Stop Installing MCP Servers on Your Laptop — Here's a One-Click Sandbox for Claude

A practical guide to running MCP servers without trusting them. Works with Claude Code and Claude Desktop, no fork required. The MCP Install Path Is an Arbitrary-Code-Execution Invitation Every guide tells you the same thing. Open your Claude config, drop in this one-liner: { "mcpServers" : { "filesystem" : { "command" : "npx" , "args" : [ "@modelcontextprotocol/server-filesystem" , "/Users/me" ] } } } That's the whole security boundary. npx resolves a package name against npm — whatever version