My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
Researchers find filesystem capability laundering in MCP servers, including two CVEs in Anthropic's Git server.
The Model Context Protocol lets AI agents call external tools, but local approval often gives the server process broad host filesystem permissions rather than only the declared operation. The authors study filesystem capability laundering, where attacker-steered arguments make a tool read sensitive host files outside its contract. MCP-FSD cataloged 21,097 servers from nine registries; 787 of 4,806 triaged servers (16.4%) had filesystem capabilities despite non-filesystem labels, and dynamic tests confirmed 150 vulnerable instances. Coordinated disclosure produced 13 advisories, including two CVEs in Anthropic's Git MCP Server.
- Approved local MCP calls can inherit broad host filesystem rights.
- 787 of 4,806 triaged servers had unexpected filesystem capabilities.
- Dynamic tests confirmed 150 vulnerable instances under sandbox policies.
- Disclosure included two CVEs in Anthropic's Git MCP Server.
Full article175 words · extracted from arxiv.org · click to collapse
The Model Context Protocol (MCP) standardizes how AI agents invoke external tools. MCP servers expose tools through a declared contract consisting of a name, description, and argument schema. In typical local deployments, client-side approval of a tool call grants the underlying server process broad host filesystem permissions rather than restricting it to the declared operation. We study the resulting vulnerability class, filesystem capability laundering, where attacker-steered arguments cause a tool to access sensitive host files outside its declared contract and deployment scope. We analyze this capability gap across three layers: server-category screening (L1), per-tool contract analysis (L2), and bypassable path-validation checks (L3). We design MCP-FSD to catalog MCP servers, infer least-privilege boundaries per tool, plant credential fixtures outside those boundaries, and evaluate exploitability and sandbox containment via paired dynamic execution. Across 21,097 MCP servers from nine registries, 787 of 4,806 triaged servers (16.4%) exhibit filesystem capabilities despite non-filesystem functional classifications. Dynamic three-case validation confirms 150 vulnerable instances under tested sandbox policies. Coordinated disclosure yielded 13 security advisories, including two CVEs in Anthropic's Git MCP Server.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.22301