I pointed capgate at Damn Vulnerable MCP. Here's what it caught — and what it couldn't.

Short summary

The author tested capgate, a sandbox compiler for MCP servers, against 10 security challenges. It completely blocked file-traversal attacks via filesystem isolation, partially constrained token exfiltration through egress proxies, but cannot prevent arbitrary shell execution due to grammar limitations. Each limitation is documented with honest caveats.

• •capgate successfully stopped file-traversal attacks by mounting only declared directories into the sandbox
• •Partially mitigated token exfiltration by limiting egress to one allowed API endpoint via proxy rules
• •Cannot express or enforce arbitrary shell execution in its capability grammar—a fundamental design limitation

Generated with AI, which can make mistakes.