Does MCP sandbox its servers at the protocol level?

**MCP** is a messaging protocol. It defines how a host application and a server talk over JSON-RPC: how they connect, list tools, call them, and return results. That is the whole job. It does not define a jail for the server. So the answer is no. MCP does not sandbox servers at the protocol level. There is no resource limit, no file-access boundary, no network restriction baked into the spec. A local stdio server is just a process you launched, and it runs with the same privileges as the account that launched it. That means a server can read any file your user can read, write where your user can write, and call any network endpoint. The user-approval prompt you see before a tool runs is about consent for that action. It is not a cage around the process. Isolation is the operator's job. If you want a server contained, you run it in a container, give it a separate low-privilege user, or restrict its filesystem and network. The protocol hands you the responsibility; it does not do it for you.

No. MCP defines messaging, not isolation. The spec covers the wire format. It standardizes JSON-RPC over stdio or streamable HTTP, the initialize handshake, and the three primitives: tools, resources, and prompts. None of that includes process isolation, resource quotas, or capability revocation. Those words do not appear as protocol guarantees. A local stdio server is a subprocess the host spawns. It inherits the host process's privileges. It can read any file that account can read and make any outbound network call. The per-call user approval is a consent gate, not a sandbox. Approving a tool does not box in what the underlying code does once it runs. Security is the host and operator's responsibility. If you want isolation, you build it. Run the server in a container with a read-only root and a tight egress policy. Give it a dedicated low-privilege user. Scope filesystem access to one directory. For remote servers, the OAuth layer handles authorization but still not runtime isolation. The interview-grade summary: MCP is a transport and capability-description protocol. It is intentionally silent on execution constraints. Treating an approved server as contained is the trap.