Security Boundary

Coding Tools MCP exposes primitives, not an agent workflow engine.

The boundary is:

• direct file tools accept workspace-relative paths only
• exec_command starts in a workspace cwd
• safe/trusted modes filter secrets and loader/startup env
• safe/trusted modes block destructive commands
• safe mode blocks network-looking commands, shell expansion, and inline scripts
• Landlock confines filesystem access when available

The boundary is not:

• a complete OS sandbox on every platform
• a package-manager policy engine
• a project build/test/install orchestrator
• an active network egress firewall

For untrusted workspaces or untrusted MCP clients, run the server inside an external container or VM with no host secrets and restricted network egress.