MCP on macOS · Roadmap

Desktop AI tools with real boundaries

macOS-native sandboxing for MCP servers: file, process, and network limits enforced by the OS. No Docker.

This pattern is roadmap. For a live walkthrough today, start with the validated AWS path.

Sandbox launch config

json

{
  "mcpServers": {
    "native-container": {
      "command": "/usr/bin/sandbox-exec",
      "args": [
        "-f", "~/.mcp/config/mcp.sb",
        "node", "~/.mcp/server/server.js"
      ]
    }
  }
}

Operating model

Local agents need boundaries too

Real sandbox, no Docker

macOS sandbox-exec constrains file, network, and process access.

Explicit permissions

Declare paths and endpoints the MCP server can reach. Everything else is denied.

No parallel governance path

Local isolation, same governance contract as the CLI and cloud workers.

Architecture

How the sandbox wraps MCP execution

Execution flow

Security posture

Deny by default

Deny-all first, explicit grants after — the discipline IAM and VPC bring to the cloud, applied to the desktop.

Filesystem

Scoped to declared project paths.

Network

Outbound blocked by default; only declared endpoints open.

Lifecycle

Supervisor-managed launch and logging.

scheme

(version 1)
(deny default)
(allow file-read* (subpath "/Users/yourname/projects"))
(allow process-exec (literal "/usr/local/bin/node"))

Need something you can run today?

The validated AWS path covers capture, approvals, and audit today.

Request a demo Browse use cases