One container per tool
Each MCP server runs in its own container, with its own filesystem and its own secrets.
WhereConsoleTerraform
Introduced Apr 2, 2026
Kata Containers + Firecracker microVM
Pod
agent-initdrops agynd + agent CLI, then exits
hands offAgent container
Claude Code · Codex · agyn-agent — runs the loop
- Dedicated workspace volume — not shared with other agents
- Restricted profile: no root, no caps, read-only root FS, no privilege escalation
- No provider keys, no tool tokens, no env secrets
tool calls over localhost
github MCP
secret: github-token
isolated from db-password
database MCP
secret: db-password
isolated from github-token
Per-pod kernel
Firecracker microVM per Pod — separate guest kernel. A sandbox escape stays inside the VM.
Drop-in via RuntimeClass
Kubernetes drives Kata like any other runtime. Existing manifests run unchanged.
MCP supply-chain blast radius
A compromised MCP server cannot read another MCP's credentials or filesystem.
How it works
Isolation per tool.
Each MCP server runs in its own container with its own filesystem and its own secrets.
A blast radius of one.
A compromised tool cannot read another tool's credentials or the agent's working directory.
Localhost between them.
The agent reaches its tools inside the workload — nothing is exposed beyond it.
See it on your own cluster.
Thirty minutes, your infrastructure, your stack. Or skip the call — it is one Helm release onto a cluster you already run.