Throne Runs MCP Servers in Disposable MicroVMs for Zero-Trust Evaluation

Evaluating untrusted MCP servers has always been a leap of faith. Throne, a new open-source project, tackles this by booting the target server inside a disposable microVM, installing it from source, and observing its behavior before any agent ever touches it.

The approach addresses a fundamental gap in the MCP ecosystem: servers can contain malicious code that exfiltrates data or tampers with prompts. By running the server in an isolated, ephemeral environment, Throne captures syscall traces, network connections, and file system changes, providing a safety report to the developer.

Under the hood, Throne uses lightweight VM technology (like Firecracker or microVMs) to ensure strong isolation. The evaluation is fully automated—point it at a server’s repository, and it produces a structured report. This is particularly relevant for teams building agentic workflows who need to vet third-party MCP servers before integrating them.

While still early-stage, Throne represents a shift toward proactive security in the MCP ecosystem, drawing inspiration from supply-chain security tools for npm and PyPI. The project is available on GitHub.