Isolate an npm server that needs a secret

Overview

Many MCP servers are npm packages that read an API key from an environment variable. If such a server started inside an agent's sandbox, the agent could read the key. If you bind the server isolated, the package runs outside the sandbox:

• SHIP pins the exact version and integrity of the package when you bind it, and builds it once.
• The server receives a stand-in value for each variable, never the real one.
• When the server calls a host that you allow, SHIP puts the real value in the request. It also removes the value from the response.
• SHIP blocks every other host.

This guide binds Sentry's server. The repository declares it as:

{
  "mcpServers": {
    "sentry": {
      "command": "npx",
      "args": ["-y", "@sentry/mcp-server@latest"],
      "env": { "SENTRY_ACCESS_TOKEN": "${SENTRY_ACCESS_TOKEN}", "SENTRY_HOST": "sentry.io" }
    }
  }
}

The ${SENTRY_ACCESS_TOKEN} reference is optional. When it is there, SHIP uses its name to pre-fill the form.

Bind it with its key and allowed host

ConsoleCLI

Select Bind on the sentry card. Choose Isolated runtime. Under the credential, choose Environment variables. Enter the value of the token. List the hosts that the server may send it to. For Sentry's cloud, this is sentry.io.

List exact hostnames. For a self-hosted Sentry, list its own host here. The SENTRY_HOST value in the file must match that host.

Wait for it to be prepared

The card reads Preparing while SHIP gets the package, verifies its integrity and builds it. This usually takes a few minutes, and the page checks the status again automatically. When the server is ready, approve its tools. Use the Tools dialog, or run ship mcp tools sentry --refresh and then --approve. The Reviewer gets only the read-only tools.

If the preparation fails, the card reads Preparing failed and gives the reason. To retry, save the binding again.

Know what can't run isolated

Only npm packages run in the isolated runtime. If you choose Isolated runtime for a Python server, a native binary or a script from the repository, SHIP refuses it and gives the reason. Some servers sign each request with the key and don't send the key itself, for example with AWS's SigV4. Such a server can't work isolated, because it has only the stand-in value, so its signatures never match. If a server needs no secret, run it in the sandbox. If it needs one, bind the vendor's hosted endpoint, as in Connect a hosted server.