iliad_code_sandbox · AXIS iliad MCP: Risk & Policy

WHAT IT DOES

What iliad_code_sandbox does on AXIS iliad

AI agents invoke iliad_code_sandbox to trigger actions in AXIS iliad. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why iliad_code_sandbox needs a policy

This tool executes arbitrary code (Python, Node.js, or Bash) inside a Docker container. Despite strong sandboxing measures (no network, read-only filesystem, dropped capabilities), it still runs arbitrary code provided by the caller. Misuse could involve executing malicious logic, exfiltrating data available in the container context, or consuming compute resources.

From the tool's definition secure code execution...spawns a fresh ephemeral Docker container...Supports python | node | bash via the multi-runtime image

Risk signalsAdmin/system-level operation

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

iliad_code_sandbox Rate-limited

iliad_code_sandbox stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "iliad_code_sandbox": {
      "limits": [
        {
          "counter": "iliad_code_sandbox_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches AXIS iliad, so you can run agents against it safely.

FAQ

Questions about iliad_code_sandbox

What does the iliad_code_sandbox tool do? +

AXIS-owned secure code execution. Each call spawns a fresh ephemeral Docker container with hardened isolation: no network, read-only root filesystem, all Linux capabilities dropped, no-new-privileges, PID/memory/CPU limits, tmpfs /tmp only, runs as nobody:nobody. Container is force-removed after each call. Supports python | node | bash via the multi-runtime image. It is categorised as a Execute tool in the AXIS iliad MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on iliad_code_sandbox? +

Register the AXIS iliad MCP server in PolicyLayer and add a rule for iliad_code_sandbox: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches AXIS iliad. Nothing to install.

What risk level is iliad_code_sandbox? +

iliad_code_sandbox is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit iliad_code_sandbox? +

Yes. Add a rate_limit block to the iliad_code_sandbox rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block iliad_code_sandbox completely? +

Set action: deny in the PolicyLayer policy for iliad_code_sandbox. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides iliad_code_sandbox? +

iliad_code_sandbox is provided by the AXIS iliad MCP server (lastmanupinc-hub/axis-iliad). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.