MCP on macOS · Roadmap

Desktop AI tools with real boundaries.

macOS-native sandboxing for MCP servers: file, process, and network limits enforced by the OS. No Docker. The pattern would extend third-party egress boundaries from your cloud to the developer machine.

DORA.TPRM-02This pattern is roadmap and is not part of that control’s evidence today. For a walkthrough now, start with the validated AWS path.

Browse use cases Request a demo

Sandbox launch config

json

{
  "mcpServers": {
    "native-container": {
      "command": "/usr/bin/sandbox-exec",
      "args": [
        "-f", "~/.mcp/config/mcp.sb",
        "node", "~/.mcp/server/server.js"
      ]
    }
  }
}

01Operating model

Local agents need boundaries too.

Real sandbox, no Docker: macOS sandbox-exec constrains file, network, and process access.
Explicit permissions: Declare paths and endpoints the MCP server can reach. Everything else is denied.
No parallel governance path: Local isolation, same governance contract as the CLI and cloud workers.

02Architecture

How the sandbox wraps MCP execution

Execution flow

03Security posture

Deny by default

Deny-all first, explicit grants after — the discipline IAM and VPC bring to the cloud, applied to the desktop.

Filesystem

Scoped to declared project paths.

Network

Outbound blocked by default; only declared endpoints open.

Lifecycle

Supervisor-managed launch and logging.

scheme

(version 1)
(deny default)
(allow file-read* (subpath "/Users/yourname/projects"))
(allow process-exec (literal "/usr/local/bin/node"))

Need something you can run today?

The validated AWS path covers capture, approvals, and audit today.

Request a demo Browse use cases