MCP security risk

[SunAndClouds]

Tried to set up the codex mcp, but realized that there is nothing that prevents the agent from spawning a codex instance that can operate on other directories than the current one, while also being able to disable the sandbox. This is typically only possible if the human user explicitly modifies the settings, but with agents running codex mcp, this could silently get bypassed.

What are some strategies that could be implemented to enforce a defensive default?