# `vllm_mlx.mcp.security`

MCP security module for command validation and sandboxing.

[View the complete module source at #L1-L852](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L1-L852).

## API details

Each callable below includes its exact signature, type annotations, inputs, defaults, return contract, documented exceptions, implementation source, and parsed docstring sections when the source provides them.

::: vllm_mlx.mcp.security
    options:
      members:
        - logger
        - ALLOW_UNSAFE_ENV_VAR
        - ALLOWED_COMMANDS
        - DANGEROUS_PATTERNS
        - DANGEROUS_ARG_PATTERNS
        - BLOCKED_COMMAND_ARG_RULES
        - CONTROL_CHARS
        - MCPSecurityError
        - MCPCommandValidator
        - _validator
        - get_validator
        - set_validator
        - validate_mcp_server_config
        - DANGEROUS_TOOL_ARG_PATTERNS
        - HIGH_RISK_TOOL_PATTERNS
        - ToolExecutionAudit
        - ToolSandbox
        - _sandbox
        - get_sandbox
        - set_sandbox
      filters: []
      show_if_no_docstring: true

## Complete contract reference

Expand any definition for its exact inputs, annotations, defaults, return contract, directly raised exceptions, source-grounded behavior, and immutable line link. This section includes private and nested definitions that ordinary API generators omit.

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPSecurityError" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPSecurityError</code> · class</summary>

```python
vllm_mlx.mcp.security.MCPSecurityError()
```

Raised when MCP security validation fails.

**Parameters**

This callable has no explicit inputs.

**Returns**

- Constructs: `vllm_mlx.mcp.security.MCPSecurityError`

**Exceptions and behavior**

Class `MCPSecurityError` derives from `Exception` and declares 0 direct member(s).
No direct `raise` statement appears in this definition.

[View source #L106-L109](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L106-L109).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator</code> · class</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator(allowed_commands: Optional[Set[str]] = None, allow_unsafe: bool = False, custom_whitelist: Optional[Set[str]] = None, check_path_exists: bool = True)
```

Validates MCP server commands for security.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `allowed_commands` | `Optional[Set[str]]` | `no` | `None` | Set of allowed command names. If None, uses default whitelist. |
| `allow_unsafe` | `bool` | `no` | `False` | If True, allows any command (for development only). |
| `custom_whitelist` | `Optional[Set[str]]` | `no` | `None` | Additional commands to allow beyond the default whitelist. |
| `check_path_exists` | `bool` | `no` | `True` | If True, verify command exists in PATH. Set to False for testing. |

**Returns**

- Constructs: `vllm_mlx.mcp.security.MCPCommandValidator`

**Exceptions and behavior**

Class `MCPCommandValidator` declares 8 direct member(s).
No direct `raise` statement appears in this definition.

[View source #L112-L427](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L112-L427).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator.__init__" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator.__init__</code> · method</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator.__init__(allowed_commands: Optional[Set[str]] = None, allow_unsafe: bool = False, custom_whitelist: Optional[Set[str]] = None, check_path_exists: bool = True) -> not annotated
```

Initialize the command validator.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `allowed_commands` | `Optional[Set[str]]` | `no` | `None` | Set of allowed command names. If None, uses default whitelist. |
| `allow_unsafe` | `bool` | `no` | `False` | If True, allows any command (for development only). |
| `custom_whitelist` | `Optional[Set[str]]` | `no` | `None` | Additional commands to allow beyond the default whitelist. |
| `check_path_exists` | `bool` | `no` | `True` | If True, verify command exists in PATH. Set to False for testing. |

**Returns**

- Type: `not annotated`

**Exceptions and behavior**

Method `MCPCommandValidator.__init__` updates `self.allow_unsafe`, `self.allowed_commands`, `self.check_path_exists`; calls `ALLOWED_COMMANDS.copy`, `self.allowed_commands.update`, `logger.warning`.
No direct `raise` statement appears in this definition.

[View source #L120-L149](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L120-L149).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator._check_control_chars" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator._check_control_chars</code> · method</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator._check_control_chars(value: str, context: str, server_name: str) -> None
```

Block command separators carried via literal newlines.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `value` | `str` | `yes` | `none` | Required positional or keyword input. |
| `context` | `str` | `yes` | `none` | Required positional or keyword input. |
| `server_name` | `str` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `None`

**Exceptions and behavior**

Method `MCPCommandValidator._check_control_chars` calls `any`, `MCPSecurityError`; can raise `MCPSecurityError`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L151-L157](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L151-L157).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator._check_path_traversal" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator._check_path_traversal</code> · method</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator._check_path_traversal(value: str, context: str, server_name: str) -> None
```

Block parent-directory traversal, including URL-encoded forms.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `value` | `str` | `yes` | `none` | Required positional or keyword input. |
| `context` | `str` | `yes` | `none` | Required positional or keyword input. |
| `server_name` | `str` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `None`

**Exceptions and behavior**

Method `MCPCommandValidator._check_path_traversal` calls `unquote`, `candidates.append`, `value.lower`, `posixpath.normpath`; can raise `MCPSecurityError`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L159-L194](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L159-L194).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_command" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator.validate_command</code> · method</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator.validate_command(command: str, server_name: str) -> None
```

Validate that a command is safe to execute.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `command` | `str` | `yes` | `none` | The command to validate |
| `server_name` | `str` | `yes` | `none` | Name of the MCP server (for logging) |

**Returns**

- Type: `None`
- Direct return expressions: `None`

**Exceptions and behavior**

Method `MCPCommandValidator.validate_command` calls `logger.warning`, `self._check_control_chars`, `self._check_path_traversal`, `pattern.search`; can raise `MCPSecurityError`; returns `None`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L196-L258](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L196-L258).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_args" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator.validate_args</code> · method</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator.validate_args(args: List[str], server_name: str) -> None
```

Validate command arguments for dangerous patterns.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `args` | `List[str]` | `yes` | `none` | List of command arguments |
| `server_name` | `str` | `yes` | `none` | Name of the MCP server (for logging) |

**Returns**

- Type: `None`
- Direct return expressions: `None`

**Exceptions and behavior**

Method `MCPCommandValidator.validate_args` calls `enumerate`, `self._check_control_chars`, `self._check_path_traversal`, `pattern.search`; can raise `MCPSecurityError`; returns `None`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L260-L286](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L260-L286).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_command_args" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator.validate_command_args</code> · method</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator.validate_command_args(command: str, args: List[str], server_name: str) -> None
```

Validate command-specific argument combinations.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `command` | `str` | `yes` | `none` | Required positional or keyword input. |
| `args` | `List[str]` | `yes` | `none` | Required positional or keyword input. |
| `server_name` | `str` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `None`
- Direct return expressions: `None`

**Exceptions and behavior**

Method `MCPCommandValidator.validate_command_args` calls `Path`, `BLOCKED_COMMAND_ARG_RULES.get`, `enumerate`, `MCPSecurityError`; can raise `MCPSecurityError`; returns `None`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L288-L330](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L288-L330).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_env" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator.validate_env</code> · method</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator.validate_env(env: Optional[Dict[str, str]], server_name: str) -> None
```

Validate environment variables for dangerous values.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `env` | `Optional[Dict[str, str]]` | `yes` | `none` | Dictionary of environment variables |
| `server_name` | `str` | `yes` | `none` | Name of the MCP server (for logging) |

**Returns**

- Type: `None`
- Direct return expressions: `None`

**Exceptions and behavior**

Method `MCPCommandValidator.validate_env` calls `env.items`, `self._check_control_chars`, `self._check_path_traversal`, `key.upper`; can raise `MCPSecurityError`; returns `None`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L332-L383](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L332-L383).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_url" markdown="1">
<summary><code>vllm_mlx.mcp.security.MCPCommandValidator.validate_url</code> · method</summary>

```python
vllm_mlx.mcp.security.MCPCommandValidator.validate_url(url: str, server_name: str) -> None
```

Validate SSE URL for security.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `url` | `str` | `yes` | `none` | The SSE URL to validate |
| `server_name` | `str` | `yes` | `none` | Name of the MCP server (for logging) |

**Returns**

- Type: `None`
- Direct return expressions: `None`

**Exceptions and behavior**

Method `MCPCommandValidator.validate_url` calls `self._check_control_chars`, `url.startswith`, `MCPSecurityError`, `logger.warning`; can raise `MCPSecurityError`; returns `None`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L385-L427](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L385-L427).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.get_validator" markdown="1">
<summary><code>vllm_mlx.mcp.security.get_validator</code> · function</summary>

```python
vllm_mlx.mcp.security.get_validator() -> MCPCommandValidator
```

Get the global command validator instance.

**Parameters**

This callable has no explicit inputs.

**Returns**

- Type: `MCPCommandValidator`
- Direct return expressions: `_validator`

**Exceptions and behavior**

Function `get_validator` calls `MCPCommandValidator`, `os.environ.get`; returns `_validator`.
No direct `raise` statement appears in this definition.

[View source #L434-L441](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L434-L441).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.set_validator" markdown="1">
<summary><code>vllm_mlx.mcp.security.set_validator</code> · function</summary>

```python
vllm_mlx.mcp.security.set_validator(validator: MCPCommandValidator) -> None
```

Set a custom global validator.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `validator` | `MCPCommandValidator` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `None`

**Exceptions and behavior**

Function `set_validator` contains no state mutation, call, raise, return, await, or yield.
No direct `raise` statement appears in this definition.

[View source #L444-L447](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L444-L447).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.validate_mcp_server_config" markdown="1">
<summary><code>vllm_mlx.mcp.security.validate_mcp_server_config</code> · function</summary>

```python
vllm_mlx.mcp.security.validate_mcp_server_config(server_name: str, command: Optional[str] = None, args: Optional[List[str]] = None, env: Optional[Dict[str, str]] = None, url: Optional[str] = None) -> None
```

Validate MCP server configuration for security.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `server_name` | `str` | `yes` | `none` | Name of the MCP server |
| `command` | `Optional[str]` | `no` | `None` | Command to execute (for stdio transport) |
| `args` | `Optional[List[str]]` | `no` | `None` | Command arguments |
| `env` | `Optional[Dict[str, str]]` | `no` | `None` | Environment variables |
| `url` | `Optional[str]` | `no` | `None` | SSE URL (for sse transport) |

**Returns**

- Type: `None`

**Exceptions and behavior**

Function `validate_mcp_server_config` calls `get_validator`, `validator.validate_command`, `validator.validate_args`, `validator.validate_command_args`.
No direct `raise` statement appears in this definition.

[View source #L450-L486](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L450-L486).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolExecutionAudit" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolExecutionAudit</code> · class</summary>

```python
vllm_mlx.mcp.security.ToolExecutionAudit(timestamp: float, tool_name: str, server_name: str, arguments: Dict[str, Any], success: bool, error_message: Optional[str] = None, execution_time_ms: Optional[float] = None)
```

Record of a tool execution for audit purposes.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `timestamp` | `float` | `yes` | `none` | Required constructor field. |
| `tool_name` | `str` | `yes` | `none` | Required constructor field. |
| `server_name` | `str` | `yes` | `none` | Required constructor field. |
| `arguments` | `Dict[str, Any]` | `yes` | `none` | Required constructor field. |
| `success` | `bool` | `yes` | `none` | Required constructor field. |
| `error_message` | `Optional[str]` | `no` | `None` | Optional constructor field; defaults to `None`. |
| `execution_time_ms` | `Optional[float]` | `no` | `None` | Optional constructor field; defaults to `None`. |

**Returns**

- Constructs: `vllm_mlx.mcp.security.ToolExecutionAudit`

**Exceptions and behavior**

Class `ToolExecutionAudit` declares 0 direct member(s).
No direct `raise` statement appears in this definition.

[View source #L516-L525](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L516-L525).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox</code> · class</summary>

```python
vllm_mlx.mcp.security.ToolSandbox(allowed_tools: Optional[Set[str]] = None, blocked_tools: Optional[Set[str]] = None, allowed_high_risk_tools: Optional[Set[str]] = None, blocked_arg_patterns: Optional[List[re.Pattern]] = None, max_calls_per_minute: int = 60, audit_callback: Optional[Callable[[ToolExecutionAudit], None]] = None, enabled: bool = True)
```

Sandboxing controls for MCP tool execution.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `allowed_tools` | `Optional[Set[str]]` | `no` | `None` | If set, only these tools can be executed (whitelist mode). |
| `blocked_tools` | `Optional[Set[str]]` | `no` | `None` | Tools that are always blocked (blacklist mode). |
| `allowed_high_risk_tools` | `Optional[Set[str]]` | `no` | `None` | High-risk tools that are explicitly allowed. |
| `blocked_arg_patterns` | `Optional[List[re.Pattern]]` | `no` | `None` | Patterns to block in tool arguments. |
| `max_calls_per_minute` | `int` | `no` | `60` | Rate limit for tool calls (0 = unlimited). |
| `audit_callback` | `Optional[Callable[[ToolExecutionAudit], None]]` | `no` | `None` | Optional callback for audit events. |
| `enabled` | `bool` | `no` | `True` | If False, sandbox checks are bypassed (dev mode only). |

**Returns**

- Constructs: `vllm_mlx.mcp.security.ToolSandbox`

**Exceptions and behavior**

Class `ToolSandbox` declares 10 direct member(s).
No direct `raise` statement appears in this definition.

[View source #L528-L834](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L528-L834).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox.__init__" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox.__init__</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox.__init__(allowed_tools: Optional[Set[str]] = None, blocked_tools: Optional[Set[str]] = None, allowed_high_risk_tools: Optional[Set[str]] = None, blocked_arg_patterns: Optional[List[re.Pattern]] = None, max_calls_per_minute: int = 60, audit_callback: Optional[Callable[[ToolExecutionAudit], None]] = None, enabled: bool = True) -> not annotated
```

Initialize tool sandbox.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `allowed_tools` | `Optional[Set[str]]` | `no` | `None` | If set, only these tools can be executed (whitelist mode). |
| `blocked_tools` | `Optional[Set[str]]` | `no` | `None` | Tools that are always blocked (blacklist mode). |
| `allowed_high_risk_tools` | `Optional[Set[str]]` | `no` | `None` | High-risk tools that are explicitly allowed. |
| `blocked_arg_patterns` | `Optional[List[re.Pattern]]` | `no` | `None` | Patterns to block in tool arguments. |
| `max_calls_per_minute` | `int` | `no` | `60` | Rate limit for tool calls (0 = unlimited). |
| `audit_callback` | `Optional[Callable[[ToolExecutionAudit], None]]` | `no` | `None` | Optional callback for audit events. |
| `enabled` | `bool` | `no` | `True` | If False, sandbox checks are bypassed (dev mode only). |

**Returns**

- Type: `not annotated`

**Exceptions and behavior**

Method `ToolSandbox.__init__` updates `self.allowed_tools`, `self.blocked_tools`, `self.allowed_high_risk_tools`, `self.blocked_arg_patterns`; calls `set`, `tool.lower`, `DANGEROUS_TOOL_ARG_PATTERNS.copy`, `defaultdict`.
No direct `raise` statement appears in this definition.

[View source #L539-L586](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L539-L586).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox.validate_tool_execution" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox.validate_tool_execution</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox.validate_tool_execution(tool_name: str, server_name: str, arguments: Dict[str, Any]) -> None
```

Validate that a tool execution is allowed.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `tool_name` | `str` | `yes` | `none` | Name of the tool to execute |
| `server_name` | `str` | `yes` | `none` | MCP server providing the tool |
| `arguments` | `Dict[str, Any]` | `yes` | `none` | Tool arguments |

**Returns**

- Type: `None`
- Direct return expressions: `None`

**Exceptions and behavior**

Method `ToolSandbox.validate_tool_execution` calls `logger.debug`, `self._is_blocked`, `MCPSecurityError`, `self._check_high_risk_tool`; can raise `MCPSecurityError`; returns `None`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L588-L634](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L588-L634).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox._is_blocked" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox._is_blocked</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox._is_blocked(tool_name: str, full_name: str) -> bool
```

Check if tool is in blocklist.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `tool_name` | `str` | `yes` | `none` | Required positional or keyword input. |
| `full_name` | `str` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `bool`
- Direct return expressions: `tool_name in self.blocked_tools or full_name in self.blocked_tools or tool_name.lower() in self.blocked_tools`

**Exceptions and behavior**

Method `ToolSandbox._is_blocked` calls `tool_name.lower`; returns `tool_name in self.blocked_tools or full_name in self.blocked_tools or tool_name.lower() in self.blocked_tools`.
No direct `raise` statement appears in this definition.

[View source #L636-L642](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L636-L642).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox._check_high_risk_tool" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox._check_high_risk_tool</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox._check_high_risk_tool(tool_name: str, full_name: str) -> None
```

Check if tool matches high-risk patterns.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `tool_name` | `str` | `yes` | `none` | Required positional or keyword input. |
| `full_name` | `str` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `None`
- Direct return expressions: `None`

**Exceptions and behavior**

Method `ToolSandbox._check_high_risk_tool` calls `tool_name.lower`, `full_name.lower`, `logger.warning`, `MCPSecurityError`; can raise `MCPSecurityError`; returns `None`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L644-L663](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L644-L663).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox._validate_arguments" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox._validate_arguments</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox._validate_arguments(tool_name: str, arguments: Dict[str, Any]) -> None
```

Validate tool arguments for dangerous patterns.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `tool_name` | `str` | `yes` | `none` | Required positional or keyword input. |
| `arguments` | `Dict[str, Any]` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `None`

**Exceptions and behavior**

Method `ToolSandbox._validate_arguments` calls `arguments.items`, `check_value`.
No direct `raise` statement appears in this definition.

[View source #L665-L686](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L665-L686).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox._validate_arguments.check_value" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox._validate_arguments.check_value</code> · nested function</summary>

```python
vllm_mlx.mcp.security.ToolSandbox._validate_arguments.check_value(key: str, value: Any, path: str = '') -> None
```

Nested Function `ToolSandbox._validate_arguments.check_value` calls `isinstance`, `pattern.search`, `MCPSecurityError`, `value.items`; can raise `MCPSecurityError`.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `key` | `str` | `yes` | `none` | Required positional or keyword input. |
| `value` | `Any` | `yes` | `none` | Required positional or keyword input. |
| `path` | `str` | `no` | `''` | Optional positional or keyword input; defaults to `''`. |

**Returns**

- Type: `None`

**Exceptions and behavior**

Nested Function `ToolSandbox._validate_arguments.check_value` calls `isinstance`, `pattern.search`, `MCPSecurityError`, `value.items`; can raise `MCPSecurityError`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L668-L683](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L668-L683).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox._check_rate_limit" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox._check_rate_limit</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox._check_rate_limit(full_name: str) -> None
```

Check and enforce rate limit for tool calls.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `full_name` | `str` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `None`
- Direct return expressions: `None`

**Exceptions and behavior**

Method `ToolSandbox._check_rate_limit` calls `time.time`, `len`, `MCPSecurityError`, `self._call_times[full_name].append`; can raise `MCPSecurityError`; returns `None`.
Directly raised exceptions: `MCPSecurityError`.

[View source #L688-L710](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L688-L710).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox.record_execution" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox.record_execution</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox.record_execution(tool_name: str, server_name: str, arguments: Dict[str, Any], success: bool, error_message: Optional[str] = None, execution_time_ms: Optional[float] = None) -> ToolExecutionAudit
```

Record a tool execution for audit purposes.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `tool_name` | `str` | `yes` | `none` | Name of the executed tool |
| `server_name` | `str` | `yes` | `none` | MCP server that executed the tool |
| `arguments` | `Dict[str, Any]` | `yes` | `none` | Arguments passed to the tool |
| `success` | `bool` | `yes` | `none` | Whether execution succeeded |
| `error_message` | `Optional[str]` | `no` | `None` | Error message if failed |
| `execution_time_ms` | `Optional[float]` | `no` | `None` | Execution time in milliseconds |

**Returns**

- Type: `ToolExecutionAudit`
- Direct return expressions: `audit`

**Exceptions and behavior**

Method `ToolSandbox.record_execution` updates `self._audit_log`; calls `ToolExecutionAudit`, `time.time`, `self._sanitize_arguments_for_log`, `self._audit_log.append`; returns `audit`.
No direct `raise` statement appears in this definition.

[View source #L712-L772](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L712-L772).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox._sanitize_arguments_for_log" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox._sanitize_arguments_for_log</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox._sanitize_arguments_for_log(arguments: Dict[str, Any]) -> Dict[str, Any]
```

Sanitize arguments for logging (redact sensitive data).

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `arguments` | `Dict[str, Any]` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `Dict[str, Any]`
- Direct return expressions: `sanitize(arguments)`

**Exceptions and behavior**

Method `ToolSandbox._sanitize_arguments_for_log` calls `sanitize`; returns `sanitize(arguments)`.
No direct `raise` statement appears in this definition.

[View source #L774-L794](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L774-L794).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox._sanitize_arguments_for_log.sanitize" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox._sanitize_arguments_for_log.sanitize</code> · nested function</summary>

```python
vllm_mlx.mcp.security.ToolSandbox._sanitize_arguments_for_log.sanitize(obj: Any) -> Any
```

Nested Function `ToolSandbox._sanitize_arguments_for_log.sanitize` calls `isinstance`, `any`, `k.lower`, `sanitize`; has 4 explicit return paths.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `obj` | `Any` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `Any`
- Direct return expressions: `{k: '[REDACTED]' if any((s in k.lower() for s in sensitive_keys)) else sanitize(v) for k, v in obj.items()}`; `[sanitize(item) for item in obj]`; `obj[:100] + f'... [truncated, {len(obj)} chars total]'`; `obj`

**Exceptions and behavior**

Nested Function `ToolSandbox._sanitize_arguments_for_log.sanitize` calls `isinstance`, `any`, `k.lower`, `sanitize`; has 4 explicit return paths.
No direct `raise` statement appears in this definition.

[View source #L778-L792](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L778-L792).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox.get_audit_log" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox.get_audit_log</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox.get_audit_log(limit: int = 100, tool_filter: Optional[str] = None, server_filter: Optional[str] = None, errors_only: bool = False) -> List[ToolExecutionAudit]
```

Get audit log entries.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `limit` | `int` | `no` | `100` | Maximum entries to return |
| `tool_filter` | `Optional[str]` | `no` | `None` | Filter by tool name (substring match) |
| `server_filter` | `Optional[str]` | `no` | `None` | Filter by server name |
| `errors_only` | `bool` | `no` | `False` | Only return failed executions |

**Returns**

- Type: `List[ToolExecutionAudit]`
- Direct return expressions: `entries[-limit:]`

**Exceptions and behavior**

Method `ToolSandbox.get_audit_log` calls `self._audit_log.copy`; returns `entries[-limit:]`.
No direct `raise` statement appears in this definition.

[View source #L796-L827](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L796-L827).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.ToolSandbox.clear_audit_log" markdown="1">
<summary><code>vllm_mlx.mcp.security.ToolSandbox.clear_audit_log</code> · method</summary>

```python
vllm_mlx.mcp.security.ToolSandbox.clear_audit_log() -> int
```

Clear audit log and return number of entries cleared.

**Parameters**

This callable has no explicit inputs.

**Returns**

- Type: `int`
- Direct return expressions: `count`

**Exceptions and behavior**

Method `ToolSandbox.clear_audit_log` calls `len`, `self._audit_log.clear`; returns `count`.
No direct `raise` statement appears in this definition.

[View source #L829-L834](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L829-L834).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.get_sandbox" markdown="1">
<summary><code>vllm_mlx.mcp.security.get_sandbox</code> · function</summary>

```python
vllm_mlx.mcp.security.get_sandbox() -> ToolSandbox
```

Get the global tool sandbox instance.

**Parameters**

This callable has no explicit inputs.

**Returns**

- Type: `ToolSandbox`
- Direct return expressions: `_sandbox`

**Exceptions and behavior**

Function `get_sandbox` calls `ToolSandbox`; returns `_sandbox`.
No direct `raise` statement appears in this definition.

[View source #L841-L846](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L841-L846).

</details>

<details class="api-contract" id="contract-vllm_mlx.mcp.security.set_sandbox" markdown="1">
<summary><code>vllm_mlx.mcp.security.set_sandbox</code> · function</summary>

```python
vllm_mlx.mcp.security.set_sandbox(sandbox: ToolSandbox) -> None
```

Set a custom global sandbox.

**Parameters**

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `sandbox` | `ToolSandbox` | `yes` | `none` | Required positional or keyword input. |

**Returns**

- Type: `None`

**Exceptions and behavior**

Function `set_sandbox` contains no state mutation, call, raise, return, await, or yield.
No direct `raise` statement appears in this definition.

[View source #L849-L852](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L849-L852).

</details>

## Complete symbol map

This map also includes private definitions and nested helpers. The signature column exposes every explicit input even when an internal helper has no dedicated parameter prose.

| Symbol | Kind | Signature and inputs | What it does | Source |
| --- | --- | --- | --- | --- |
| [`MCPSecurityError`](#contract-vllm_mlx.mcp.security.MCPSecurityError) | class | `MCPSecurityError()` | Raised when MCP security validation fails. | [#L106-L109](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L106-L109) |
| [`MCPCommandValidator`](#contract-vllm_mlx.mcp.security.MCPCommandValidator) | class | `MCPCommandValidator(allowed_commands: Optional[Set[str]] = None, allow_unsafe: bool = False, custom_whitelist: Optional[Set[str]] = None, check_path_exists: bool = True)` | Validates MCP server commands for security. | [#L112-L427](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L112-L427) |
| [`MCPCommandValidator.__init__`](#contract-vllm_mlx.mcp.security.MCPCommandValidator.__init__) | method | `MCPCommandValidator.__init__(allowed_commands: Optional[Set[str]] = None, allow_unsafe: bool = False, custom_whitelist: Optional[Set[str]] = None, check_path_exists: bool = True) -> not annotated` | Initialize the command validator. | [#L120-L149](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L120-L149) |
| [`MCPCommandValidator._check_control_chars`](#contract-vllm_mlx.mcp.security.MCPCommandValidator._check_control_chars) | method | `MCPCommandValidator._check_control_chars(value: str, context: str, server_name: str) -> None` | Block command separators carried via literal newlines. | [#L151-L157](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L151-L157) |
| [`MCPCommandValidator._check_path_traversal`](#contract-vllm_mlx.mcp.security.MCPCommandValidator._check_path_traversal) | method | `MCPCommandValidator._check_path_traversal(value: str, context: str, server_name: str) -> None` | Block parent-directory traversal, including URL-encoded forms. | [#L159-L194](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L159-L194) |
| [`MCPCommandValidator.validate_command`](#contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_command) | method | `MCPCommandValidator.validate_command(command: str, server_name: str) -> None` | Validate that a command is safe to execute. | [#L196-L258](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L196-L258) |
| [`MCPCommandValidator.validate_args`](#contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_args) | method | `MCPCommandValidator.validate_args(args: List[str], server_name: str) -> None` | Validate command arguments for dangerous patterns. | [#L260-L286](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L260-L286) |
| [`MCPCommandValidator.validate_command_args`](#contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_command_args) | method | `MCPCommandValidator.validate_command_args(command: str, args: List[str], server_name: str) -> None` | Validate command-specific argument combinations. | [#L288-L330](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L288-L330) |
| [`MCPCommandValidator.validate_env`](#contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_env) | method | `MCPCommandValidator.validate_env(env: Optional[Dict[str, str]], server_name: str) -> None` | Validate environment variables for dangerous values. | [#L332-L383](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L332-L383) |
| [`MCPCommandValidator.validate_url`](#contract-vllm_mlx.mcp.security.MCPCommandValidator.validate_url) | method | `MCPCommandValidator.validate_url(url: str, server_name: str) -> None` | Validate SSE URL for security. | [#L385-L427](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L385-L427) |
| [`get_validator`](#contract-vllm_mlx.mcp.security.get_validator) | function | `get_validator() -> MCPCommandValidator` | Get the global command validator instance. | [#L434-L441](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L434-L441) |
| [`set_validator`](#contract-vllm_mlx.mcp.security.set_validator) | function | `set_validator(validator: MCPCommandValidator) -> None` | Set a custom global validator. | [#L444-L447](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L444-L447) |
| [`validate_mcp_server_config`](#contract-vllm_mlx.mcp.security.validate_mcp_server_config) | function | `validate_mcp_server_config(server_name: str, command: Optional[str] = None, args: Optional[List[str]] = None, env: Optional[Dict[str, str]] = None, url: Optional[str] = None) -> None` | Validate MCP server configuration for security. | [#L450-L486](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L450-L486) |
| [`ToolExecutionAudit`](#contract-vllm_mlx.mcp.security.ToolExecutionAudit) | class | `ToolExecutionAudit(timestamp: float, tool_name: str, server_name: str, arguments: Dict[str, Any], success: bool, error_message: Optional[str] = None, execution_time_ms: Optional[float] = None)` | Record of a tool execution for audit purposes. | [#L516-L525](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L516-L525) |
| [`ToolSandbox`](#contract-vllm_mlx.mcp.security.ToolSandbox) | class | `ToolSandbox(allowed_tools: Optional[Set[str]] = None, blocked_tools: Optional[Set[str]] = None, allowed_high_risk_tools: Optional[Set[str]] = None, blocked_arg_patterns: Optional[List[re.Pattern]] = None, max_calls_per_minute: int = 60, audit_callback: Optional[Callable[[ToolExecutionAudit], None]] = None, enabled: bool = True)` | Sandboxing controls for MCP tool execution. | [#L528-L834](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L528-L834) |
| [`ToolSandbox.__init__`](#contract-vllm_mlx.mcp.security.ToolSandbox.__init__) | method | `ToolSandbox.__init__(allowed_tools: Optional[Set[str]] = None, blocked_tools: Optional[Set[str]] = None, allowed_high_risk_tools: Optional[Set[str]] = None, blocked_arg_patterns: Optional[List[re.Pattern]] = None, max_calls_per_minute: int = 60, audit_callback: Optional[Callable[[ToolExecutionAudit], None]] = None, enabled: bool = True) -> not annotated` | Initialize tool sandbox. | [#L539-L586](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L539-L586) |
| [`ToolSandbox.validate_tool_execution`](#contract-vllm_mlx.mcp.security.ToolSandbox.validate_tool_execution) | method | `ToolSandbox.validate_tool_execution(tool_name: str, server_name: str, arguments: Dict[str, Any]) -> None` | Validate that a tool execution is allowed. | [#L588-L634](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L588-L634) |
| [`ToolSandbox._is_blocked`](#contract-vllm_mlx.mcp.security.ToolSandbox._is_blocked) | method | `ToolSandbox._is_blocked(tool_name: str, full_name: str) -> bool` | Check if tool is in blocklist. | [#L636-L642](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L636-L642) |
| [`ToolSandbox._check_high_risk_tool`](#contract-vllm_mlx.mcp.security.ToolSandbox._check_high_risk_tool) | method | `ToolSandbox._check_high_risk_tool(tool_name: str, full_name: str) -> None` | Check if tool matches high-risk patterns. | [#L644-L663](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L644-L663) |
| [`ToolSandbox._validate_arguments`](#contract-vllm_mlx.mcp.security.ToolSandbox._validate_arguments) | method | `ToolSandbox._validate_arguments(tool_name: str, arguments: Dict[str, Any]) -> None` | Validate tool arguments for dangerous patterns. | [#L665-L686](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L665-L686) |
| [`ToolSandbox._validate_arguments.check_value`](#contract-vllm_mlx.mcp.security.ToolSandbox._validate_arguments.check_value) | nested function | `ToolSandbox._validate_arguments.check_value(key: str, value: Any, path: str = '') -> None` | Nested Function `ToolSandbox._validate_arguments.check_value` calls `isinstance`, `pattern.search`, `MCPSecurityError`, `value.items`; can raise `MCPSecurityError`. | [#L668-L683](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L668-L683) |
| [`ToolSandbox._check_rate_limit`](#contract-vllm_mlx.mcp.security.ToolSandbox._check_rate_limit) | method | `ToolSandbox._check_rate_limit(full_name: str) -> None` | Check and enforce rate limit for tool calls. | [#L688-L710](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L688-L710) |
| [`ToolSandbox.record_execution`](#contract-vllm_mlx.mcp.security.ToolSandbox.record_execution) | method | `ToolSandbox.record_execution(tool_name: str, server_name: str, arguments: Dict[str, Any], success: bool, error_message: Optional[str] = None, execution_time_ms: Optional[float] = None) -> ToolExecutionAudit` | Record a tool execution for audit purposes. | [#L712-L772](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L712-L772) |
| [`ToolSandbox._sanitize_arguments_for_log`](#contract-vllm_mlx.mcp.security.ToolSandbox._sanitize_arguments_for_log) | method | `ToolSandbox._sanitize_arguments_for_log(arguments: Dict[str, Any]) -> Dict[str, Any]` | Sanitize arguments for logging (redact sensitive data). | [#L774-L794](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L774-L794) |
| [`ToolSandbox._sanitize_arguments_for_log.sanitize`](#contract-vllm_mlx.mcp.security.ToolSandbox._sanitize_arguments_for_log.sanitize) | nested function | `ToolSandbox._sanitize_arguments_for_log.sanitize(obj: Any) -> Any` | Nested Function `ToolSandbox._sanitize_arguments_for_log.sanitize` calls `isinstance`, `any`, `k.lower`, `sanitize`; has 4 explicit return paths. | [#L778-L792](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L778-L792) |
| [`ToolSandbox.get_audit_log`](#contract-vllm_mlx.mcp.security.ToolSandbox.get_audit_log) | method | `ToolSandbox.get_audit_log(limit: int = 100, tool_filter: Optional[str] = None, server_filter: Optional[str] = None, errors_only: bool = False) -> List[ToolExecutionAudit]` | Get audit log entries. | [#L796-L827](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L796-L827) |
| [`ToolSandbox.clear_audit_log`](#contract-vllm_mlx.mcp.security.ToolSandbox.clear_audit_log) | method | `ToolSandbox.clear_audit_log() -> int` | Clear audit log and return number of entries cleared. | [#L829-L834](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L829-L834) |
| [`get_sandbox`](#contract-vllm_mlx.mcp.security.get_sandbox) | function | `get_sandbox() -> ToolSandbox` | Get the global tool sandbox instance. | [#L841-L846](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L841-L846) |
| [`set_sandbox`](#contract-vllm_mlx.mcp.security.set_sandbox) | function | `set_sandbox(sandbox: ToolSandbox) -> None` | Set a custom global sandbox. | [#L849-L852](https://github.com/waybarrios/vllm-mlx/blob/a69d47912bcb21d8fe04d48f75fa896b620ffcfa/vllm_mlx/mcp/security.py#L849-L852) |