Running MCP Servers at Scale: Sandboxed Tool Execution on Kubernetes

Abstract

Model Context Protocol (MCP) is becoming the standard for connecting LLMs to tools — but running MCP servers in production raises hard infrastructure questions: How do you isolate tool execution per user? How do you scale to thousands of concurrent sessions without cold-start penalty? How do you safely expose filesystem, shell, and network access to agents? This session presents a Kubernetes-native approach to MCP server infrastructure using warm sandbox pools. We show how SandboxSet pre-warms execution environments, SandboxClaim binds them to agent sessions in under 100ms, and checkpoint/restore preserves tool state across session boundaries. We cover threat isolation (per-sandbox namespaces + seccomp), dynamic volume injection for per-user data, and graceful session handoff when an MCP server needs upgrade. Attendees leave with reusable patterns for deploying MCP servers at production scale on Kubernetes — without rebuilding your infrastructure from scratch.