Deny reading `gcloud` credential file prevented Pi MCP server working

[finnvyrn]

How do you solve this?

[dwt]

Does allowing the sandbox to read the file help?

[finnvyrn]

The mcp servers are spawn as subprocesses of the agent process, which in turn is spawn by fence. Therefore, the mcp server and the agent have the same permission. Allowing read sovles the issue but that also allows the agent to read the file.

[dwt]

If you want the agent harness to spawn the MCP servers that will be unavoidable. I guess you could start the MCP servers as e.g. systemd user services and then allow the sandbox to talk to them over tcp or file sockets, that way you can remove the credentials from the agent harness sandbox. If you use something like inetd (or the systemd equivalent) their startup could still be automated. But this does mean a more complex setup.

To me this is one of the classic tradeoffs of security vs. convenience - if you want it as secure as possible (agent has no ability to get access to the credentials) then that means more complexity in your setup - or you give the agent access to the secrets and gain a simpler setup for less security. I would probably do the latter for now, and start thinking about how to change my setup to gain more security later.