fetched artifact runs in the measured jail (network egress denied, host filesystem confined).
We synthesize a one-server stdio config — "command":"npx","args":["-y", …] — fetch that published release and run it in the jail.
Full registry scan — all 183 active rules
Every one of the 183 active rules is browsable and individually selectable above — nothing a full registry scan runs is hidden from this catalogue.
What a jailed run produces
On a host that can build a confining jail, the run executes and the result view shows:
- Severity-ranked findings from the deterministic engine — each named, with any OWASP MCP / MITRE ATLAS mapping it carries, plus a per-server coverage note showing what did and did not run (out-of-scope is never dressed up as a clean pass).
- Watch it run — a per-tool step-through of the witnessed behavior of the highest-risk tools (a risk-ordered sample, not the whole surface): declared annotation hints vs what running each did — filesystem writes observed host-side, and outbound attempts the tool’s own output evidenced (the jail denies all egress at the routing layer) — plus the redacted input/output and the tool→tool feeding chain. A tool that declared
readOnlyHint: truebut was caught writing or reaching off-box is flagged as a divergence. - Cross-server intelligence (multi-server config): the deterministic risk matrix (P01–P12) and attack-graph kill chains (KC01–KC07) over the observed servers, plus any witnessed cross-server toxic flow — a real read on one server composed into a real egress attempt on another, both inside the jail.
The intelligence layer is deterministic — risk patterns and kill chains, no LLM guessing in the analysis path. A live adversarial-LLM narrative is a future authenticated-workspace capability; it is deliberately not run on this public page, because an anonymous live-LLM pass is an unbounded cost surface. Everything above degrades honestly: where the host cannot build a confining jail, the sandbox observation is reported as a coverage gap (the console simply does not appear, and the scan continues source-only) — never a clean pass.