Why We Run Every Agent Tool in Ephemeral Sandboxes
Scraped README files and unverified stdio MCP servers are ripe for prompt injection and token exfiltration. Here is our automated audit pipeline.
The Unverified Stdio Threat
Model Context Protocol grants agents direct execution reach across developer workstations. But granting an autonomous agent access to standard input and output bridges external model inputs directly to OS-level system calls.
An attacker who plants an indirect prompt injection inside a GitHub issue or documentation payload can trick an unsuspecting agent into invoking destructive file deletions or streaming environment variables to remote endpoints.
“Capability is not the number of actions in a schema; it is the reliability of the outcome.”
The Ephemeral Isolation Pipeline
At Markly, we test every MCP server and CLI tool inside isolated Docker containers with non-root user permissions and read-only root filesystems before indexing them.
Our automated testbed monitors network egress, file descriptor mutations, and memory footprint. Tools that attempt covert outbound network calls or ignore explicit parameter bounds are rejected before they reach the directory.