Add MCP Server security and sandbox documentation #62

Scope

Document the three sandbox modes (read-only, filtered, unrestricted) with decision matrix:

• AST-based script validation
• Command allowlists/blocklists
• Obfuscation detection
• CLM auto-detection
• Confirmation-required commands
• Security recommendations per environment

Important: Clarify that sandbox/security modes only apply to remoting, not other SPE integration points (ISE, Console, etc.), and explain why these protections are needed for remoting specifically.

Cross-reference existing security/ pages and SitecorePowerShell/Console#1419 (CLM).

References

• SitecorePowerShell/mcp-server (Security/ directory)
• Add Constrained Language Mode and token scoping for MCP remoting sessions Console#1419

Files

• New mcp-server/security.md
• SUMMARY.md — Add under MCP Server