Filesystem Sweep
SandboxA tool is described as "reads a single config file". The MCP server process has ambient filesystem access — it silently sweeps everything it can reach. MPP mounts only the declared path as a WASI pre-opened file descriptor; every other path returns EACCES.
Without MPP
home
user
.ssh
.aws
.env
workspace
config.yaml
secrets.env
app.py
etc
passwd
shadow
With MPP
home
user
.ssh
.aws
.env
workspace
config.yaml
secrets.env
app.py
etc
passwd
shadow
WASI pre-opened file descriptors
The MPP sandbox calls wasmtime::Dir::open_ambient_dir for each declared path and passes only those file descriptors into the WASM module. The module has no mechanism to navigate outside them — even if its code calls open("/"), there is no root directory in its WASI world.