OptionalrootPath: stringDirectory under which all workspaces are created. Defaults to a folder in the
OS temp dir, which is fine for run scope but should be pointed somewhere
durable when using agent or agent-user scopes, since temp dirs get swept.
Releases the workspace.
Must be safe to call on every exit path including crash and cancellation, and must not throw — a finalize that throws inside a failure path masks the original error with a cleanup error.
Provisions (or reattaches to) the workspace identified by key.
Phase-1 sandbox: a scoped directory on the MJ server's own filesystem.
What this does and does not protect against
It gives each run a workspace of the right lifetime and keeps agents out of each other's files. It does not contain the harness process: a determined harness can read outside its workspace, and
NetworkPolicyis advisory here because nothing intercepts the process's sockets. Real enforcement needs the container provider, andmcp-onlyis the recommended production posture precisely because it is the one that can actually be enforced.Saying so plainly matters more than the code: an operator who believes
networkPolicy: 'none'is enforced by this provider has a false sense of containment, which is worse than knowing the boundary is soft.