A lot of these MCP servers run locally because they need access to your files, shell, browser, etc. The problem: they typically run with the same privileges as your user. If a server is buggy, misconfigured, or prompt-injected, it can do anything you can do: read SSH keys, exfiltrate dotfiles, poke around in private repos, etc.

Our research group is working on this by adding a security manifest (inspired by the Android app manifest) plus a local policy enforcement engine that sandbox MCP servers. You can specify which hosts they can reach, which files/directories they can read/write, and so on, instead of giving them full user-level access.

Code and docs: https://github.com/orgs/GuardiAgent/repositories https://www.guardiagent.com

Curious how others are locking down agents/tools today and what you'd want from a system like this.