Security Model

The security model of the Container Use MCP extension for Zed focuses on isolating AI coding agent activities within containerized environments. By delegating execution to the Model Context Protocol (MCP) server named cu, the extension ensures that potentially destructive or untrusted code generated by agents does not execute directly on the host machine's primary operating system.

The primary security boundary is established by the cu binary, which provides the containerized execution environment. The Zed extension acts as a bridge, configuring and launching this binary while managing its integration into the Zed editor workspace.

Sources: README.md:1-5, extension.toml:1-4, src/container_use_mcp.rs:1-10

Execution Isolation

The core security feature is the redirection of agent actions into a container. This is enforced through specific agent rules and the instantiation of the cu process.

Containerized Environment

Coding agents are restricted to containerized environments to prevent unauthorized access to the host file system or network. This is facilitated by the cu (Container Use) binary, which is executed as a child process of Zed using the stdio transport mechanism.

Sources: README.md:1-5, src/container_use_mcp.rs:77-81

Agent Rule Enforcement

To maintain the security boundary, the project requires the presence of an .rules file in the project root. This file contains instructions that guide AI agents to exclusively use the containerized environment provided by the MCP server.

mermaid
sequenceDiagram
participant Zed as Zed Editor
participant Ext as Extension (Rust)
participant Host as Host OS

Zed->>Ext: Request Context Server
Ext->>Host: exec: "which cu"
Host-->>Ext: Path to binary (e.g., /usr/local/bin/cu)
Ext->>Zed: Return Command(path, args=["stdio"])
Zed->>Host: Spawn cu process

Sources: [extension.toml:10-13](https://github.com/RemyLoveLogicAI/zed-container-use-mcp/blob/HEAD/extension.toml#L10-L13), [src/container_use_mcp.rs:32-35](https://github.com/RemyLoveLogicAI/zed-container-use-mcp/blob/HEAD/src/container_use_mcp.rs#L32-L35)

## Configuration and Settings Security

Settings are handled through the `ContextServerSettings` API, ensuring that configuration data is parsed safely using `serde`.

### Schema Validation
The extension defines a strict schema for its settings using the `JsonSchema` and `Deserialize` traits. This prevents injection of malformed data into the extension logic.

```rust
#[derive(Debug, Deserialize, JsonSchema)]
struct ContainerUseMcpSettings {
    /// Path to the cu binary (optional - will download if not provided)
    cu_path: Option<String>,
}

Sources: src/container_use_mcp.rs:11-15, Cargo.toml:10-13

Settings Access

Settings are retrieved on a per-project basis, ensuring that security configurations like the cu_path can be localized to specific project environments without affecting the global editor state if necessary.

Sources: src/container_use_mcp.rs:65-68

Summary

The security model of zed-container-use-mcp is built on the principle of least privilege for AI agents. By wrapping the cu tool, the extension ensures that all agent-initiated code execution is sandboxed. The extension itself maintains security by validating binary paths and using structured, schema-validated settings to control its behavior.

Sources: README.md:1-10, src/container_use_mcp.rs:24-30