Sandbox Code Auditor MCP

Python sandbox escape detection, SQL injection taint analysis, Seccomp BPF filter generation, and ReDoS regex scanning.

Part of the WHAM ENGINE fleet of deterministic AI agent micro-services with automated Base L2 HTTP 402 (x402) USDC micropayments.

Tools Included in this Suite (5 Tools)

• python_ast_sandbox_escape_detector: Audits Python ASTs for dangerous builtins, __subclasses__ gadget chains, importlib, and bytecode compilation tricks used in sandbox escapes.
• sql_ast_sqli_taint_analyzer: Parses SQL query ASTs to verify parameterized binding, flagging raw string concatenations that lead to second-order SQL injection vulnerabilities.
• regex_redos_exponential_scanner: Audits regular expressions for catastrophic polynomial and exponential backtracking (ReDoS) vulnerabilities using NFA/DFA cycle decomposition.
• linux_seccomp_bpf_filter_generator: Generates minimal Seccomp BPF syscall filter profiles for sandboxing untrusted agent processes, blocking ptrace, fork, and raw socket creation.
• cors_policy_preflight_misconfig_checker: Audits CORS response headers for dangerous wildcards with credentials (Access-Control-Allow-Origin: * + Credentials: true).

Recommended Workflow

An autonomous coding agent receives a script from an external PR -> analyzes the Python AST for sandbox escapes -> audits SQL queries for injection taint -> tests regexes for ReDoS -> outputs a Seccomp BPF filter to execute the code securely.

Quickstart Configuration

Add this server to your claude_desktop_config.json:

{
  "mcpServers": {
    "sandbox-code-auditor-mcp": {
      "command": "npx",
      "args": ["-y", "@whambammy/sandbox-code-auditor-mcp"],
      "env": {
        "PAYMENT_WALLET": "0x9793E7269b3301893318dEa8338576Ba612F39B3",
        "BASE_RPC_URL": "https://mainnet.base.org"
      }
    }
  }
}

Or connect the skill directly via Smithery:

smithery skill add whambammy/sandbox-code-auditor-mcp