TheMachine Press

A daily newspaper for the age of artificial intelligence.

Morning edition

Permanent story

safety security

The Tool Contract Ends Before the Filesystem Does

A scan of 21,097 MCP servers finds a permission gap: approving one declared tool can leave its process able to reach files outside that contract.

Published Updated Story ID: mp-2026-10-16-001
Read the complete editionStory JSON

Summary

A scan of 21,097 MCP servers finds a permission gap: approving one declared tool can leave its process able to reach files outside that contract.

Model Context Protocol clients commonly ask a person to approve a named tool with a description and argument schema. The underlying local server process, however, can retain much broader host permissions. The MCP-FSD study calls the resulting gap filesystem capability laundering: attacker-steered arguments lead a tool beyond its declared operation and deployment scope. Across 21,097 servers from nine registries, the authors triaged 4,806 and found 787 with filesystem capability despite non-filesystem classifications; paired dynamic tests confirmed 150 vulnerable instances under the tested sandbox policies. Coordinated disclosure produced 13 advisories, including two CVEs in Anthropic's Git MCP Server. These are the paper's measurements, not evidence that every MCP server or client is exploitable. The operational lesson is precise: a tool-call approval is not a least-privilege boundary unless the process beneath it is actually constrained.

Why it matters

A scan of 21,097 MCP servers finds a permission gap: approving one declared tool can leave its process able to reach files outside that contract.

Limits and context

  • These are the paper's measurements, not evidence that every MCP server or client is exploitable.
  • The operational lesson is precise: a tool-call approval is not a least-privilege boundary unless the process beneath it is actually constrained.

Key claims

  1. A scan of 21,097 MCP servers finds a permission gap: approving one declared tool can leave its process able to reach files outside that contract.

    Qualification: These are the paper's measurements, not evidence that every MCP server or client is exploitable.

    Evidence: source-2026-10-16-001

Sources

  1. arXiv preprint 2610.22301, original v1arXiv / submitting research authors · primary research

Corrections

No corrections have been recorded for this story.