From 20e574ac26c26fe8bce5877912a9f4e1ee82d029 Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Wed, 18 Mar 2026 23:50:41 +0100 Subject: [PATCH] Document custom sandbox configurations via YAML --- docs/code-execution-security-guide.md | 2 ++ docs/code-execution-security.md | 2 ++ 2 files changed, 4 insertions(+) diff --git a/docs/code-execution-security-guide.md b/docs/code-execution-security-guide.md index f40ff53..d6066d2 100644 --- a/docs/code-execution-security-guide.md +++ b/docs/code-execution-security-guide.md @@ -180,6 +180,8 @@ By default (when the `sandbox` argument is not specified), `execute_code` uses t For higher-risk scenarios (e.g., running untrusted scripts, processing sensitive data), the `anvilmcp` sandbox should be explicitly specified to ensure the tighter restrictions are enforced — it uses a temporary workspace, minimal filesystem access, and a restricted set of environment variables. +Custom sandbox configurations can be created by adding a YAML file to the `sandbox/` subdirectory in the anvillm config directory (`~/.config/anvillm/sandbox/`). These can be as permissive or restricted as desired. + ### Adjusting Timeout Default: 30 seconds diff --git a/docs/code-execution-security.md b/docs/code-execution-security.md index 03c714c..aa116af 100644 --- a/docs/code-execution-security.md +++ b/docs/code-execution-security.md @@ -320,6 +320,8 @@ By default (when the `sandbox` argument is not specified), `execute_code` uses t For higher-risk scenarios (e.g., running untrusted scripts, processing sensitive data), the `anvilmcp` sandbox should be explicitly specified to ensure the tighter restrictions are enforced — it uses a temporary workspace, minimal filesystem access, and a restricted set of environment variables. +Custom sandbox configurations can be created by adding a YAML file to the `sandbox/` subdirectory in the anvillm config directory (`~/.config/anvillm/sandbox/`). These can be as permissive or restricted as desired. + ### bash Permissions ```bash