{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-10-16-001",
    "source_story_id": "tmp-lead-mcp-capability-laundering",
    "edition_id": "mp-2026-10-16-morning-0098",
    "edition_url": "https://themachinepress.com/edition/2026-10-16",
    "position": 1,
    "story_type": "lead",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "The Tool Contract Ends Before the Filesystem Does",
    "slug": "the-tool-contract-ends-before-the-filesystem-does",
    "dek": "A scan of 21,097 MCP servers finds a permission gap: approving one declared tool can leave its process able to reach files outside that contract.",
    "summary": "A scan of 21,097 MCP servers finds a permission gap: approving one declared tool can leave its process able to reach files outside that contract.",
    "body_text": "Model Context Protocol clients commonly ask a person to approve a named tool with a description and argument schema. The underlying local server process, however, can retain much broader host permissions. The MCP-FSD study calls the resulting gap filesystem capability laundering: attacker-steered arguments lead a tool beyond its declared operation and deployment scope. Across 21,097 servers from nine registries, the authors triaged 4,806 and found 787 with filesystem capability despite non-filesystem classifications; paired dynamic tests confirmed 150 vulnerable instances under the tested sandbox policies. Coordinated disclosure produced 13 advisories, including two CVEs in Anthropic's Git MCP Server. These are the paper's measurements, not evidence that every MCP server or client is exploitable. The operational lesson is precise: a tool-call approval is not a least-privilege boundary unless the process beneath it is actually constrained.",
    "why_it_matters": "A scan of 21,097 MCP servers finds a permission gap: approving one declared tool can leave its process able to reach files outside that contract.",
    "limitations": [
      "These are the paper's measurements, not evidence that every MCP server or client is exploitable.",
      "The operational lesson is precise: a tool-call approval is not a least-privilege boundary unless the process beneath it is actually constrained."
    ],
    "importance": 10,
    "canonical_url": "https://themachinepress.com/story/mp-2026-10-16-001/the-tool-contract-ends-before-the-filesystem-does",
    "json_url": "https://themachinepress.com/story/mp-2026-10-16-001.json",
    "first_published_at": "2026-10-16T09:00:00.000-04:00",
    "modified_at": "2026-10-16T09:00:00.000-04:00",
    "content_status": "new",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-10-16-001-001",
        "text": "A scan of 21,097 MCP servers finds a permission gap: approving one declared tool can leave its process able to reach files outside that contract.",
        "source_ids": [
          "source-2026-10-16-001"
        ],
        "qualification": "These are the paper's measurements, not evidence that every MCP server or client is exploitable."
      }
    ],
    "source_ids": [
      "source-2026-10-16-001"
    ],
    "tags": [
      "MCP",
      "filesystem security",
      "least privilege",
      "agent tools"
    ],
    "image_url": "https://themachinepress.com/issues/2026-10-16/lead-capability-laundering.png",
    "corrections": []
  },
  "sources": [
    {
      "source_id": "source-2026-10-16-001",
      "title": "arXiv preprint 2610.22301, original v1",
      "publisher": "arXiv / submitting research authors",
      "url": "https://arxiv.org/abs/2610.22301v1",
      "canonical_url": "https://arxiv.org/abs/2610.22301v1",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": "2026-10-15T13:48:10.000-04:00",
      "accessed_at": "2026-10-16T08:26:36.400-04:00",
      "supports_claim_ids": [
        "claim-mp-2026-10-16-001-001"
      ]
    }
  ],
  "corrections": [],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "The Tool Contract Ends Before the Filesystem Does",
    "publisher": "The Machine Press",
    "published_at": "2026-10-16T09:00:00.000-04:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-10-16-001/the-tool-contract-ends-before-the-filesystem-does"
  }
}