The base image's entrypoint pins the Deno sandbox to --allow-run=bash, but a stdio MCP server (tools.mcp[].command) is spawned directly by StdioClientTransport. Inside the container, any command other than bash is denied by Deno before the server ever starts.
The gh-issues-mcp example works around this by launching the server through bash:
tools:
mcp:
- name: github
command: ["bash", "-c", "exec /usr/local/bin/github-mcp-server stdio"]The absolute path matters too: the server's env is scoped to its env: block, so there is no PATH for bash to search.
Two possible fixes:
- Compile
tools.mcp[].command[0] into the entrypoint's --allow-run the same way permissions.run compiles to flags (needs the entrypoint to re-exec, or the CLI to assemble flags before the in-process run).
- Have
connectMcpServers wrap stdio commands in bash -c exec ... itself, so configs can declare the real command and the docs example (docs/tools.md shows command: ["docker", "run", "-i", ...]) works unchanged in the container.
Either way, the config as documented should run in the container without the author knowing about the sandbox's allow-run list.
🤖 Generated with Claude Code
The base image's entrypoint pins the Deno sandbox to
--allow-run=bash, but a stdio MCP server (tools.mcp[].command) is spawned directly byStdioClientTransport. Inside the container, any command other thanbashis denied by Deno before the server ever starts.The
gh-issues-mcpexample works around this by launching the server through bash:The absolute path matters too: the server's env is scoped to its
env:block, so there is noPATHfor bash to search.Two possible fixes:
tools.mcp[].command[0]into the entrypoint's--allow-runthe same waypermissions.runcompiles to flags (needs the entrypoint to re-exec, or the CLI to assemble flags before the in-process run).connectMcpServerswrap stdio commands inbash -c exec ...itself, so configs can declare the real command and the docs example (docs/tools.mdshowscommand: ["docker", "run", "-i", ...]) works unchanged in the container.Either way, the config as documented should run in the container without the author knowing about the sandbox's allow-run list.
🤖 Generated with Claude Code