Add sandbox enforcement to mcptools scripts

cmd/anvilmcp/execute.go

@@ -182,6 +182,8 @@ func executeCode(code, language string, timeout int) (string, error) {
 			{"--rox", "/bin"},
 			{"--ro", "/etc/alternatives"},
 			{"--ro", "/etc/ld.so.cache"},
+			{"--rw", "/dev/null"},
+			{"--ro", "/dev/urandom"},
 		}
 		
 		for _, sp := range systemPaths {

mcptools/capture_browser.sh

@@ -3,6 +3,12 @@
 # description: Capture browser window showing a specific URL: capture_browser.sh [output_path] [url_pattern]
 set -e
 
+# Verify running under landrun (test filesystem restriction)
+if cat /etc/passwd >/dev/null 2>&1; then
+  echo "Error: This script must be run via execute_code tool" >&2
+  exit 1
+fi
+
 OUTPUT="${1:-${TMPDIR:-/tmp}/browser_capture.png}"
 URL_PATTERN="${2:-localhost}"
 

mcptools/list_sessions.sh

@@ -3,6 +3,12 @@
 # description: List all active agent sessions (JSON array)
 set -euo pipefail
 
+# Verify running under landrun (test filesystem restriction)
+if cat /etc/passwd >/dev/null 2>&1; then
+  echo "Error: This script must be run via execute_code tool" >&2
+  exit 1
+fi
+
 9p read agent/list | jq -Rs '
   split("\n") | map(select(length > 0)) | map(
     split("\t") | {

mcptools/list_skills.sh

@@ -3,6 +3,12 @@
 # description: List all available skills (JSON array)
 set -euo pipefail
 
+# Verify running under landrun (test filesystem restriction)
+if cat /etc/passwd >/dev/null 2>&1; then
+  echo "Error: This script must be run via execute_code tool" >&2
+  exit 1
+fi
+
 if [ -z "${ANVILLM_SKILLS_PATH:-}" ]; then
   echo "[]"
   exit 0

mcptools/read_inbox.sh

@@ -3,6 +3,12 @@
 # description: Read messages from agent inbox: AGENT_ID
 set -euo pipefail
 
+# Verify running under landrun (test filesystem restriction)
+if cat /etc/passwd >/dev/null 2>&1; then
+  echo "Error: This script must be run via execute_code tool" >&2
+  exit 1
+fi
+
 agent_id="${1:?Usage: read_inbox <agent_id>}"
 inbox_path="agent/${agent_id}/inbox"
 

mcptools/send_message.sh

@@ -3,6 +3,12 @@
 # description: Send message to agent or user: FROM TO TYPE SUBJECT BODY
 set -euo pipefail
 
+# Verify running under landrun (test filesystem restriction)
+if cat /etc/passwd >/dev/null 2>&1; then
+  echo "Error: This script must be run via execute_code tool" >&2
+  exit 1
+fi
+
 from="${1:?Usage: send_message <from> <to> <type> <subject> <body>}"
 to="${2:?Usage: send_message <from> <to> <type> <subject> <body>}"
 type="${3:?Usage: send_message <from> <to> <type> <subject> <body>}"